PCD Deploying applications — 40 Questions

Question 1

You are deploying a critical application on Compute Engine. The application requires high availability and must survive a zonal failure. You have created a managed instance group (MIG) with autoscaling across two zones. The application state is stored in a Cloud SQL instance with a read replica in another region. The application also uses a shared static IP address for client access. During a test, you simulate a failure of zone us-central1-a. You observe that the MIG automatically creates new instances in the remaining zone, but the application becomes unreachable for several minutes. What is the most likely cause of the downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The load balancer's health check interval and timeout caused a delay in marking the backend instances as unhealthy and routing traffic to the new zone.. The most likely cause is that the load balancer's health check interval and timeout delayed the detection of unhealthy instances in the failed zone, preventing traffic from being rerouted to the new instances in the remaining zone. Even though the MIG created new instances quickly, the load balancer continued sending requests to the failed zone until the health check marked those backends as unhealthy, causing the application to be unreachable during that window.

Answer

The static IP address was not configured to failover to the remaining zone.

Answer

The Cloud SQL read replica did not promote to primary quickly enough.

Answer

The managed instance group's autoscaler took too long to create new instances in the remaining zone.

Question 2

An organization deploys a critical application on GKE with multiple namespaces. They want to enforce that only certain images from approved Artifact Registry repositories can be deployed in the production namespace. Which GKE feature should they use?

Accepted Answer

Binary Authorization. Binary Authorization is the correct GKE feature because it enforces deployment-time policy controls that require container images to be signed by trusted authorities and originate from approved Artifact Registry repositories. By configuring an admission webhook with Binary Authorization, the organization can create an attestation policy that blocks any pod in the production namespace from running unless its image has a valid cryptographic signature from a trusted signer and the image path matches an allowed Artifact Registry host.

Answer

Network Policies

Answer

Workload Identity

Answer

Pod Security Policies (deprecated)

Question 3

After updating the image to v2, users report that the frontend application returns errors because it cannot reach the backend service. The backend service is running on GKE with the name 'backend-service' in the same namespace. What is the most likely cause?

Accepted Answer

The application expects the backend URL from an environment variable named BACKEND_SERVICE_URL, but the deployment sets BACKEND_URL.. The most likely cause is that the frontend application expects the backend URL from an environment variable named `BACKEND_SERVICE_URL`, but the deployment sets `BACKEND_URL`. This mismatch means the frontend cannot resolve the backend endpoint, leading to connection errors. In Kubernetes, environment variables are commonly used to pass service discovery information, and a naming mismatch directly breaks the application's ability to reach the backend.

Answer

The selector labels do not match the pods.

Answer

The backend service is not listening on port 8080.

Answer

The termination grace period is too short causing connection drops.

Question 4

A team deploys a containerized web application on Google Kubernetes Engine (GKE) using a Deployment. They need to expose the application externally via a stable IP address and enable SSL termination. Which resource should they use?

Accepted Answer

Ingress with Google-managed SSL certificate. An Ingress with a Google-managed SSL certificate is the correct choice because it provides a single stable IP address via a global forwarding rule, terminates SSL at the Google Cloud HTTP(S) load balancer, and routes traffic to the GKE Deployment. This approach offloads SSL decryption from the application pods and uses a managed certificate that auto-renews, meeting both the stable IP and SSL termination requirements.

Answer

HorizontalPodAutoscaler

Answer

Service type NodePort

Answer

Service type LoadBalancer

Question 5

During a deployment to App Engine flexible environment, the new version fails to start and the logs show 'Container failed to start: context deadline exceeded'. The previous version remains serving traffic. What is the most likely cause?

Accepted Answer

The container startup time exceeds the 10-minute timeout.. The error 'context deadline exceeded' in App Engine flexible environment indicates that the container did not start within the allowed startup timeout. The default timeout for container startup in App Engine flexible is 10 minutes, and if the application takes longer (e.g., due to slow initialization, large dependency downloads, or database migrations), the platform kills the container and logs this error. The previous version continues serving because the new version failed to become healthy.

Answer

The health check is misconfigured, causing the instance to be considered unhealthy.

Answer

The app requires an environment variable that is not set.

Answer

The Dockerfile has a syntax error that prevents the container from building.

Question 6

A company has a multi-region Cloud Run service with traffic splitting between revisions. They notice that a newly rolled-out revision is receiving 0% of traffic even though they set traffic to 100% via the console. The revision shows 'Ready: Yes'. What is the most likely cause?

Accepted Answer

The revision has a tag but no traffic percentage assigned; the tag is being used for routing.. When a revision shows 'Ready: Yes' but receives 0% traffic despite setting 100% via the console, the most likely cause is that the revision has a tag assigned but no traffic percentage. In Cloud Run, tags are used for direct URL routing (e.g., for testing) and do not receive any traffic from the service's main URL unless a traffic percentage is explicitly assigned. The console's traffic splitting UI allows setting a tag without a percentage, which can lead to this confusion.

Answer

The revision has a low CPU limit causing it to be throttled.

Answer

The revision is not healthy because of a misconfigured health check.

Answer

The revision has a concurrency setting of 0, which is invalid.

Question 7

A DevOps engineer is automating deployments to Compute Engine using a CI/CD pipeline. They want to minimize downtime and ensure that if a new VM fails health checks, the old VM continues serving. Which deployment strategy should they implement?

Accepted Answer

Blue/green deployment with health checks and a managed instance group. Blue/green deployment with health checks and a managed instance group is correct because it allows the new version (green) to be fully deployed and validated against health checks before any traffic is switched from the old version (blue). If the new VM fails health checks, the managed instance group automatically keeps the old version serving, ensuring zero downtime and immediate rollback without manual intervention.

Answer

Redeploy the old version manually if the new version fails

Answer

Rolling update with a readiness probe

Answer

Canary deployment with a small percentage of traffic

Question 8

A developer deploys a Cloud Function (2nd gen) that processes messages from Pub/Sub. The function sometimes fails with 'Deadline Exceeded' for messages that take longer than 9 minutes. What should the developer do to handle these long-running messages without losing them?

Accepted Answer

Set the Pub/Sub subscription acknowledgment deadline to 10 minutes and implement a push endpoint that acknowledges after processing.. Cloud Functions (2nd gen) have a maximum timeout of 60 minutes, but Pub/Sub push subscriptions have a default acknowledgment deadline of 10 seconds. By setting the acknowledgment deadline to 10 minutes and implementing a push endpoint that acknowledges after processing, the developer ensures the message is not redelivered prematurely while allowing the function up to 10 minutes to complete. This prevents 'Deadline Exceeded' errors for messages that take longer than 9 minutes without losing messages, as the subscription will wait for the acknowledgment before considering the message as failed.

Answer

Configure the function to retry on failure and set a maximum retry count.

Answer

Increase the Cloud Function timeout to 60 minutes.

Answer

Use Cloud Tasks instead of Pub/Sub for asynchronous invocation.

Question 9

Which TWO statements about deploying applications on Google Kubernetes Engine (GKE) are correct?

Accepted Answer

HorizontalPodAutoscaler can use custom metrics from Cloud Monitoring.. HorizontalPodAutoscaler (HPA) in GKE can scale pods based on custom metrics from Cloud Monitoring (formerly Stackdriver). This is achieved by using the custom.metrics.k8s.io API, which allows HPA to query metrics like custom application latency or queue depth, not just default CPU/memory. This enables fine-grained, application-specific autoscaling.

Answer

Kubernetes Secrets are encrypted at rest by default.

Answer

A zonal GKE cluster automatically uses regional persistent disks for high availability.

Answer

To expose a Deployment externally, you must create an Ingress resource.

Question 10

Which THREE practices should be followed when deploying a containerized application to Cloud Run?

Accepted Answer

Avoid writing to the local filesystem for data that must persist across requests.. Cloud Run instances are ephemeral and the local filesystem is not persisted across requests or instance restarts. Writing to local disk for data that must survive beyond a single request will cause data loss when the instance is recycled, which is a fundamental characteristic of serverless container platforms.

Answer

Set a maximum request timeout of 10 minutes to avoid cold starts.

Answer

Hardcode port 8080 in the container.

Question 11

A developer runs the above command and receives the error. What is the most likely cause?

Accepted Answer

The cloudbuild.yaml file has a syntax error, such as incorrect indentation.. The error is most likely due to a syntax error in the cloudbuild.yaml file, such as incorrect indentation. Cloud Build uses YAML for configuration, and YAML is sensitive to indentation; a missing space or incorrect alignment can cause the build to fail with a parsing error. The command `gcloud builds submit` reads the cloudbuild.yaml file from the current directory, and if the YAML is malformed, the submission will fail before any Docker or build steps are executed.

Answer

The image tag format is incorrect.

Answer

The cloudbuild.yaml file is not present in the current directory.

Answer

The Dockerfile is missing from the repository.

Question 12

A developer deploys the above app.yaml to App Engine standard environment. The deployment succeeds, but the application fails to connect to the database. What is the most likely reason?

Accepted Answer

The application is trying to connect to a local database on localhost, which is not available in the App Engine sandbox.. In App Engine standard environment, applications run in a sandboxed environment that does not support connections to a local database on localhost. The application code is attempting to connect to a database at 127.0.0.1 or localhost, which is not available in the sandbox. Instead, the application must connect to a Cloud SQL instance using a Unix socket or a private IP, or use a fully managed database service like Firestore.

Answer

The runtime 'python39' is not supported in App Engine standard environment.

Answer

The $PORT environment variable is not set in App Engine standard environment.

Answer

The entrypoint command is incorrect because gunicorn is not allowed.

Question 13

A company wants to deploy a containerized application on Google Kubernetes Engine (GKE) with zero downtime during updates. The application is stateless and runs on a Deployment with 5 replicas. Which deployment strategy should be used?

Accepted Answer

Rolling update. A rolling update is the default deployment strategy in Kubernetes and is ideal for stateless applications requiring zero downtime. It gradually replaces old Pods with new ones, ensuring that a minimum number of replicas remain available throughout the update. This strategy is configured via the `strategy.type: RollingUpdate` field in the Deployment spec, with parameters like `maxSurge` and `maxUnavailable` controlling the pace.

Answer

Blue/green deployment

Answer

Recreate update

Answer

Canary deployment

Question 14

A developer is deploying a Cloud Run service that needs to access a Cloud SQL instance. The service is deployed with the --no-allow-unauthenticated flag. What is the recommended way to grant the service access to the database?

Accepted Answer

Grant the Cloud SQL Client role to the Cloud Run service's runtime service account.. The recommended way to grant a Cloud Run service access to a Cloud SQL instance is to grant the Cloud SQL Client role (roles/cloudsql.client) to the Cloud Run service's runtime service account. This role provides the necessary permissions (cloudsql.instances.connect and cloudsql.instances.get) to establish a secure connection via the Cloud SQL Auth Proxy or the Cloud SQL connector library. Using the runtime service account follows the principle of least privilege and avoids managing long-lived credentials.

Answer

Create a service account key and store it in Secret Manager, then mount it as a volume.

Answer

Use the default Compute Engine service account and grant it the Cloud SQL Client role.

Answer

Enable the Cloud SQL Admin API and use Application Default Credentials from the Cloud Run service.

Question 15

A company is deploying a microservices architecture on GKE. They need to expose a set of related microservices under a single external IP address with path-based routing. Which Kubernetes resource should they use?

Accepted Answer

Ingress resource. An Ingress resource is the correct choice because it provides HTTP/HTTPS layer-7 routing to expose multiple services under a single external IP address, using path-based or host-based rules. This directly meets the requirement of exposing a set of related microservices with path-based routing on GKE, whereas a Service of type LoadBalancer would create a separate external IP per service.

Answer

Service of type NodePort

Answer

NetworkPolicy

Answer

Service of type LoadBalancer

Question 16

A developer needs to deploy a Python application to App Engine flexible environment. The application requires a specific version of a system package (libssl-dev) that is not included in the default runtime image. How should the developer install this package?

Accepted Answer

Create a Dockerfile that uses the base runtime image and runs apt-get install.. The App Engine flexible environment runs your application in a Docker container based on a Google-provided runtime image. To install system packages like libssl-dev that are not included in the default image, you must customize the container by creating a Dockerfile that starts FROM the base runtime image and then runs apt-get install. This is the standard method for adding OS-level dependencies in the flexible environment.

Answer

Use a custom runtime that already includes the package.

Answer

Specify the package in the app.yaml file under the 'libraries' section.

Answer

Add the package name to the requirements.txt file.

Question 17

Which TWO of the following are best practices when deploying applications on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across nodes.. Pod anti-affinity ensures pods are scheduled across different nodes, improving fault tolerance and high availability. This is a best practice for stateless applications to avoid a single point of failure during node failures. Option D is correct because defining resource requests and limits allows the Kubernetes scheduler to make informed placement decisions and prevents resource starvation, ensuring predictable application performance.

Answer

Store sensitive configuration data in environment variables.

Answer

Skip liveness and readiness probes for stateless applications.

Answer

Use the default Compute Engine service account for pods.

Question 18

A developer runs the above command to build and push a container image to Container Registry, but receives the error shown. The developer has the 'Cloud Build Editor' role on the project. What is the most likely cause of the error?

Accepted Answer

The Cloud Build service account has not been enabled or does not have permission to act on behalf of the user.. The error occurs because the Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) lacks the necessary permissions to push the container image to Container Registry. Even though the developer has the 'Cloud Build Editor' role, Cloud Build itself needs a service account with appropriate IAM roles (e.g., Storage Object Admin) to write to the registry. The error is not about the developer's direct permissions but about the service account that Cloud Build uses to execute the build and push.

Answer

The Cloud Storage bucket for storing build artifacts does not exist.

Answer

The developer's user account has been revoked access to the project.

Answer

The developer does not have the 'cloudbuild.builds.create' permission because the Cloud Build Editor role does not include it.

Question 19

Your company is deploying a web application on Cloud Run using a continuous deployment pipeline from Cloud Build. The application is built as a Docker container and pushed to Container Registry. The Cloud Run service is configured with the '--no-allow-unauthenticated' flag. You have set up Cloud Build triggers to build and deploy on commits to the main branch. The deployment works correctly for the first few commits, but after adding a new environment variable in the Cloud Build configuration file (cloudbuild.yaml), the deployment fails with an error that the Cloud Run service cannot be updated because the new revision fails health checks. The application code has not changed. What is the most likely cause?

Accepted Answer

The new environment variable causes the application to fail its startup or health check.. The application code has not changed, yet the deployment fails health checks immediately after adding a new environment variable. This indicates that the application is likely reading that variable at startup and crashing or failing its readiness probe due to an invalid value, missing dependency, or misconfiguration. Cloud Run requires the new revision to pass health checks (e.g., HTTP GET on the configured port) before it can serve traffic; if the variable causes the app to exit or hang, the revision is considered unhealthy and the update is rejected.

Answer

The Cloud Build service account does not have permission to update the Cloud Run service.

Answer

The new environment variable exceeds the maximum size limit for environment variables in Cloud Run.

Answer

The health check configuration in the Cloud Run service was overwritten by the new deployment.

Question 20

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The development team has built a Docker image and pushed it to Artifact Registry. They want to automate the deployment process so that whenever a new image is pushed to the registry, the application is automatically updated in the GKE cluster. Which combination of services should they use to achieve this?

Accepted Answer

Set up a Cloud Build trigger that monitors the Artifact Registry and runs a build step to update the GKE deployment using kubectl.. Cloud Build can be configured with a trigger that monitors Artifact Registry for new image pushes. When a new image is pushed, the trigger executes a build step that uses kubectl to update the GKE deployment, enabling continuous deployment without manual intervention.

Answer

Use Cloud Deploy to create a delivery pipeline that watches the Artifact Registry and promotes the image to GKE.

Answer

Schedule a Cloud Scheduler job that periodically checks for new images in Artifact Registry and updates the GKE deployment.

Answer

Configure a Cloud Run service that is automatically deployed when a new image is pushed to Artifact Registry.