PCD Deploying applications Practice Test 2 — 15 Questions

Question 1

A developer needs to deploy a Python application to App Engine flexible environment. The application requires a specific version of a system package (libssl-dev) that is not included in the default runtime image. How should the developer install this package?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Dockerfile that uses the base runtime image and runs apt-get install.. The App Engine flexible environment runs your application in a Docker container based on a Google-provided runtime image. To install system packages like libssl-dev that are not included in the default image, you must customize the container by creating a Dockerfile that starts FROM the base runtime image and then runs apt-get install. This is the standard method for adding OS-level dependencies in the flexible environment.

Answer

Use a custom runtime that already includes the package.

Answer

Specify the package in the app.yaml file under the 'libraries' section.

Answer

Add the package name to the requirements.txt file.

Question 2

Which TWO of the following are best practices when deploying applications on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across nodes.. Pod anti-affinity ensures pods are scheduled across different nodes, improving fault tolerance and high availability. This is a best practice for stateless applications to avoid a single point of failure during node failures. Option D is correct because defining resource requests and limits allows the Kubernetes scheduler to make informed placement decisions and prevents resource starvation, ensuring predictable application performance.

Answer

Store sensitive configuration data in environment variables.

Answer

Skip liveness and readiness probes for stateless applications.

Answer

Use the default Compute Engine service account for pods.

Question 3

A developer runs the above command to build and push a container image to Container Registry, but receives the error shown. The developer has the 'Cloud Build Editor' role on the project. What is the most likely cause of the error?

Accepted Answer

The Cloud Build service account has not been enabled or does not have permission to act on behalf of the user.. The error occurs because the Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) lacks the necessary permissions to push the container image to Container Registry. Even though the developer has the 'Cloud Build Editor' role, Cloud Build itself needs a service account with appropriate IAM roles (e.g., Storage Object Admin) to write to the registry. The error is not about the developer's direct permissions but about the service account that Cloud Build uses to execute the build and push.

Answer

The Cloud Storage bucket for storing build artifacts does not exist.

Answer

The developer's user account has been revoked access to the project.

Answer

The developer does not have the 'cloudbuild.builds.create' permission because the Cloud Build Editor role does not include it.

Question 4

Your company is deploying a web application on Cloud Run using a continuous deployment pipeline from Cloud Build. The application is built as a Docker container and pushed to Container Registry. The Cloud Run service is configured with the '--no-allow-unauthenticated' flag. You have set up Cloud Build triggers to build and deploy on commits to the main branch. The deployment works correctly for the first few commits, but after adding a new environment variable in the Cloud Build configuration file (cloudbuild.yaml), the deployment fails with an error that the Cloud Run service cannot be updated because the new revision fails health checks. The application code has not changed. What is the most likely cause?

Accepted Answer

The new environment variable causes the application to fail its startup or health check.. The application code has not changed, yet the deployment fails health checks immediately after adding a new environment variable. This indicates that the application is likely reading that variable at startup and crashing or failing its readiness probe due to an invalid value, missing dependency, or misconfiguration. Cloud Run requires the new revision to pass health checks (e.g., HTTP GET on the configured port) before it can serve traffic; if the variable causes the app to exit or hang, the revision is considered unhealthy and the update is rejected.

Answer

The Cloud Build service account does not have permission to update the Cloud Run service.

Answer

The new environment variable exceeds the maximum size limit for environment variables in Cloud Run.

Answer

The health check configuration in the Cloud Run service was overwritten by the new deployment.

Question 5

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The development team has built a Docker image and pushed it to Artifact Registry. They want to automate the deployment process so that whenever a new image is pushed to the registry, the application is automatically updated in the GKE cluster. Which combination of services should they use to achieve this?

Accepted Answer

Set up a Cloud Build trigger that monitors the Artifact Registry and runs a build step to update the GKE deployment using kubectl.. Cloud Build can be configured with a trigger that monitors Artifact Registry for new image pushes. When a new image is pushed, the trigger executes a build step that uses kubectl to update the GKE deployment, enabling continuous deployment without manual intervention.

Answer

Use Cloud Deploy to create a delivery pipeline that watches the Artifact Registry and promotes the image to GKE.

Answer

Schedule a Cloud Scheduler job that periodically checks for new images in Artifact Registry and updates the GKE deployment.

Answer

Configure a Cloud Run service that is automatically deployed when a new image is pushed to Artifact Registry.

Question 6

A team is deploying a microservice application on Google Kubernetes Engine (GKE). They want to ensure high availability and minimize downtime during rolling updates. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure pod disruption budgets to limit the number of pods that can be unavailable simultaneously.. PodDisruptionBudgets (PDBs) allow you to specify the minimum number of pods that must remain available during voluntary disruptions like rolling updates, ensuring high availability. Option D is correct because readiness probes control when a pod is added to a Service's endpoints; during rolling updates, they prevent traffic from being sent to a pod until it is ready, minimizing downtime.

Answer

Use Horizontal Pod Autoscaler to automatically adjust the number of pods based on CPU utilization.

Answer

Enable liveness probes to automatically restart pods that become unresponsive.

Answer

Enable node auto-repair to automatically replace unhealthy nodes.

Question 7

Refer to the exhibit. A developer is deploying a container to Cloud Run and receives the error shown. What is the most likely cause?

Accepted Answer

The container is trying to listen on a privileged port (e.g., 80) instead of the expected port 8080.. Cloud Run requires containers to listen on the port specified by the PORT environment variable, which defaults to 8080. The error indicates the container is trying to bind to port 80, a privileged port, which is not allowed by the Cloud Run runtime sandbox. This mismatch causes the container to fail health checks and deployment.

Answer

The container's health check is failing because the startup command is incorrect.

Answer

The PORT environment variable is not set correctly in the Cloud Run service configuration.

Answer

The container image does not exist in the specified registry.

Question 8

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) in the correct order.

Accepted Answer

Create GKE cluster, authenticate kubectl with the cluster, apply Kubernetes manifest files, expose the application via Service or Ingress. Deploying to GKE requires creating a cluster, authenticating, then applying manifests and exposing the service.

Answer

Authenticate kubectl with the cluster, create GKE cluster, apply Kubernetes manifest files, expose the application via Service or Ingress

Answer

Create GKE cluster, apply Kubernetes manifest files, authenticate kubectl with the cluster, expose the application via Service or Ingress

Answer

Create GKE cluster, expose the application via Service or Ingress, authenticate kubectl with the cluster, apply Kubernetes manifest files

Question 9

Drag and drop the steps to set up a Firestore database in native mode in the correct order.

Accepted Answer

Enable Firestore API, then Create Firestore database in native mode, then Add data to the database. Firestore native mode is selected during database creation, then data can be added.

Answer

Create Firestore database in native mode, then Enable Firestore API, then Add data to the database

Answer

Enable Firestore API, then Add data to the database, then Create Firestore database in native mode

Answer

Create Firestore database in native mode, then Add data to the database, then Enable Firestore API

Question 10

Match each IAM role to its description.

Accepted Answer

Viewer: Read-only access to resources. IAM basic roles include Viewer (read-only), Editor (read/write without IAM management), and Owner (full control). The distractors swap these definitions.

Answer

Viewer: Full access to resources

Answer

Editor: Read-only access to resources

Question 11

Match each Cloud CDN feature to its benefit.

Accepted Answer

Caching: Reduces latency by serving content from edge locations. Cloud CDN features like caching, SSL/TLS termination, and compression each provide distinct benefits. Caching reduces latency, SSL/TLS termination improves security, and compression reduces bandwidth. Distractors often mix up these benefits.

Answer

Caching: Improves security by blocking malicious requests

Answer

SSL/TLS termination: Reduces latency by speeding up content delivery

Question 12

A developer wants to deploy a containerized application to Google Kubernetes Engine (GKE) and ensure that new pods are automatically created if an existing pod fails. Which Kubernetes resource should be used?

Accepted Answer

Deployment. A Deployment is the correct Kubernetes resource for ensuring declarative updates and self-healing for stateless applications. It manages a ReplicaSet, which maintains the desired number of pod replicas; if a pod fails, the ReplicaSet controller automatically creates a replacement pod to match the desired state.

Answer

Job

Answer

DaemonSet

Answer

StatefulSet

Question 13

A company has a monolithic application that needs to be migrated to Cloud Run. The application currently writes logs to a local file. What is the best practice for handling logs in Cloud Run?

Accepted Answer

Write logs to stdout and stderr; Cloud Run automatically sends them to Cloud Logging.. Cloud Run is a serverless compute platform that automatically integrates with Cloud Logging. The best practice is to write logs to stdout and stderr because Cloud Run's runtime captures these streams and forwards them to Cloud Logging without any additional agents or sidecars. This approach aligns with the 12-factor app methodology and ensures logs are available for monitoring and troubleshooting.

Answer

Use a third-party logging agent installed in the container image.

Answer

Use a sidecar container to ship logs to Stackdriver.

Answer

Continue writing to a local file; Cloud Run will persist it.

Question 14

A developer is deploying an application on Compute Engine and needs to automatically apply security patches without downtime. The application runs behind a TCP load balancer. What is the best deployment strategy?

Accepted Answer

Use a rolling update on the instance group.. A rolling update on a managed instance group allows the developer to update instances incrementally, applying security patches without downtime. The TCP load balancer automatically distributes traffic only to healthy instances, so as each instance is updated and passes health checks, traffic is seamlessly redirected away from instances being patched.

Answer

Use a canary deployment with a separate instance group.

Answer

Stop all instances, apply patches, then restart them.

Answer

Use a managed instance group with autohealing.

Question 15

A team is deploying a microservice on Cloud Run that requires environment variables with sensitive information, such as database passwords. What is the recommended way to provide these secrets?

Accepted Answer

Use Secret Manager to store the secrets and refer to them in the Cloud Run service.. Secret Manager is Google Cloud's dedicated service for securely storing and managing sensitive data like API keys and database passwords. Cloud Run natively integrates with Secret Manager, allowing you to reference secret versions by name in your service configuration without exposing the secret value in plaintext. This approach ensures secrets are encrypted at rest and in transit, and access can be tightly controlled via IAM permissions.

Answer

Inject them directly in the Cloud Run YAML configuration.

Answer

Embed them in the container image as environment variables.

Answer

Store them in a Cloud Storage bucket and mount as a volume.