PCD Deploying applications Practice Test 2 — 15 Questions

Question 1

You deployed a microservice on Cloud Run. Users report intermittent 503 errors. The service uses Cloud SQL with connection pooling. What is the most likely cause?

Accepted Answer

The connection pool is drained due to CPU throttling on Cloud Run.. When Cloud Run CPU throttling occurs (e.g., during cold starts or when the instance is processing requests beyond its allocated CPU), the connection pool can become drained because existing connections are held open while new requests cannot be processed. This leads to intermittent 503 errors as the service cannot establish new database connections or respond to incoming requests in time. Connection pooling does not protect against CPU throttling; it only manages database connections efficiently.

Answer

The service is not using a VPC connector for Cloud SQL access.

Answer

The Cloud SQL auth proxy is not configured.

Answer

The Cloud Run service name is not resolvable via Cloud DNS.

Question 2

A company is migrating a monolithic Java application to Cloud Run. The application takes 10 minutes to start. What is the best deployment approach?

Accepted Answer

Optimize the Java application to start within 10 minutes and use startup CPU boost.. Cloud Run allows a maximum container startup time of 10 minutes (600 seconds) by default, and the startup CPU boost feature temporarily allocates additional CPU during startup to accelerate initialization. By optimizing the application to start within this limit and enabling startup CPU boost, the company can directly address the cold start issue without changing the deployment platform or architecture.

Answer

Migrate to App Engine Flexible Environment.

Answer

Use a custom runtime with a cold start optimization.

Answer

Increase the memory limit to 4 GB.

Question 3

You are setting up Cloud Build to automatically deploy a container to Cloud Run when code is pushed to the main branch of a GitHub repository. What is the minimal configuration required?

Accepted Answer

Create a Cloud Build trigger connected to GitHub, and include a cloudbuild.yaml with steps to build and deploy.. Cloud Build triggers can be configured to automatically execute a build pipeline when code is pushed to a GitHub repository. The minimal configuration requires a trigger connected to GitHub and a cloudbuild.yaml file that defines the steps to build the container image and deploy it to Cloud Run using the `gcloud run deploy` command or the `cloudrun` builder. This setup provides a fully automated CI/CD pipeline without additional services.

Answer

Set up GitHub Actions to push images to Container Registry and then use Cloud Run.

Answer

Create a Cloud Build trigger without a build config file, using the inline builder.

Answer

Use Artifact Registry to store images and then manually trigger deployment.

Question 4

Your Cloud Run service experiences high latency during traffic spikes. You need to reduce p95 latency without over-provisioning. Which action should you take?

Accepted Answer

Set min-instances to at least 5 for consistent baseline capacity.. Setting min-instances to at least 5 ensures that a baseline number of container instances are always warm and ready to handle incoming requests. This eliminates cold starts and reduces latency during traffic spikes because new requests can be immediately served by pre-warmed instances, rather than waiting for new containers to spin up. This approach directly reduces p95 latency without over-provisioning, as you only pay for the baseline instances when they are idle.

Answer

Set max-instances to a low number to ensure consistent resources.

Answer

Reduce the max-concurrency per container to 1.

Answer

Disable CPU throttling to always allocate CPU.

Question 5

An application running on Compute Engine instances behind a Cloud Load Balancer experiences intermittent 502 errors. The health checks pass but sometimes requests time out. What is the most likely cause?

Accepted Answer

The connection draining timeout is too short.. A connection draining timeout that is too short can cause the load balancer to close connections prematurely while backend instances are still processing requests. This results in intermittent 502 errors and timeouts, even though health checks pass, as the instances are healthy but connections are being terminated before responses are sent.

Answer

The load balancer is misconfigured with wrong backend type.

Answer

The backend instances are running out of memory.

Answer

The SSL certificate has expired.

Question 6

A company deploys a stateful application using StatefulSets on GKE. They need to store persistent data on regional persistent disks for high availability. However, during zonal failures, pods are not rescheduled quickly. What is the best approach to improve recovery time?

Accepted Answer

Configure podDisruptionBudget and use persistent disk with regional replication.. Configuring a podDisruptionBudget ensures that a minimum number of Pods remain available during voluntary disruptions, while using regional persistent disks (which replicate data across zones) allows the StatefulSet controller to quickly reschedule Pods in another zone without waiting for the failed zone's disk to become available. This combination minimizes downtime during zonal failures by maintaining quorum and ensuring data is already accessible in the surviving zone.

Answer

Increase the number of replicas in the StatefulSet.

Answer

Use a headless service with external persistent storage like Filestore.

Answer

Use a Deployment instead of StatefulSet.

Question 7

A developer deploys a service on Cloud Run with a concurrency setting of 1. The service makes external API calls. Under heavy load, the service starts returning 503 errors. What is the most likely cause?

Accepted Answer

Instance concurrency is too low causing request queuing and timeout.. With concurrency set to 1, each Cloud Run instance can handle only one request at a time. Under heavy load, new requests must wait for an available instance, and if the queue wait time exceeds the request timeout (default 5 minutes, max 60 minutes), the requests are dropped with a 503 HTTP status. This is the most direct cause of the 503 errors, as the service cannot scale fast enough or the queue depth exceeds limits.

Answer

The container image is too large.

Answer

The Cloud Run service is hitting the maximum number of requests per second limit.

Answer

The API endpoint rate limits the requests.

Question 8

A team is deploying a new version of an application on GKE using a rolling update. They want to ensure that the update proceeds only if the new pods are healthy. Which two steps should they include? (Choose two.)

Accepted Answer

Set the minReadySeconds field in the deployment.. Setting `minReadySeconds` in a Deployment ensures that a newly created Pod is considered ready only after it has been stable for that duration, preventing the rolling update from proceeding if the Pod fails shortly after startup. Option B is correct because a readiness probe determines whether a Pod is ready to serve traffic; during a rolling update, the Deployment controller waits for the new Pod's readiness probe to succeed before scaling down old Pods, ensuring the update only continues when new Pods are healthy.

Answer

Define a liveness probe for the container.

Answer

Set the revisionHistoryLimit to 10.

Answer

Use a postStart lifecycle hook to test health.

Question 9

A developer is deploying a Node.js application to App Engine flexible environment. They need to install custom dependencies and run startup scripts. Which two configuration elements should they define in the app.yaml? (Choose two.)

Accepted Answer

entrypoint. A is correct because the `entrypoint` element in app.yaml for App Engine flexible environment specifies the command to run your application, allowing you to execute custom startup scripts and install dependencies before the main process starts. This is essential for Node.js apps that require custom build steps or runtime initialization beyond the default `npm start`.

Answer

env_variables

Answer

manual_scaling

Answer

network

Question 10

A developer uses this Cloud Build configuration to deploy to Cloud Run. The build succeeds but the deployment fails with an error that the service account lacks permission. What is the most likely missing permission?

Accepted Answer

roles/iam.serviceAccountUser on the Cloud Build service account.. The Cloud Build service account (typically the default compute engine service account or a user-specified service account) needs the `roles/iam.serviceAccountUser` role on the Cloud Run service account to impersonate it during deployment. Without this permission, Cloud Build cannot act as the Cloud Run service account to deploy the revision, even though the build itself succeeds. This is a common misconfiguration when deploying to Cloud Run from Cloud Build.

Answer

roles/iam.serviceAccountUser on the Compute Engine default service account.

Answer

roles/storage.objectViewer on the container registry.

Answer

roles/run.admin on the Cloud Run service.

Question 11

A company deploys a containerized web application to Cloud Run. The application needs to access a Cloud SQL instance but fails with a connection timeout. The VPC connector is configured and attached to the Cloud Run service. What is the most likely cause?

Accepted Answer

The VPC connector is not configured to route to the Cloud SQL private IP range.. The VPC connector is attached to the Cloud Run service, but for it to route traffic to the Cloud SQL private IP address, the connector must be configured with a subnet that has a route to the Cloud SQL private IP range (e.g., 10.0.0.0/8 or a specific allocated range). Without this route, packets destined for the Cloud SQL instance's private IP are dropped, causing a connection timeout. The VPC connector itself does not automatically know how to reach Cloud SQL; the subnet must be peered or have appropriate routes.

Answer

Cloud SQL instance does not have a public IP address.

Answer

The application is not using the Cloud SQL Auth Proxy.

Answer

The VPC firewall rules block traffic to Cloud SQL.

Question 12

A team is deploying a critical microservice on GKE. They want to minimize risk by gradually shifting traffic from old to new version. They use a Deployment with a single Service. What deployment strategy should they implement?

Accepted Answer

Create two Deployments (stable and canary) with different numbers of replicas and use the same Service label.. It implements a canary deployment pattern on GKE: two separate Deployments (stable and canary) share the same Service label, allowing the Service to distribute traffic to both based on replica counts. This enables gradual traffic shifting by adjusting the number of canary replicas, minimizing risk while the new version is validated.

Answer

Use a rolling update with maxSurge=1 and maxUnavailable=0.

Answer

Use a single Deployment with a readinessProbe that fails for the new version until ready.

Answer

Create two separate Deployments and switch the Service selector to the new version after testing.

Question 13

A startup wants to deploy a Python web application with low traffic and minimal operational overhead. They need to automatically scale down to zero when not in use. Which compute option should they choose?

Accepted Answer

App Engine Standard Environment.. Both App Engine Standard Environment and Cloud Run satisfy the requirements of low traffic, minimal operational overhead, and scaling to zero. App Engine Standard can scale to zero when no requests are incoming and supports Python, making it a valid choice. Cloud Run also scales to zero automatically and is fully managed, but for a simple Python web app, App Engine Standard offers even less configuration. Therefore, both options are correct.

Answer

Compute Engine with managed instance group and autoscaling.

Answer

Google Kubernetes Engine with cluster autoscaling.

Question 14

A company deploys a stateful application on GKE using a StatefulSet with PersistentVolumeClaims (PVCs). After a node failure, the pod is rescheduled to another node but the PVC remains in 'Pending' state. What is the most likely reason?

Accepted Answer

The PV's claimRef still points to the old PVC UID and is in Released state.. When a StatefulSet pod is rescheduled after a node failure, the original PersistentVolume (PV) may remain in a 'Released' state if its claimRef still points to the old PersistentVolumeClaim (PVC) UID. The PV cannot be re-bound to the new PVC (which has a different UID) until the claimRef is cleared, causing the PVC to remain 'Pending'. This is a known behavior in Kubernetes where PVs are not automatically recycled for reuse with a new PVC UID.

Answer

The PVC is bound to a PV that is still attached to the failed node.

Answer

The StorageClass has reclaimPolicy: Delete so the PV was deleted.

Answer

The StatefulSet's pod management policy prevents reattachment.

Question 15

A company deploys a web app on Cloud Run and configures a custom domain mapping with a managed SSL certificate. After mapping, the domain returns 404 errors. The Cloud Run service is accessible via its default URL. What is the most likely issue?

Accepted Answer

The domain mapping is pointing to a different Cloud Run service or region.. The most likely issue is that the custom domain mapping is pointing to a different Cloud Run service or region. When a custom domain is mapped to Cloud Run, the DNS CNAME must point to the domain mapping's resolved target (e.g., `ghs.googlehosted.com`), not to the default Cloud Run URL. If the mapping points to a different service or region, the request reaches Cloud Run but the service cannot handle it, resulting in a 404 error from the Cloud Run frontend. The default URL works because it bypasses the custom domain mapping and routes directly to the correct service.

Answer

The SSL certificate is not yet provisioned.

Answer

The Cloud Run service does not have the correct IAM permissions.

Answer

The DNS CNAME record is not configured correctly.