PCD Deploying applications — 20 Questions

Question 1

A company has a multi-region Cloud Run service with traffic splitting between revisions. They notice that a newly rolled-out revision is receiving 0% of traffic even though they set traffic to 100% via the console. The revision shows 'Ready: Yes'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The revision has a tag but no traffic percentage assigned; the tag is being used for routing.. When a revision shows 'Ready: Yes' but receives 0% traffic despite setting 100% via the console, the most likely cause is that the revision has a tag assigned but no traffic percentage. In Cloud Run, tags are used for direct URL routing (e.g., for testing) and do not receive any traffic from the service's main URL unless a traffic percentage is explicitly assigned. The console's traffic splitting UI allows setting a tag without a percentage, which can lead to this confusion.

Answer

The revision has a low CPU limit causing it to be throttled.

Answer

The revision is not healthy because of a misconfigured health check.

Answer

The revision has a concurrency setting of 0, which is invalid.

Question 2

A DevOps engineer is automating deployments to Compute Engine using a CI/CD pipeline. They want to minimize downtime and ensure that if a new VM fails health checks, the old VM continues serving. Which deployment strategy should they implement?

Accepted Answer

Blue/green deployment with health checks and a managed instance group. Blue/green deployment with health checks and a managed instance group is correct because it allows the new version (green) to be fully deployed and validated against health checks before any traffic is switched from the old version (blue). If the new VM fails health checks, the managed instance group automatically keeps the old version serving, ensuring zero downtime and immediate rollback without manual intervention.

Answer

Redeploy the old version manually if the new version fails

Answer

Rolling update with a readiness probe

Answer

Canary deployment with a small percentage of traffic

Question 3

A developer deploys a Cloud Function (2nd gen) that processes messages from Pub/Sub. The function sometimes fails with 'Deadline Exceeded' for messages that take longer than 9 minutes. What should the developer do to handle these long-running messages without losing them?

Accepted Answer

Set the Pub/Sub subscription acknowledgment deadline to 10 minutes and implement a push endpoint that acknowledges after processing.. Cloud Functions (2nd gen) have a maximum timeout of 60 minutes, but Pub/Sub push subscriptions have a default acknowledgment deadline of 10 seconds. By setting the acknowledgment deadline to 10 minutes and implementing a push endpoint that acknowledges after processing, the developer ensures the message is not redelivered prematurely while allowing the function up to 10 minutes to complete. This prevents 'Deadline Exceeded' errors for messages that take longer than 9 minutes without losing messages, as the subscription will wait for the acknowledgment before considering the message as failed.

Answer

Configure the function to retry on failure and set a maximum retry count.

Answer

Increase the Cloud Function timeout to 60 minutes.

Answer

Use Cloud Tasks instead of Pub/Sub for asynchronous invocation.

Question 4

A developer runs the above command and receives the error. What is the most likely cause?

Accepted Answer

The cloudbuild.yaml file has a syntax error, such as incorrect indentation.. The error is most likely due to a syntax error in the cloudbuild.yaml file, such as incorrect indentation. Cloud Build uses YAML for configuration, and YAML is sensitive to indentation; a missing space or incorrect alignment can cause the build to fail with a parsing error. The command `gcloud builds submit` reads the cloudbuild.yaml file from the current directory, and if the YAML is malformed, the submission will fail before any Docker or build steps are executed.

Answer

The image tag format is incorrect.

Answer

The cloudbuild.yaml file is not present in the current directory.

Answer

The Dockerfile is missing from the repository.

Question 5

A developer deploys the above app.yaml to App Engine standard environment. The deployment succeeds, but the application fails to connect to the database. What is the most likely reason?

Accepted Answer

The application is trying to connect to a local database on localhost, which is not available in the App Engine sandbox.. In App Engine standard environment, applications run in a sandboxed environment that does not support connections to a local database on localhost. The application code is attempting to connect to a database at 127.0.0.1 or localhost, which is not available in the sandbox. Instead, the application must connect to a Cloud SQL instance using a Unix socket or a private IP, or use a fully managed database service like Firestore.

Answer

The runtime 'python39' is not supported in App Engine standard environment.

Answer

The $PORT environment variable is not set in App Engine standard environment.

Answer

The entrypoint command is incorrect because gunicorn is not allowed.

Question 6

A developer runs the above command to build and push a container image to Container Registry, but receives the error shown. The developer has the 'Cloud Build Editor' role on the project. What is the most likely cause of the error?

Accepted Answer

The Cloud Build service account has not been enabled or does not have permission to act on behalf of the user.. The error occurs because the Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) lacks the necessary permissions to push the container image to Container Registry. Even though the developer has the 'Cloud Build Editor' role, Cloud Build itself needs a service account with appropriate IAM roles (e.g., Storage Object Admin) to write to the registry. The error is not about the developer's direct permissions but about the service account that Cloud Build uses to execute the build and push.

Answer

The Cloud Storage bucket for storing build artifacts does not exist.

Answer

The developer's user account has been revoked access to the project.

Answer

The developer does not have the 'cloudbuild.builds.create' permission because the Cloud Build Editor role does not include it.

Question 7

You are deploying a critical application on Compute Engine. The application requires high availability and must survive a zonal failure. You have created a managed instance group (MIG) with autoscaling across two zones. The application state is stored in a Cloud SQL instance with a read replica in another region. The application also uses a shared static IP address for client access. During a test, you simulate a failure of zone us-central1-a. You observe that the MIG automatically creates new instances in the remaining zone, but the application becomes unreachable for several minutes. What is the most likely cause of the downtime?

Accepted Answer

The load balancer's health check interval and timeout caused a delay in marking the backend instances as unhealthy and routing traffic to the new zone.. The most likely cause is that the load balancer's health check interval and timeout delayed the detection of unhealthy instances in the failed zone, preventing traffic from being rerouted to the new instances in the remaining zone. Even though the MIG created new instances quickly, the load balancer continued sending requests to the failed zone until the health check marked those backends as unhealthy, causing the application to be unreachable during that window.

Answer

The static IP address was not configured to failover to the remaining zone.

Answer

The Cloud SQL read replica did not promote to primary quickly enough.

Answer

The managed instance group's autoscaler took too long to create new instances in the remaining zone.

Question 8

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The development team has built a Docker image and pushed it to Artifact Registry. They want to automate the deployment process so that whenever a new image is pushed to the registry, the application is automatically updated in the GKE cluster. Which combination of services should they use to achieve this?

Accepted Answer

Set up a Cloud Build trigger that monitors the Artifact Registry and runs a build step to update the GKE deployment using kubectl.. Cloud Build can be configured with a trigger that monitors Artifact Registry for new image pushes. When a new image is pushed, the trigger executes a build step that uses kubectl to update the GKE deployment, enabling continuous deployment without manual intervention.

Answer

Use Cloud Deploy to create a delivery pipeline that watches the Artifact Registry and promotes the image to GKE.

Answer

Schedule a Cloud Scheduler job that periodically checks for new images in Artifact Registry and updates the GKE deployment.

Answer

Configure a Cloud Run service that is automatically deployed when a new image is pushed to Artifact Registry.

Question 9

A team is deploying a microservice application on Google Kubernetes Engine (GKE). They want to ensure high availability and minimize downtime during rolling updates. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure pod disruption budgets to limit the number of pods that can be unavailable simultaneously.. PodDisruptionBudgets (PDBs) allow you to specify the minimum number of pods that must remain available during voluntary disruptions like rolling updates, ensuring high availability. Option D is correct because readiness probes control when a pod is added to a Service's endpoints; during rolling updates, they prevent traffic from being sent to a pod until it is ready, minimizing downtime.

Answer

Use Horizontal Pod Autoscaler to automatically adjust the number of pods based on CPU utilization.

Answer

Enable liveness probes to automatically restart pods that become unresponsive.

Answer

Enable node auto-repair to automatically replace unhealthy nodes.

Question 10

Refer to the exhibit. A developer is deploying a container to Cloud Run and receives the error shown. What is the most likely cause?

Accepted Answer

The container is trying to listen on a privileged port (e.g., 80) instead of the expected port 8080.. Cloud Run requires containers to listen on the port specified by the PORT environment variable, which defaults to 8080. The error indicates the container is trying to bind to port 80, a privileged port, which is not allowed by the Cloud Run runtime sandbox. This mismatch causes the container to fail health checks and deployment.

Answer

The container's health check is failing because the startup command is incorrect.

Answer

The PORT environment variable is not set correctly in the Cloud Run service configuration.

Answer

The container image does not exist in the specified registry.

Question 11

Match each IAM role to its description.

Accepted Answer

Viewer: Read-only access to resources. IAM basic roles include Viewer (read-only), Editor (read/write without IAM management), and Owner (full control). The distractors swap these definitions.

Answer

Viewer: Full access to resources

Answer

Editor: Read-only access to resources

Question 12

Match each Cloud CDN feature to its benefit.

Accepted Answer

Caching: Reduces latency by serving content from edge locations. Cloud CDN features like caching, SSL/TLS termination, and compression each provide distinct benefits. Caching reduces latency, SSL/TLS termination improves security, and compression reduces bandwidth. Distractors often mix up these benefits.

Answer

Caching: Improves security by blocking malicious requests

Answer

SSL/TLS termination: Reduces latency by speeding up content delivery

Question 13

Which THREE are valid methods for authenticating a user or service when deploying a Cloud Function via the Google Cloud SDK? (Choose 3)

Accepted Answer

Using a user account with 'gcloud auth login'. 'gcloud auth login' authenticates a user account via OAuth 2.0, which is a valid method for deploying Cloud Functions. The Google Cloud SDK uses the user's credentials to authorize API calls, including deployments, making this a standard authentication approach for interactive or user-driven workflows.

Answer

Using an API key

Answer

Using an OAuth 2.0 client ID

Question 14

A developer runs the command above and receives the error. The developer has just been granted the 'roles/cloudbuild.builds.editor' role on the project. What is the most likely reason for the permission error?

Accepted Answer

The Cloud Build API is not enabled for the project.. The error occurs because the Cloud Build API has not been enabled for the project. Even with the 'roles/cloudbuild.builds.editor' IAM role, the Cloud Build service itself must be explicitly enabled via the Google Cloud Console or using the `gcloud services enable cloudbuild.googleapis.com` command. Without enabling the API, any attempt to run a build will fail with a permission error, as the service is not available to process the request.

Answer

The project ID 'my-project' does not exist or the developer typed it incorrectly.

Answer

The container registry (gcr.io) is incorrect; should use us.gcr.io.

Answer

The developer is using the wrong region; Cloud Build must be enabled per region.

Question 15

A developer deployed the Kubernetes Deployment shown. The application takes about 45 seconds to fully initialize and respond on the /healthz endpoint. What problem will occur with this configuration?

Accepted Answer

The liveness probe will start too early and cause the pod to be restarted before it becomes ready.. The liveness probe has an initialDelaySeconds of 30 seconds, which is less than the application's initialization time of 45 seconds. Therefore, the liveness probe will start checking the /healthz endpoint at 30 seconds, fail, and Kubernetes will restart the pod before it becomes ready. The readiness probe does not prevent the liveness probe from running and causing restarts.

Answer

The readiness probe will never succeed, and the pod will be removed from service.

Answer

The deployment will not create any pods because of a syntax error.

Answer

The pod will be marked ready immediately because the readiness probe uses the same endpoint as liveness.

Question 16

You deployed a microservice on Cloud Run. Users report intermittent 503 errors. The service uses Cloud SQL with connection pooling. What is the most likely cause?

Accepted Answer

The connection pool is drained due to CPU throttling on Cloud Run.. When Cloud Run CPU throttling occurs (e.g., during cold starts or when the instance is processing requests beyond its allocated CPU), the connection pool can become drained because existing connections are held open while new requests cannot be processed. This leads to intermittent 503 errors as the service cannot establish new database connections or respond to incoming requests in time. Connection pooling does not protect against CPU throttling; it only manages database connections efficiently.

Answer

The service is not using a VPC connector for Cloud SQL access.

Answer

The Cloud SQL auth proxy is not configured.

Answer

The Cloud Run service name is not resolvable via Cloud DNS.

Question 17

A company is migrating a monolithic Java application to Cloud Run. The application takes 10 minutes to start. What is the best deployment approach?

Accepted Answer

Optimize the Java application to start within 10 minutes and use startup CPU boost.. Cloud Run allows a maximum container startup time of 10 minutes (600 seconds) by default, and the startup CPU boost feature temporarily allocates additional CPU during startup to accelerate initialization. By optimizing the application to start within this limit and enabling startup CPU boost, the company can directly address the cold start issue without changing the deployment platform or architecture.

Answer

Migrate to App Engine Flexible Environment.

Answer

Use a custom runtime with a cold start optimization.

Answer

Increase the memory limit to 4 GB.

Question 18

You are setting up Cloud Build to automatically deploy a container to Cloud Run when code is pushed to the main branch of a GitHub repository. What is the minimal configuration required?

Accepted Answer

Create a Cloud Build trigger connected to GitHub, and include a cloudbuild.yaml with steps to build and deploy.. Cloud Build triggers can be configured to automatically execute a build pipeline when code is pushed to a GitHub repository. The minimal configuration requires a trigger connected to GitHub and a cloudbuild.yaml file that defines the steps to build the container image and deploy it to Cloud Run using the `gcloud run deploy` command or the `cloudrun` builder. This setup provides a fully automated CI/CD pipeline without additional services.

Answer

Set up GitHub Actions to push images to Container Registry and then use Cloud Run.

Answer

Create a Cloud Build trigger without a build config file, using the inline builder.

Answer

Use Artifact Registry to store images and then manually trigger deployment.

Question 19

Your Cloud Run service experiences high latency during traffic spikes. You need to reduce p95 latency without over-provisioning. Which action should you take?

Accepted Answer

Set min-instances to at least 5 for consistent baseline capacity.. Setting min-instances to at least 5 ensures that a baseline number of container instances are always warm and ready to handle incoming requests. This eliminates cold starts and reduces latency during traffic spikes because new requests can be immediately served by pre-warmed instances, rather than waiting for new containers to spin up. This approach directly reduces p95 latency without over-provisioning, as you only pay for the baseline instances when they are idle.

Answer

Set max-instances to a low number to ensure consistent resources.

Answer

Reduce the max-concurrency per container to 1.

Answer

Disable CPU throttling to always allocate CPU.

Question 20

An application running on Compute Engine instances behind a Cloud Load Balancer experiences intermittent 502 errors. The health checks pass but sometimes requests time out. What is the most likely cause?

Accepted Answer

The connection draining timeout is too short.. A connection draining timeout that is too short can cause the load balancer to close connections prematurely while backend instances are still processing requests. This results in intermittent 502 errors and timeouts, even though health checks pass, as the instances are healthy but connections are being terminated before responses are sent.

Answer

The load balancer is misconfigured with wrong backend type.

Answer

The backend instances are running out of memory.

Answer

The SSL certificate has expired.