PCD Deploying applications Practice Test 2 — 15 Questions

Question 1

You are deploying a critical application on Compute Engine. The application requires high availability and must survive a zonal failure. You have created a managed instance group (MIG) with autoscaling across two zones. The application state is stored in a Cloud SQL instance with a read replica in another region. The application also uses a shared static IP address for client access. During a test, you simulate a failure of zone us-central1-a. You observe that the MIG automatically creates new instances in the remaining zone, but the application becomes unreachable for several minutes. What is the most likely cause of the downtime?

Accepted Answer

The load balancer's health check interval and timeout caused a delay in marking the backend instances as unhealthy and routing traffic to the new zone.. The most likely cause is that the load balancer's health check interval and timeout delayed the detection of unhealthy instances in the failed zone, preventing traffic from being rerouted to the new instances in the remaining zone. Even though the MIG created new instances quickly, the load balancer continued sending requests to the failed zone until the health check marked those backends as unhealthy, causing the application to be unreachable during that window.

Answer

The static IP address was not configured to failover to the remaining zone.

Answer

The Cloud SQL read replica did not promote to primary quickly enough.

Answer

The managed instance group's autoscaler took too long to create new instances in the remaining zone.

Question 2

Your company is deploying a web application on Cloud Run using a continuous deployment pipeline from Cloud Build. The application is built as a Docker container and pushed to Container Registry. The Cloud Run service is configured with the '--no-allow-unauthenticated' flag. You have set up Cloud Build triggers to build and deploy on commits to the main branch. The deployment works correctly for the first few commits, but after adding a new environment variable in the Cloud Build configuration file (cloudbuild.yaml), the deployment fails with an error that the Cloud Run service cannot be updated because the new revision fails health checks. The application code has not changed. What is the most likely cause?

Accepted Answer

The new environment variable causes the application to fail its startup or health check.. Option D is correct because the application code has not changed, yet the deployment fails health checks immediately after adding a new environment variable. This indicates that the application is likely reading that variable at startup and crashing or failing its readiness probe due to an invalid value, missing dependency, or misconfiguration. Cloud Run requires the new revision to pass health checks (e.g., HTTP GET on the configured port) before it can serve traffic; if the variable causes the app to exit or hang, the revision is considered unhealthy and the update is rejected.

Answer

The Cloud Build service account does not have permission to update the Cloud Run service.

Answer

The new environment variable exceeds the maximum size limit for environment variables in Cloud Run.

Answer

The health check configuration in the Cloud Run service was overwritten by the new deployment.

Question 3

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The development team has built a Docker image and pushed it to Artifact Registry. They want to automate the deployment process so that whenever a new image is pushed to the registry, the application is automatically updated in the GKE cluster. Which combination of services should they use to achieve this?

Accepted Answer

Set up a Cloud Build trigger that monitors the Artifact Registry and runs a build step to update the GKE deployment using kubectl.. Option B is correct because Cloud Build can be configured with a trigger that monitors Artifact Registry for new image pushes. When a new image is pushed, the trigger executes a build step that uses kubectl to update the GKE deployment, enabling continuous deployment without manual intervention.

Answer

Use Cloud Deploy to create a delivery pipeline that watches the Artifact Registry and promotes the image to GKE.

Answer

Schedule a Cloud Scheduler job that periodically checks for new images in Artifact Registry and updates the GKE deployment.

Answer

Configure a Cloud Run service that is automatically deployed when a new image is pushed to Artifact Registry.

Question 4

A team is deploying a microservice application on Google Kubernetes Engine (GKE). They want to ensure high availability and minimize downtime during rolling updates. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure pod disruption budgets to limit the number of pods that can be unavailable simultaneously.. Option C is correct because PodDisruptionBudgets (PDBs) allow you to specify the minimum number of pods that must remain available during voluntary disruptions like rolling updates, ensuring high availability. Option D is correct because readiness probes control when a pod is added to a Service's endpoints; during rolling updates, they prevent traffic from being sent to a pod until it is ready, minimizing downtime.

Answer

Use Horizontal Pod Autoscaler to automatically adjust the number of pods based on CPU utilization.

Answer

Enable liveness probes to automatically restart pods that become unresponsive.

Answer

Enable node auto-repair to automatically replace unhealthy nodes.

Question 5

Refer to the exhibit. A developer is deploying a container to Cloud Run and receives the error shown. What is the most likely cause?

Accepted Answer

The container is trying to listen on a privileged port (e.g., 80) instead of the expected port 8080.. Cloud Run requires containers to listen on the port specified by the PORT environment variable, which defaults to 8080. The error indicates the container is trying to bind to port 80, a privileged port, which is not allowed by the Cloud Run runtime sandbox. This mismatch causes the container to fail health checks and deployment.

Answer

The container's health check is failing because the startup command is incorrect.

Answer

The PORT environment variable is not set correctly in the Cloud Run service configuration.

Answer

The container image does not exist in the specified registry.

Question 6

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) in the correct order.

Question 7

Drag and drop the steps to set up a Firestore database in native mode in the correct order.

Question 8

Match each IAM role to its description.

Question 9

Match each Cloud CDN feature to its benefit.

Question 10

A developer wants to deploy a containerized application to Google Kubernetes Engine (GKE) and ensure that new pods are automatically created if an existing pod fails. Which Kubernetes resource should be used?

Accepted Answer

Deployment. A Deployment is the correct Kubernetes resource for ensuring declarative updates and self-healing for stateless applications. It manages a ReplicaSet, which maintains the desired number of pod replicas; if a pod fails, the ReplicaSet controller automatically creates a replacement pod to match the desired state.

Answer

Job

Answer

DaemonSet

Answer

StatefulSet

Question 11

A company has a monolithic application that needs to be migrated to Cloud Run. The application currently writes logs to a local file. What is the best practice for handling logs in Cloud Run?

Accepted Answer

Write logs to stdout and stderr; Cloud Run automatically sends them to Cloud Logging.. Cloud Run is a serverless compute platform that automatically integrates with Cloud Logging. The best practice is to write logs to stdout and stderr because Cloud Run's runtime captures these streams and forwards them to Cloud Logging without any additional agents or sidecars. This approach aligns with the 12-factor app methodology and ensures logs are available for monitoring and troubleshooting.

Answer

Use a third-party logging agent installed in the container image.

Answer

Use a sidecar container to ship logs to Stackdriver.

Answer

Continue writing to a local file; Cloud Run will persist it.

Question 12

A developer is deploying an application on Compute Engine and needs to automatically apply security patches without downtime. The application runs behind a TCP load balancer. What is the best deployment strategy?

Accepted Answer

Use a rolling update on the instance group.. Option D is correct because a rolling update on a managed instance group allows the developer to update instances incrementally, applying security patches without downtime. The TCP load balancer automatically distributes traffic only to healthy instances, so as each instance is updated and passes health checks, traffic is seamlessly redirected away from instances being patched.

Answer

Use a canary deployment with a separate instance group.

Answer

Stop all instances, apply patches, then restart them.

Answer

Use a managed instance group with autohealing.

Question 13

A team is deploying a microservice on Cloud Run that requires environment variables with sensitive information, such as database passwords. What is the recommended way to provide these secrets?

Accepted Answer

Use Secret Manager to store the secrets and refer to them in the Cloud Run service.. Secret Manager is the recommended service for storing and accessing sensitive data like passwords. Access via environment variable or volume mount. Storing in source code or Cloud Storage without encryption is insecure.

Answer

Inject them directly in the Cloud Run YAML configuration.

Answer

Embed them in the container image as environment variables.

Answer

Store them in a Cloud Storage bucket and mount as a volume.

Question 14

A developer is troubleshooting a deployment on Cloud Run. The service fails with 'Container failed to start' error. The container image is built from a Dockerfile that uses CMD ['npm', 'start']. What is the most likely cause?

Accepted Answer

The application does not listen on the port specified by the PORT environment variable.. Cloud Run requires the containerized application to listen on the port specified by the PORT environment variable (default 8080). If the application is hardcoded to listen on a different port (e.g., 3000) or does not read the PORT variable, Cloud Run's health checks and routing will fail, resulting in a 'Container failed to start' error. The CMD instruction is correct for starting npm, but the application must bind to the correct port.

Answer

The Dockerfile uses CMD instead of ENTRYPOINT.

Answer

The container image is too large and exceeds the memory limit.

Answer

The Cloud Run service does not have permission to pull the image from Container Registry.

Question 15

An organization runs a stateful application on GKE that uses PersistentVolumes. They want to perform a rolling update of the application without disrupting the underlying persistent data. What should they use?

Accepted Answer

A StatefulSet with a PersistentVolumeClaim template.. A StatefulSet is the correct choice because it is designed for stateful applications that require stable, unique network identifiers and persistent storage. By including a PersistentVolumeClaim template in the StatefulSet spec, each Pod gets its own dedicated PersistentVolume that persists across rescheduling and rolling updates, ensuring data is not disrupted.

Answer

A ReplicaSet with a headless service.

Answer

A DaemonSet with a PodDisruptionBudget.

Answer

A Deployment with a PersistentVolumeClaim template.