PCD Building and testing applications — Timed 40 Questions

Question 1

A team is developing a microservice that processes messages from Pub/Sub. The service is deployed on Cloud Run and uses Cloud Firestore to store processed data. During load testing, the service frequently fails with 'DeadlineExceeded' errors from Firestore. What is the most likely cause and best practice to fix it?

40 minute time limit — choose an answer to begin.

Accepted Answer

Increase the Cloud Run container instance request timeout. The 'DeadlineExceeded' error is raised by the Firestore client-side SDK when the operation exceeds its default timeout (e.g., 60 seconds). However, the underlying cause in this Cloud Run environment is that the default Cloud Run request timeout (5 minutes) is too short for the entire processing pipeline, causing the container to be terminated before the Firestore operation completes. When the container is terminated, the pending Firestore request fails with 'DeadlineExceeded'. Increasing the Cloud Run request timeout prevents premature termination, allowing the Firestore operation to finish within the container's lifetime. This is the most direct fix, as it addresses the infrastructure timeout that triggers the client-side error.

Answer

Increase the Pub/Sub subscription acknowledgment deadline

Answer

Enable CPU always allocation for the Cloud Run service

Answer

Add retry logic with exponential backoff for Firestore operations

Question 2

Your team has developed a containerized application that processes streaming data from Pub/Sub. The application is deployed on Cloud Run. Under normal load, it processes messages within seconds. However, during spikes, processing time increases and some messages are not acknowledged before the Cloud Run request timeout of 60 minutes. You need to ensure that all messages are processed reliably without losing data. You have the following options: A) Increase the Cloud Run request timeout to 120 minutes. B) Use Cloud Run jobs instead of services to handle the processing asynchronously. C) Set up a second subscription to Pub/Sub with a different push endpoint to parallelize processing. D) Use a Cloud Tasks queue to decouple the Pub/Sub push and process messages with retries. Which option should you choose?

Accepted Answer

Use Cloud Run jobs instead of services to handle the processing asynchronously.. Cloud Run jobs are designed for asynchronous, batch-style processing that can run longer than the 60-minute request timeout of Cloud Run services. By using a job, you can pull messages from Pub/Sub, process them without a hard timeout, and acknowledge them only after successful processing, ensuring reliable message handling during spikes.

Answer

Use a Cloud Tasks queue to decouple the Pub/Sub push and process messages with retries.

Answer

Increase the Cloud Run request timeout to 120 minutes.

Answer

Set up a second subscription to Pub/Sub with a different push endpoint to parallelize processing.

Question 3

You are a Cloud Developer working for an e-commerce company. The company uses Cloud Build to build and deploy a Python application to App Engine standard environment. The application uses Cloud SQL for its database. The team recently updated the application code and added a new dependency. The build succeeds, but the deployment fails with 'Error Response: [9] Application startup error!' You check the logs and see 'ImportError: No module named requests'. The team uses a requirements.txt file. However, the requirements.txt file has been configured correctly in the past. The team also uses a custom runtime config in app.yaml with a 'entrypoint' field. They did not change any configuration files. What is the most likely cause of this error?

Accepted Answer

The app.yaml file incorrectly specifies 'runtime: python27' but the code uses Python 3, and python27 does not automatically install dependencies from requirements.txt.. The error 'ImportError: No module named requests' indicates that the dependency was not installed. In App Engine standard, when using 'runtime: python27', dependencies listed in requirements.txt are not automatically installed; you must use a third-party library or vendor them manually. Since the team uses a custom entrypoint in app.yaml, this does not override the runtime's default behavior for Python 2.7, which does not support automatic dependency installation from requirements.txt.

Answer

The custom entrypoint in app.yaml bypasses the automatic installation of dependencies.

Answer

The app.yaml file specifies 'runtime: python39' which is not supported by App Engine standard.

Answer

The requirements.txt file is missing from the deployment directory.

Question 4

A company is developing a microservices application on Google Cloud. Each service is deployed as a Docker container on Cloud Run. The development team wants to ensure that inter-service communication is encrypted and authenticated. What is the best approach?

Accepted Answer

Use Cloud Run's built-in IAM-based authentication and automatic TLS for internal requests.. Cloud Run automatically provisions TLS certificates for all incoming requests and supports IAM-based authentication for internal requests between services in the same Google Cloud project. This means inter-service communication is encrypted by default via HTTPS and can be authenticated by configuring the receiving service to require a valid IAM token from the caller, without any additional infrastructure or sidecar proxies.

Answer

Configure mutual TLS (mTLS) between services using Cloud Endpoints.

Answer

Deploy a sidecar proxy on each Cloud Run service to handle TLS termination.

Answer

Assign a service account to each service and use its private key to sign requests.

Question 5

A developer is designing a CI/CD pipeline for a Node.js application hosted on Cloud Run using Cloud Build. The pipeline should run unit tests, build the container, push to Artifact Registry, and deploy to Cloud Run. The developer wants to minimize build time by caching dependencies. What is the recommended approach?

Accepted Answer

Use Cloud Build's built-in caching with a persistent volume to store node_modules between builds.. Cloud Build supports built-in caching via persistent volumes (e.g., `/cache` or `/workspace`) that can store `node_modules` across builds. By configuring a cache volume in the `cloudbuild.yaml` and using `npm ci --prefer-offline`, the pipeline avoids re-downloading dependencies on every run, significantly reducing build time for Node.js applications on Cloud Run.

Answer

Run npm install locally and commit the node_modules folder to the repository for faster builds.

Answer

Use Cloud Build's step-level caching by copying the node_modules from a previous build step.

Answer

Create a custom base image that includes all dependencies and reference it in the Dockerfile.

Question 6

A developer needs to test a Cloud Function locally before deploying. Which tool should they use?

Accepted Answer

Functions Framework for your language.. The Functions Framework is the correct tool because it is an open-source library that allows you to run Cloud Functions locally on your machine, emulating the Cloud Functions runtime environment. This enables you to test your function's behavior, including HTTP triggers and event handling, without deploying to Google Cloud. Option D is correct because the Functions Framework is specifically designed for local development and testing of Cloud Functions.

Answer

Docker container with a custom entrypoint.

Answer

gcloud functions call command.

Answer

Cloud Code for VS Code or IntelliJ.

Question 7

A team is building a mobile backend on Google Cloud using Cloud Endpoints with Firebase Authentication. They want to protect their API from abuse by implementing rate limiting per user. What approach should they take?

Accepted Answer

Use Apigee API Management as a proxy to enforce rate limiting per developer app.. Apigee API Management is the correct choice because it provides built-in rate limiting policies that can be enforced per developer app, which maps directly to per-user rate limiting when Firebase Authentication is used. Cloud Endpoints does not natively support per-user rate limiting; it relies on the backend to implement such logic, which is not a managed solution. Apigee acts as a proxy that can inspect the Firebase-issued JWT token to identify the user and apply rate limits accordingly, offloading this concern from the backend code.

Answer

Implement rate limiting in the backend code and enforce it via Cloud Endpoints.

Answer

Configure Cloud Armor with a rule to block requests from users exceeding a threshold.

Answer

Use Cloud CDN with a cache key based on the user ID.

Question 8

A company is migrating a monolithic Java application to microservices on Google Kubernetes Engine (GKE). The application uses a shared MySQL database. The team wants to adopt a testing strategy that validates service interactions without deploying to a full cluster. Which testing approach is most appropriate?

Accepted Answer

Consumer-driven contract testing with tools like Spring Cloud Contract.. Consumer-driven contract testing (CDC) with tools like Spring Cloud Contract validates the interactions between microservices by defining and verifying API contracts (e.g., request/response formats, headers, status codes) without requiring a full GKE cluster. This approach is ideal for a migration from a monolithic Java application because it ensures that each service adheres to its expected behavior when communicating over HTTP or messaging, catching integration issues early in the development cycle. It does not require deploying to a cluster, making it faster and more lightweight than end-to-end testing.

Answer

Load testing to simulate production traffic.

Answer

Unit testing with mocked dependencies.

Answer

End-to-end testing in a staging environment.

Question 9

Which TWO statements about building container images for Google Cloud Run are correct? (Choose TWO.)

Accepted Answer

The container must respond to health checks on the same port as the main application.. Cloud Run requires the container to respond to health checks (e.g., HTTP GET /health) on the same port as the main application. Cloud Run uses the same port for both user requests and health check probes; if the health check fails, the container is restarted. This ensures the container is always ready to serve traffic.

Answer

The container must use HTTP/1.1; HTTP/2 is not supported.

Answer

The container must listen on port 8080 by default.

Answer

The container must run as root user.

Question 10

Which THREE steps are required to set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub? (Choose THREE.)

Accepted Answer

Enable the Cloud Build, Cloud Run, and Artifact Registry APIs.. To set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub, three steps are required: (A) enable the Cloud Build, Cloud Run, and Artifact Registry APIs; (B) grant the Cloud Build service account permission to deploy to Cloud Run; and (C) create a cloudbuild.yaml file in the repository root. Option D is incorrect because Container Registry is deprecated and Cloud Run typically uses Artifact Registry. Mirroring the GitHub repository to Cloud Source Repositories (E) is optional, not required.

Answer

Push the container image to Container Registry.

Answer

Mirror the GitHub repository to Cloud Source Repositories.

Question 11

A developer needs to build a CI/CD pipeline that automatically tests and deploys a Node.js application to Cloud Run whenever a pull request is merged to the main branch. Which Google Cloud service should be used to trigger the pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct service because it is Google Cloud's fully managed CI/CD platform that can automatically trigger pipeline executions in response to repository events, such as a pull request merge to the main branch. By configuring a Cloud Build trigger with a source repository (e.g., Cloud Source Repositories, GitHub, or Bitbucket), the developer can define build steps to test the Node.js application and deploy it to Cloud Run using the `gcloud run deploy` command or a dedicated builder. This makes Cloud Build the native and most direct choice for building, testing, and deploying to Cloud Run in a single automated pipeline.

Answer

Cloud Functions

Answer

Cloud Deploy

Answer

App Engine

Question 12

A company deploys a Java application on Compute Engine with a preemptible VM instance group managed by an instance template. The application writes critical state to local SSD. After a preemption event, the new instance starts fresh and loses state. What is the best practice to ensure state persistence?

Accepted Answer

Refactor the application to write state to a persistent service like Cloud Storage. Local SSD data is ephemeral and lost on VM preemption or termination. Refactoring the application to write critical state to a persistent service like Cloud Storage ensures data durability independent of the VM lifecycle. This aligns with the best practice of designing preemptible workloads to be stateless, where state is stored externally.

Answer

Modify the startup script to recover state from a snapshot

Answer

Configure the managed instance group as stateful to preserve local SSD data

Answer

Use a regular (non-preemptible) VM instead of preemptible

Question 13

During a code review, a developer notices that the application's Cloud Storage client library is using the default credentials of the Compute Engine instance. What is a more secure alternative for a production environment?

Accepted Answer

Create a dedicated service account with minimal permissions and attach it to the instance. Creating a dedicated service account with minimal permissions and attaching it to the Compute Engine instance follows the principle of least privilege. This avoids using the overly permissive default Compute Engine service account, which often has broad access to many Google Cloud services. By scoping the service account to only the required Cloud Storage permissions (e.g., roles/storage.objectViewer), you reduce the attack surface and adhere to production security best practices.

Answer

Store user credentials in a configuration file

Answer

Use an API key for Cloud Storage

Answer

Generate an access token and embed it in the code

Question 14

A team is migrating a monolithic .NET application to Cloud Run. The application uses .NET Framework 4.8 and depends on Windows-specific libraries. What is the recommended approach to containerize and deploy this application?

Accepted Answer

Port the application to .NET Core/.NET 6+ and run on Linux. Cloud Run only supports Linux containers, so a .NET Framework 4.8 application that depends on Windows-specific libraries cannot be directly deployed. The recommended approach is to port the application to .NET Core/.NET 6+ (now .NET 8/9), which is cross-platform and can run on Linux containers, enabling deployment to Cloud Run. This aligns with Google's guidance for modernizing legacy .NET applications to leverage serverless platforms.

Answer

Deploy the application on Compute Engine with Windows Server

Answer

Use Cloud Run for Anthos on a Windows node pool

Answer

Use a Windows base image and deploy to Cloud Run

Question 15

Which TWO practices should be followed when integrating Cloud Endpoints with a Cloud Run service to enforce API authentication and rate limiting?

Accepted Answer

Set the audience field in the Endpoints service configuration to the Cloud Run service URL. The `audience` field in the Endpoints service configuration must match the Cloud Run service URL (e.g., `https://myservice-xxxxx-uc.a.run.app`). This ensures that the JWT tokens issued by Google's authentication system are validated against the intended recipient, preventing token reuse across different services. Without this match, authentication will fail because the token's `aud` claim will not match the expected audience.

Answer

Use API keys to authenticate end users

Answer

Deploy Cloud Endpoints as a sidecar container in the same Cloud Run instance

Answer

Configure Cloud Armor rules to enforce rate limiting before requests reach Endpoints

Question 16

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Accepted Answer

Automate the teardown of test resources after test completion. End-to-end testing of a Cloud Run service that interacts with Firestore and Pub/Sub must include automated teardown of test resources (e.g., Pub/Sub topics, subscriptions, Firestore documents) to prevent resource leaks and avoid incurring ongoing costs. Without teardown, leftover resources can cause quota exhaustion and interfere with subsequent test runs, making automation essential for reliable CI/CD pipelines.

Answer

Use the Cloud Run emulator to run the service locally

Answer

Use the Firestore emulator to simulate Firestore operations

Question 17

Refer to the exhibit. A developer deployed a Cloud Run service as shown. Authenticated requests from another service in the same project using a service account receive 403 Forbidden. What is the most likely cause?

Accepted Answer

The service account used to authenticate is not granted the roles/run.invoker role on the Cloud Run service. The Cloud Run service requires the IAM role `roles/run.invoker` on the service itself for any principal (including a service account) to invoke it. Since the service was deployed with `--no-allow-unauthenticated`, only explicitly granted principals can invoke it. The service account used for authentication lacks this role, causing the 403 Forbidden response.

Answer

The Cloud Run service requires the 'allAuthenticatedUsers' member to be added

Answer

The --no-allow-unauthenticated flag blocks all requests including authenticated ones

Answer

The container image was built without proper authentication headers

Question 18

Refer to the exhibit. A developer is configuring Cloud Build to build a Docker image from a Cloud Source Repository. The build fails with a permission error. What is the most likely reason?

Accepted Answer

The service account is missing the roles/source.reader role to access the repository. The build fails with a permission error because the Cloud Build service account does not have the `roles/source.reader` role on the Cloud Source Repository. Without this role, the service account cannot read the source code from the repository, which is required to trigger the build. The error is not about building permissions but about accessing the source.

Answer

The service account lacks the roles/cloudbuild.builds.builder role

Answer

The Cloud Source Repository does not have the build trigger enabled

Answer

The build config file is missing the 'source' field

Question 19

A developer is building a CI/CD pipeline for a microservices application. The pipeline should build a container image, run unit tests, and deploy to Google Kubernetes Engine (GKE) only if all tests pass. Which Google Cloud service is best suited for orchestrating this pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct choice because it is a fully managed CI/CD platform that natively supports building container images, running unit tests, and deploying to GKE. It can be configured with a cloudbuild.yaml file to define steps for building, testing, and deploying, and it only proceeds to the deploy step if all prior steps (including tests) succeed. This makes it the best fit for orchestrating the entire pipeline in a single, integrated service.

Answer

Compute Engine

Answer

Cloud Run

Answer

Cloud Functions

Question 20

A team uses Cloud Source Repositories for version control and Cloud Build for CI. The build configuration file (cloudbuild.yaml) includes a step that runs unit tests. The team wants to ensure that the build fails if any test fails. What should the developer do?

Accepted Answer

Ensure the test command in the build step returns a non-zero exit code when tests fail.. Cloud Build executes each step as a container, and the build step's success or failure is determined by the exit code of the command run inside that container. If the test command (e.g., `npm test` or `pytest`) returns a non-zero exit code when tests fail, Cloud Build will automatically mark that step as failed and stop the build. No special configuration or custom builder is required beyond ensuring the test command itself propagates the failure exit code.

Answer

Use Cloud Build's built-in test runner that automatically fails the build on test failure.

Answer

Create a custom builder that runs tests and emits a non-zero exit code on failure.

Answer

Add a pre-build step that checks test results and triggers a build failure if needed.