PCD Building and testing applications Practice Test 7 — 15 Questions

Question 1

A team uses Cloud Build to deploy a containerized application to Cloud Run. The build step fails intermittently with the error 'Failed to trigger build: Build timed out'. What is the most likely cause?

Accepted Answer

The build exceeds the default Cloud Build timeout.. The error 'Failed to trigger build: Build timed out' indicates that the Cloud Build execution exceeded the maximum allowed duration. By default, Cloud Build has a timeout of 10 minutes for build steps. If the build process (e.g., pulling dependencies, building the container image) takes longer than this default timeout, the build is automatically terminated, resulting in this intermittent failure. Increasing the timeout in the build configuration or using a larger machine type can resolve this.

Answer

The build machine has insufficient memory.

Answer

The Dockerfile contains invalid syntax.

Answer

The Cloud Build service account lacks permissions to deploy to Cloud Run.

Question 2

A development team is implementing a CI/CD pipeline using Cloud Build. They need to ensure that sensitive data, such as API keys, are never exposed in build logs. What is the best practice?

Accepted Answer

Use Cloud Build's encrypted variables or Secret Manager to pass secrets at build time.. Option A is correct because Cloud Build's encrypted variables and Secret Manager are designed to securely inject sensitive data like API keys at build time without exposing them in logs. Encrypted variables are stored in Cloud KMS and decrypted only during the build, while Secret Manager provides versioned secrets with fine-grained access control. This ensures secrets never appear in plaintext in the build configuration or output logs.

Answer

Store the API keys in a separate file in the source repository and reference it in the build.

Answer

Use custom substitutions with default values and rely on Cloud Build's encryption.

Answer

Store the API keys as plain text in cloudbuild.yaml and restrict access to the file.

Question 3

A company deploys a microservice on Google Kubernetes Engine (GKE) with a Cloud Deploy delivery pipeline. The application uses a custom container image stored in Artifact Registry. After a successful deployment to a staging cluster, the production deployment fails with 'ImagePullErr: image not found'. The staging and production clusters are in different projects. What is the most likely cause?

Accepted Answer

The production cluster's node pool has not been granted access to pull images from Artifact Registry in the staging project.. Option C is correct because the production cluster's node pool, which runs in a different project, does not have the necessary permissions to pull the custom container image from Artifact Registry in the staging project. By default, GKE node pools use the Compute Engine default service account, which only has access to images in the same project. To pull images across projects, the node pool's service account must be granted the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in the staging project.

Answer

The Cloud Deploy service account lacks permission to create pods in the production cluster.

Answer

Cloud Deploy is not configured to use Artifact Registry and still references Container Registry.

Answer

The container image tag used in production is different from the staging tag.

Question 4

A developer is writing unit tests for a Python application that will run on Cloud Functions. The function makes HTTP requests to an external API. The developer wants to avoid making actual network calls during tests. What should the developer use?

Accepted Answer

Mock the HTTP requests using a library like unittest.mock.. Option D is correct because `unittest.mock` allows the developer to replace the actual HTTP request calls (e.g., `requests.get`) with mock objects that return controlled responses, preventing any real network traffic. This is essential for unit testing Cloud Functions where external API calls must be isolated to ensure tests are fast, deterministic, and do not depend on external services.

Answer

Use a test double to replace the entire function.

Answer

Use dependency injection to pass a fallback URL.

Answer

Deploy the function to Cloud Functions and run integration tests.

Question 5

A team uses Cloud Build to build and deploy a Node.js application to App Engine flexible environment. The build succeeds, but the deployment fails with 'ERROR: (gcloud.app.deploy) Error Response: [9] Application startup error!' The team checks logs and sees 'Error: Module not found: 'express''. What is the most likely cause?

Accepted Answer

The dependencies are not installed during the build step before deploying.. Option A is correct because the dependencies must be installed in the build step for them to be available at runtime. Option B is wrong because 'npm test' failure would not cause deployment error in this context. Option C is wrong because app.yaml is not in the root could cause a different error if not specified. Option D is wrong because Node.js version mismatch would give a different error.

Answer

The build step includes 'npm test' which fails.

Answer

The Node.js version specified in app.yaml is incompatible with the dependencies.

Answer

The app.yaml file is missing from the root of the repository.

Question 6

A company is using Cloud Deploy to manage canary deployments to GKE. They want to automatically promote a release to the 'production' target if the canary deployment in the 'staging' target passes a set of automated smoke tests. What is the required configuration?

Accepted Answer

Define a deployment verifier in the pipeline that runs smoke tests and promotes on success.. Option B is correct because Cloud Deploy supports deployment verifiers, which are custom Cloud Build jobs that run as part of a rollout. By defining a verifier in the pipeline that executes automated smoke tests, the canary deployment in the staging target can be automatically promoted to production only if the verifier succeeds. This integrates testing directly into the delivery pipeline without manual intervention.

Answer

Create a Cloud Build trigger to redeploy on test success.

Answer

Configure a manual approval gate between staging and production in the delivery pipeline.

Answer

Set the 'automaticPromotion' flag to true on the staging target.

Question 7

A developer is writing integration tests for a Cloud Function that uses Cloud Firestore. The tests must run in a local environment without incurring costs or affecting production data. What should the developer use?

Accepted Answer

Use the Firestore emulator running locally.. Option C is correct because the Firestore emulator, part of the Firebase Local Emulator Suite, allows integration tests to run entirely on the local machine without network calls to GCP. This avoids incurring costs and prevents any impact on production data, as all operations are performed against an in-memory Firestore instance that mimics the real service's behavior.

Answer

Create a separate GCP project for testing and use its Firestore.

Answer

Mock the Firestore client library calls.

Answer

Run tests against the production Firestore instance with a test prefix.

Question 8

A team uses Cloud Build to build a Go application and deploy it to Cloud Run. The build triggers from a GitHub repository. The team wants to ensure that only commits to the 'main' branch trigger a production deployment, while other branches trigger a build but not a deployment. How should they configure this?

Accepted Answer

Use a single Cloud Build trigger with a substitution variable for the branch name, and include a conditional step that runs deployment only when the variable equals 'main'.. Option C is correct because Cloud Build supports substitution variables like $_BRANCH, which automatically receive the branch name from the trigger event. By using a conditional step in cloudbuild.yaml that checks if $_BRANCH equals 'main', you can run the deployment step only for main branch commits, while still building on all branches. This approach keeps a single trigger and avoids unnecessary duplication or external filtering.

Answer

Configure the GitHub repository to only send push events from the main branch to Cloud Build.

Answer

Use a conditional step in cloudbuild.yaml that checks the $_BRANCH variable and skips deployment if not main.

Answer

Create two separate Cloud Build triggers: one for main branch with deployment step, and one for all branches without deployment step.

Question 9

An organization uses Cloud Build to deploy multiple microservices to GKE. They want to ensure that the deployment process can be audited and that each deployment can be rolled back to a previous version. What is the recommended approach?

Accepted Answer

Use Cloud Deploy to manage deployments with rollback capabilities and audit logs.. Cloud Deploy is the recommended service for managing progressive deliveries and rollbacks on GKE, as it provides built-in rollback capabilities, audit logging, and delivery pipeline management. Unlike raw Kubernetes Deployment history, Cloud Deploy integrates with Cloud Build and offers a controlled, auditable deployment process with the ability to roll back to any previous release revision.

Answer

Use Kubernetes Deployment history to rollback by specifying a revision.

Answer

Store each manifest version in Artifact Registry and manually apply kubectl.

Answer

Use Cloud Build to redeploy a previous image tag when rollback is needed.

Question 10

Which TWO of the following are valid strategies for testing Cloud Functions locally before deployment?

Accepted Answer

Use the Cloud Functions emulator provided by gcloud beta emulators.. Option C is correct because the `gcloud beta emulators` command includes a Cloud Functions emulator that allows you to run your functions locally in a simulated environment, enabling testing without deploying to the cloud. Option D is correct because the Functions Framework is an open-source library that starts a local HTTP server (typically on port 8080) and serves your function, matching the Cloud Functions runtime environment exactly.

Answer

Write unit tests that mock the HTTP request and response objects.

Answer

Use the Cloud Console to invoke the function with test events.

Answer

Deploy the function to a staging Cloud Functions project and test via HTTP invocations.

Question 11

Which THREE of the following are best practices for building secure applications on Google Cloud?

Accepted Answer

Use Secret Manager to manage sensitive configuration values.. Option A is correct because Secret Manager provides a centralized and secure way to store and manage sensitive configuration values such as API keys, database passwords, and certificates. By using Secret Manager, you avoid hardcoding secrets in source code or configuration files, reducing the risk of exposure. It integrates with IAM for fine-grained access control and supports automatic rotation, ensuring that secrets are protected at rest and in transit.

Answer

Disable authentication on a test Cloud Run service for end-user testing.

Answer

Use a single service account for all Cloud Functions to simplify permissions.

Question 12

Which THREE of the following are valid reasons to use Cloud Deploy instead of manually applying kubectl commands in a CI/CD pipeline?

Accepted Answer

Cloud Deploy maintains a deployment history for auditing.. Option B is correct because Cloud Deploy automatically maintains a detailed deployment history, including the state of each rollout, approvals, and metadata. This history is stored in the Cloud Deploy API and can be queried for auditing, compliance, and troubleshooting purposes, which is not natively provided by manual kubectl commands in a CI/CD pipeline.

Answer

Cloud Deploy automatically containerizes applications.

Answer

Cloud Deploy enforces IAM roles on Kubernetes clusters.

Question 13

You are a Cloud Developer at a fintech company. Your team has developed a Node.js application that processes real-time financial transactions. The application is deployed on Cloud Run and uses Cloud Pub/Sub to receive transaction messages. The application must have high availability and low latency. Recently, the team noticed that during peak hours, the application experiences increased latency and some messages are not processed within the required 10-minute SLA. The team has configured Cloud Run with a minimum of 5 instances and a maximum of 50, with a concurrency setting of 80. The CPU usage per instance rarely exceeds 40% during peak times. The team also uses Cloud Monitoring and Logging for observability. After analyzing the logs, you find that the message processing time increases due to a database call that often takes 2-3 seconds. The Pub/Sub subscription is configured with a delivery deadline of 10 minutes. What should you recommend to reduce latency and ensure messages are processed within SLA?

Accepted Answer

Increase the concurrency setting to 200 to allow each instance to handle more requests simultaneously, reducing queuing.. Increasing the concurrency setting to 200 allows each Cloud Run instance to handle more requests simultaneously, which reduces the queuing delay caused by the 2-3 second database call. Since CPU usage is only 40%, the instances have headroom to process additional concurrent requests without being CPU-bound, directly addressing the latency issue within the 10-minute SLA.

Answer

Migrate the application to GKE with Horizontal Pod Autoscaler to scale based on custom metrics.

Answer

Increase the CPU limit per container to 2 CPUs to speed up database call.

Answer

Increase the minimum number of instances to 50 to ensure capacity during peak hours.

Question 14

You are a Cloud Developer working for an e-commerce company. The company uses Cloud Build to build and deploy a Python application to App Engine standard environment. The application uses Cloud SQL for its database. The team recently updated the application code and added a new dependency. The build succeeds, but the deployment fails with 'Error Response: [9] Application startup error!' You check the logs and see 'ImportError: No module named requests'. The team uses a requirements.txt file. However, the requirements.txt file has been configured correctly in the past. The team also uses a custom runtime config in app.yaml with a 'entrypoint' field. They did not change any configuration files. What is the most likely cause of this error?

Accepted Answer

The app.yaml file incorrectly specifies 'runtime: python27' but the code uses Python 3, and python27 does not automatically install dependencies from requirements.txt.. Option D is correct because App Engine standard environment uses the Python 3 runtime and does not install dependencies from requirements.txt automatically unless the runtime is Python 3 and the file is present. If the runtime is Python 2.7, it uses app.yaml to specify libraries. Given the error, likely the wrong runtime. Option A is wrong because the file is present and hasn't changed. Option B is wrong because the entrypoint field doesn't affect dependency installation. Option C is wrong because there is no 'runtime: python39' field; it's 'python39' as a runtime value.

Answer

The custom entrypoint in app.yaml bypasses the automatic installation of dependencies.

Answer

The app.yaml file specifies 'runtime: python39' which is not supported by App Engine standard.

Answer

The requirements.txt file is missing from the deployment directory.

Question 15

A company is building a microservice that processes incoming HTTP requests, performs some business logic, and writes results to Firestore. The service has variable traffic with occasional spikes. The development team wants to minimize cold start latency and prefers to use a containerized application with a custom runtime. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it runs containerized applications in a fully managed, serverless environment that automatically scales to zero and can handle variable traffic with occasional spikes. It minimizes cold start latency by keeping instances warm when traffic is expected, and it supports custom runtimes via Docker containers, meeting the team's requirement for a containerized application with a custom runtime.

Answer

Compute Engine

Answer

App Engine Standard

Answer

Cloud Functions (1st gen)