PCD Building and testing applications — Timed 20 Questions

Question 1

A developer is designing a CI/CD pipeline for a Node.js application hosted on Cloud Run using Cloud Build. The pipeline should run unit tests, build the container, push to Artifact Registry, and deploy to Cloud Run. The developer wants to minimize build time by caching dependencies. What is the recommended approach?

20 minute time limit — choose an answer to begin.

Accepted Answer

Use Cloud Build's built-in caching with a persistent volume to store node_modules between builds.. Cloud Build supports built-in caching via persistent volumes (e.g., `/cache` or `/workspace`) that can store `node_modules` across builds. By configuring a cache volume in the `cloudbuild.yaml` and using `npm ci --prefer-offline`, the pipeline avoids re-downloading dependencies on every run, significantly reducing build time for Node.js applications on Cloud Run.

Answer

Run npm install locally and commit the node_modules folder to the repository for faster builds.

Answer

Use Cloud Build's step-level caching by copying the node_modules from a previous build step.

Answer

Create a custom base image that includes all dependencies and reference it in the Dockerfile.

Question 2

A team is building a mobile backend on Google Cloud using Cloud Endpoints with Firebase Authentication. They want to protect their API from abuse by implementing rate limiting per user. What approach should they take?

Accepted Answer

Use Apigee API Management as a proxy to enforce rate limiting per developer app.. Apigee API Management is the correct choice because it provides built-in rate limiting policies that can be enforced per developer app, which maps directly to per-user rate limiting when Firebase Authentication is used. Cloud Endpoints does not natively support per-user rate limiting; it relies on the backend to implement such logic, which is not a managed solution. Apigee acts as a proxy that can inspect the Firebase-issued JWT token to identify the user and apply rate limits accordingly, offloading this concern from the backend code.

Answer

Implement rate limiting in the backend code and enforce it via Cloud Endpoints.

Answer

Configure Cloud Armor with a rule to block requests from users exceeding a threshold.

Answer

Use Cloud CDN with a cache key based on the user ID.

Question 3

Which TWO statements about building container images for Google Cloud Run are correct? (Choose TWO.)

Accepted Answer

The container must respond to health checks on the same port as the main application.. Option B is correct because Cloud Run sends startup and liveness probes to the same container port that serves traffic (the port set via the PORT environment variable, default 8080), so the health-check endpoint must be exposed on that port. Option C is correct because Cloud Run instances are ephemeral and can be scaled down or replaced at any time, so any state written to the local filesystem is lost; persistent data must go to external services like Cloud Storage, Firestore, or Cloud SQL. Option A is wrong because Cloud Run supports HTTP/2 (including end-to-end HTTP/2 and gRPC) when configured, so HTTP/1.1 is not the only allowed protocol. Option D is wrong because although 8080 is the default, Cloud Run injects a PORT environment variable and the container may listen on any port it configures, so 8080 is not mandatory. Option E is wrong because Cloud Run does not require running as root and in fact best practice is to run as a non-root user.

Answer

The container must use HTTP/1.1; HTTP/2 is not supported.

Answer

The container must listen on port 8080 by default.

Answer

The container must run as root user.

Question 4

A team is developing a microservice that processes messages from Pub/Sub. The service is deployed on Cloud Run and uses Cloud Firestore to store processed data. During load testing, the service frequently fails with 'DeadlineExceeded' errors from Firestore. What is the most likely cause and best practice to fix it?

Accepted Answer

Increase the Cloud Run container instance request timeout. The 'DeadlineExceeded' error is raised by the Firestore client-side SDK when the operation exceeds its default timeout (e.g., 60 seconds). However, the underlying cause in this Cloud Run environment is that the default Cloud Run request timeout (5 minutes) is too short for the entire processing pipeline, causing the container to be terminated before the Firestore operation completes. When the container is terminated, the pending Firestore request fails with 'DeadlineExceeded'. Increasing the Cloud Run request timeout prevents premature termination, allowing the Firestore operation to finish within the container's lifetime. This is the most direct fix, as it addresses the infrastructure timeout that triggers the client-side error.

Answer

Increase the Pub/Sub subscription acknowledgment deadline

Answer

Enable CPU always allocation for the Cloud Run service

Answer

Add retry logic with exponential backoff for Firestore operations

Question 5

Which TWO practices should be followed when integrating Cloud Endpoints with a Cloud Run service to enforce API authentication and rate limiting?

Accepted Answer

Set the audience field in the Endpoints service configuration to the Cloud Run service URL. Option B is correct because when Cloud Endpoints (ESPv2) validates a JWT for a Cloud Run backend, the audience in the Endpoints service configuration must match the Cloud Run service URL so the token's aud claim is validated against the intended backend. Option C is correct because rate limiting (quota) in Cloud Endpoints is declared in the OpenAPI specification using the x-google-quota extension properties, which the ESPv2 proxy enforces per API key or consumer. Option A is not appropriate because API keys identify projects/apps rather than authenticating end users, and the scenario calls for API authentication. Option D is wrong because Cloud Endpoints is deployed as a separate proxy (ESPv2) in front of Cloud Run, not as a sidecar container inside the same Cloud Run instance. Option E is wrong because Cloud Armor provides edge security (WAF/DDoS) and does not implement Endpoints API-level quota/rate limiting defined in the OpenAPI spec.

Answer

Use API keys to authenticate end users

Answer

Deploy Cloud Endpoints as a sidecar container in the same Cloud Run instance

Answer

Configure Cloud Armor rules to enforce rate limiting before requests reach Endpoints

Question 6

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Accepted Answer

Automate the teardown of test resources after test completion. Option E is correct because creating a separate Google Cloud project for testing provides full isolation of IAM, quotas, billing, and resources, ensuring end-to-end tests never touch production data or services. Option C is correct because Pub/Sub topics and subscriptions are project-scoped resources; provisioning dedicated test topics and subscriptions guarantees the Cloud Run service under test publishes and consumes messages in an isolated channel rather than interfering with production message flows. Option A is correct because end-to-end tests that provision real cloud resources (project, topics, subscriptions) must automate teardown afterward to avoid orphaned resources, quota consumption, and recurring costs. Option B is not required because the Cloud Run emulator only runs the container locally and cannot exercise real Firestore or Pub/Sub integrations needed for true end-to-end testing. Option D is not required because the Firestore emulator only simulates Firestore locally and would not validate the real managed-service behavior that end-to-end testing targets.

Answer

Use the Cloud Run emulator to run the service locally

Answer

Use the Firestore emulator to simulate Firestore operations

Question 7

Refer to the exhibit. A developer is configuring Cloud Build to build a Docker image from a Cloud Source Repository. The build fails with a permission error. What is the most likely reason?

Accepted Answer

The service account is missing the roles/source.reader role to access the repository. The build fails with a permission error because the Cloud Build service account does not have the `roles/source.reader` role on the Cloud Source Repository. Without this role, the service account cannot read the source code from the repository, which is required to trigger the build. The error is not about building permissions but about accessing the source.

Answer

The service account lacks the roles/cloudbuild.builds.builder role

Answer

The Cloud Source Repository does not have the build trigger enabled

Answer

The build config file is missing the 'source' field

Question 8

A developer is deploying a new version of a microservice to Cloud Run. The developer wants to ensure that the new revision is tested with a small percentage of traffic before rolling out to all users. Which TWO approaches can the developer use?

Accepted Answer

Use the 'gcloud run deploy' command with '--no-traffic' and then use 'gcloud run services update-traffic --to-revisions=REVISION=5' to send 5% of traffic.. Option A is correct because deploying with '--no-traffic' creates the new revision without receiving any production traffic, and then 'gcloud run services update-traffic --to-revisions=REVISION=5' explicitly assigns exactly 5% of traffic to that revision, enabling a small-percentage canary test. Option B is correct because the same '--no-traffic' deployment followed by 'gcloud run services update-traffic' allows the developer to progressively shift traffic to the new revision in controlled increments, which is the standard Cloud Run gradual rollout pattern. Option C is incorrect because 'max-instances' only caps the number of container instances for scaling and does not control the percentage of requests routed to a revision. Option D is incorrect because '--tag' creates a tagged URL for direct access to a revision (useful for testing by URL), but it does not split production traffic by percentage. Option E is incorrect because Cloud Run revisions are immutable and uniquely named; you cannot overwrite an existing revision by reusing its name, and this approach would not provide percentage-based traffic testing.

Answer

Set the 'max-instances' parameter to limit the number of instances handling requests.

Answer

Use the 'gcloud run deploy' command with '--tag' to assign a tag to the new revision, then direct test traffic to that tag.

Answer

Deploy the new revision with the same revision name as the old one to overwrite it, then roll back if issues occur.

Question 9

You are a developer for an e-commerce platform running on Google Kubernetes Engine (GKE) with a Cloud SQL backend. The application uses Cloud Memorystore for Redis for session caching. During a flash sale, you notice that the application latency spikes and some users are unable to complete checkout. You suspect the Redis instance is overwhelmed. The Redis instance is currently a Standard tier instance with 5 GB of memory. You need to increase throughput without significant architectural changes. You have the following options: A) Use client-side caching to reduce load on the Redis instance. B) Switch to a Memorystore Standard tier instance with a higher capacity and enable scaling. C) Migrate to a Memorystore Basic tier instance with a larger memory size. D) Enable for Redis clustering on the existing instance to distribute load across shards. Which option should you choose?

Accepted Answer

Switch to a Memorystore Standard tier instance with a higher capacity and enable scaling.. Enabling scaling on a Memorystore Standard tier instance allows you to increase the instance's capacity and throughput without architectural changes. Scaling up the memory size increases the available CPU and network bandwidth, directly addressing the latency spike during the flash sale. This approach maintains the existing Redis configuration and requires no application code changes, unlike clustering or client-side caching.

Answer

Use client-side caching to reduce load on the Redis instance.

Answer

Migrate to a Memorystore Basic tier instance with a larger memory size.

Answer

Enable for Redis clustering on the existing instance to distribute load across shards.

Question 10

Your team has developed a containerized application that processes streaming data from Pub/Sub. The application is deployed on Cloud Run. Under normal load, it processes messages within seconds. However, during spikes, processing time increases and some messages are not acknowledged before the Cloud Run request timeout of 60 minutes. You need to ensure that all messages are processed reliably without losing data. You have the following options: A) Increase the Cloud Run request timeout to 120 minutes. B) Use Cloud Run jobs instead of services to handle the processing asynchronously. C) Set up a second subscription to Pub/Sub with a different push endpoint to parallelize processing. D) Use a Cloud Tasks queue to decouple the Pub/Sub push and process messages with retries. Which option should you choose?

Accepted Answer

Use Cloud Run jobs instead of services to handle the processing asynchronously.. Cloud Run jobs are designed for asynchronous, batch-style processing that can run longer than the 60-minute request timeout of Cloud Run services. By using a job, you can pull messages from Pub/Sub, process them without a hard timeout, and acknowledge them only after successful processing, ensuring reliable message handling during spikes.

Answer

Use a Cloud Tasks queue to decouple the Pub/Sub push and process messages with retries.

Answer

Increase the Cloud Run request timeout to 120 minutes.

Answer

Set up a second subscription to Pub/Sub with a different push endpoint to parallelize processing.

Question 11

Which TWO actions should a developer take to ensure that a Cloud Run service can access a Cloud SQL instance securely?

Accepted Answer

Use the Cloud SQL Auth Proxy as a sidecar container in the same pod.. The Cloud SQL Auth Proxy, when deployed as a sidecar container in the same pod, provides encrypted connections and IAM-based authentication to Cloud SQL without requiring a public IP or complex network configuration. It automatically handles TLS 1.3 encryption and uses the service account's IAM permissions to authorize connections, ensuring secure access from Cloud Run.

Answer

Use a Cloud NAT to provide outbound internet access for the service.

Answer

Assign a public IP to the Cloud SQL instance and allow all traffic from Cloud Run.

Answer

Create a service account with the cloudsql.instances.connect permission.

Question 12

A team is developing a microservice that needs to store user profile images in Cloud Storage. The service is deployed on Cloud Run and will be invoked by other services via HTTP. The images are uploaded by users and the service must validate that the file is an image (e.g., JPEG, PNG) before storing it. The team wants to minimize costs and operational overhead while ensuring that only valid images are stored. The current implementation uploads the file directly to Cloud Storage from the client, but the team wants to add validation in the service. Which approach should the team take?

Accepted Answer

Have the client send the file to the Cloud Run service, validate the file on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library.. It keeps the validation logic within the Cloud Run service, which is already deployed and handling HTTP requests. The service can receive the file via HTTP, validate its MIME type and magic bytes on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library. This minimizes costs (no additional compute services) and operational overhead (single service to manage), while ensuring only valid images are stored.

Answer

Create a separate Cloud Function that receives the file, validates it, and uploads it to Cloud Storage. Invoke the Cloud Function from the client.

Answer

Validate the file on the client side before uploading directly to Cloud Storage, and rely on client-side validation.

Answer

Upload the file to Cloud Storage, then trigger a Cloud Function using Cloud Storage events to validate the file and delete it if invalid.

Question 13

A team is deploying a containerized application to Cloud Run. The application needs to process large files (up to 500 MB) uploaded by users. Which storage approach should they use to avoid Cloud Run's request size limit?

Accepted Answer

Use signed URLs to upload to Cloud Storage. Cloud Run has a default request size limit of 32 MB, which is far below the 500 MB files the application needs to process. Using signed URLs allows users to upload files directly to Cloud Storage, bypassing Cloud Run entirely. This approach avoids the request size limit and offloads the storage and retrieval of large files to a scalable, managed service.

Answer

Upload files directly to Cloud Run

Answer

Mount a Cloud Filestore volume

Answer

Use Cloud Functions as a proxy for uploads

Question 14

A team deploys a stateful application on GKE using StatefulSets. They need to test data persistence after pod rescheduling. Which test scenario best validates this?

Accepted Answer

Delete a pod and verify the new pod has the same data from PersistentVolumeClaim. Deleting a pod in a StatefulSet triggers Kubernetes to reschedule a new pod with the same identity and PersistentVolumeClaim (PVC). The PVC retains the data from the original pod, so verifying that the new pod has the same data directly confirms that the PersistentVolume (PV) is correctly bound and the data persists across pod rescheduling. This tests the core persistence guarantee of StatefulSets without altering the replica count or cluster state.

Answer

Use a CronJob to regularly snapshot the data

Answer

Scale down the StatefulSet to 0 and scale up again, then check data

Answer

Delete the entire cluster and recreate it from backups

Question 15

A team uses Cloud Build to deploy applications that need to access a Cloud SQL database in a VPC. They want to avoid exposing the database to the public internet. Which configuration is required?

Accepted Answer

Configure Cloud Build to use a private pool in the same VPC as the database. Cloud Build private pools run in a customer-managed VPC, allowing workers to directly access resources like Cloud SQL instances via private IP without traversing the public internet. This configuration ensures the database is never exposed to the public internet, meeting the security requirement.

Answer

Enable VPC Network Peering between Cloud Build and the database VPC

Answer

Use Cloud SQL Proxy in a Cloud Build step

Answer

Use a public IP on Cloud SQL and restrict by IP whitelist

Question 16

A developer created a Cloud Function that makes an HTTP request to an external API. The above error occurs intermittently. The external API is working correctly. What is the most likely cause?

Accepted Answer

The request to the external API has incorrect headers or payload. Intermittent failures on an HTTP call to a healthy external API most commonly stem from malformed requests — incorrect headers (e.g., missing Content-Type, bad Authorization token) or payloads that only fail under certain conditions (e.g., specific input values, expired tokens). Since the API itself works, the fault lies in how the function constructs the request.

Answer

The function is not handling network retries properly

Answer

The Cloud Function is not deployed in the same region as the API

Answer

The function is timing out due to long response time

Question 17

A company uses Cloud Build to build multiple microservices. They want to reuse a set of build steps across all services. What is the most maintainable approach?

Accepted Answer

Use Cloud Build substitutions. Cloud Build substitutions allow you to define reusable variables in a central configuration, enabling you to parameterize build steps across multiple microservices without duplicating code. By referencing substitution variables (e.g., $_SERVICE_NAME) in a single cloudbuild.yaml, you can maintain one source of truth for common steps, making updates easier and reducing errors. This approach is more maintainable than copying steps because changes propagate automatically to all services.

Answer

Copy the steps into each service's cloudbuild.yaml

Answer

Create a custom builder image with the steps

Answer

Use Cloud Build triggers with a common config file

Question 18

A team is setting up a CI/CD pipeline for a Node.js App Engine application using Cloud Build. The source code is in Cloud Source Repositories. What must be configured to automatically run unit tests before deployment?

Accepted Answer

Add a cloudbuild.yaml file with a test step. Cloud Build uses a cloudbuild.yaml file to define build steps, and adding a test step ensures unit tests run automatically before deployment. Without this configuration, Cloud Build will not execute tests; it only runs the steps explicitly defined in the build configuration file.

Answer

Enable Cloud Build triggers on the repository

Answer

Use the App Engine deployment wizard

Answer

Use a Dockerfile to run tests

Question 19

During a Cloud Build run, a developer sees the error: "Step #0: error: failed to fetch metadata: connection refused". The build is trying to access a private Docker registry in a different project. What is the most likely cause?

Accepted Answer

The build environment cannot reach the registry due to network restrictions. The error 'connection refused' indicates a network connectivity issue, not an authentication or authorization problem. The most likely cause is that the build environment (Cloud Build) cannot reach the private Docker registry in the other project due to network restrictions such as VPC Service Controls, firewall rules, or the registry being in a different VPC network. Authentication errors would typically show 'denied' or 'unauthorized'. Therefore, option B is correct.

Answer

The registry does not exist

Answer

The build service account lacks IAM permissions to the registry

Answer

The build is using a public pool with no access to internal networks

Question 20

A developer is using Cloud Functions and wants to ensure that their testing environment mirrors production as closely as possible. Which approach should they take?

Accepted Answer

Use the Functions Framework with a simulated production event. The Functions Framework is a local emulator that allows developers to run Cloud Functions locally with the same invocation context and event triggers as in production. By using the Functions Framework with a simulated production event, you can test your function's behavior, including event data parsing and response handling, without deploying to any cloud environment, ensuring the testing environment mirrors production as closely as possible.

Answer

Use Cloud Build to run tests before deployment

Answer

Run all tests in Cloud Shell

Answer

Deploy to a staging Cloud Function and run tests against it