PCD Deploying applications Practice Test 3 — 15 Questions

Question 1

Which THREE methods are valid ways to deploy a containerized application to Google Kubernetes Engine (GKE)?

Accepted Answer

Use Helm to install a chart.. Helm is a package manager for Kubernetes that simplifies deploying containerized applications by using pre-configured charts. A Helm chart packages all the necessary Kubernetes resource definitions (e.g., Deployments, Services) into a single deployable unit, and running `helm install` on a GKE cluster will deploy the application correctly.

Answer

Use gcloud container clusters create to deploy the application.

Answer

Upload the container image to Cloud Storage and use a trigger to deploy.

Question 2

Your company runs a multi-tier application on GKE. The frontend is a Deployment with 5 replicas, backend is a StatefulSet with 3 replicas, and a database runs on Cloud SQL. Recently, after a cluster upgrade, the frontend pods are failing with 'Connection refused' errors when trying to reach the backend service. The backend pods are running and healthy. You have verified that the Service and Endpoints objects exist. The backend service is of type ClusterIP on port 8080, and the frontend uses the service name 'backend-svc'. The frontend pods are in a different namespace 'frontend-ns', while the backend is in 'backend-ns'. What is the most likely cause of the error?

Accepted Answer

The frontend pods are not using the correct DNS name that includes the namespace.. When a frontend pod in namespace 'frontend-ns' uses the service name 'backend-svc' to reach a backend service in namespace 'backend-ns', the DNS resolution will only work if the fully qualified domain name (FQDN) is used: 'backend-svc.backend-ns.svc.cluster.local'. Without the namespace qualifier, the DNS query resolves to a non-existent service in the same namespace, causing 'Connection refused'. Option A is incorrect because ClusterIP services are accessible cluster-wide provided the correct DNS name is used; an Ingress is not required. Option B is incorrect because we verified that Endpoints exist for the backend service, indicating the StatefulSet pods are correctly selected. Option C is incorrect because a NetworkPolicy blocking traffic would typically result in a timeout or no route, not an immediate 'Connection refused'; the error here is due to DNS resolution to a nonexistent endpoint.

Answer

The backend Service is not exposed via an Ingress, so it is not reachable from other namespaces.

Answer

The StatefulSet pods are not part of the backend Service's selector.

Answer

A NetworkPolicy is blocking traffic between the namespaces.

Question 3

A developer is deploying a Python web application to App Engine Flexible Environment. The application requires a specific third-party binary that is not pre-installed on the runtime image. Which two steps should the developer take to ensure the binary is available? (Choose two.)

Accepted Answer

Use a startup script in the app.yaml to install the binary.. App Engine Flexible Environment supports a `startup_script` field in `app.yaml` that runs shell commands during instance initialization, allowing installation of third-party binaries. Option E is correct because using a custom runtime with a Dockerfile gives full control over the base image and dependencies, enabling the developer to install any required binary via `RUN` commands.

Answer

Configure a VM-level startup script in the Google Cloud Console.

Answer

Specify the binary as a dependency in the requirements.txt file.

Answer

Include the binary in the application's Git repository and reference it in the app.yaml.

Question 4

A company is deploying a microservices architecture on Google Cloud using Cloud Run. They need to ensure that services can communicate securely with each other and with other Google Cloud services, such as Cloud Storage and Secret Manager. Which three steps should they take? (Choose three.)

Accepted Answer

Use Cloud Run's direct VPC egress to access resources in a VPC network.. To securely communicate with other Google Cloud services like Cloud Storage and Secret Manager, Cloud Run services can use direct VPC egress to route traffic through your VPC. Additionally, to access resources in a VPC, you can use a VPC connector. Using service accounts with least privilege ensures secure access control. These three steps together provide secure communication.

Answer

Enable Cloud Service Mesh for sidecar proxy injection.

Answer

Configure Cloud Run services to use internal load balancing.

Question 5

A company is deploying a static website on Cloud Storage with a custom domain. They want to serve the website over HTTPS. They have created a bucket with the same name as the domain and uploaded the files. They have verified the domain ownership in Search Console and added the bucket as a CNAME record in their DNS. Users report that when they navigate to the domain, they get a 404 error. The company has verified that the bucket's main page suffix is set to index.html. The team is confident the files are uploaded correctly. They need to resolve the 404 error and serve the site over HTTPS. What should they do?

Accepted Answer

Create a Cloud Load Balancer with the bucket as backend and update DNS.. To serve a static website from a Cloud Storage bucket over HTTPS with a custom domain, you must place the bucket behind a Cloud Load Balancer (HTTPS) and point DNS to the load balancer. Cloud Storage's built-in website endpoint only supports HTTP, so HTTPS requires a load balancer with a managed SSL certificate. This also resolves the 404 because the load balancer correctly routes requests to the bucket's index page.

Answer

Add a DNS A record pointing to the load balancer IP instead of a CNAME.

Answer

Enable Cloud CDN on the bucket.

Answer

Set the bucket's default object ACL to public read.

Question 6

A team is deploying a containerized application to Google Kubernetes Engine using a Deployment and a Service of type LoadBalancer. The application is a web server that should be accessible on port 80. After deployment, the external IP is assigned, but when they try to access http://<EXTERNAL_IP>:80, they get a connection timeout. The pods are running, and the logs show the web server is listening on port 8080. The team has verified that the cluster firewall rules allow traffic on port 80. They have also confirmed that the pods are healthy and no network policies are in place. What is the most likely cause?

Accepted Answer

The Deployment's containerPort is set to 8080, but the Service's port is set to 80 and targetPort is not specified.. In Kubernetes, a Service of type LoadBalancer maps an external port to a targetPort on the pods. If the Service's port is 80 but targetPort is not specified, it defaults to the same value as port (80), while the container listens on 8080 — causing connection timeouts. The fix is to set targetPort: 8080.

Answer

The cluster has a network policy that blocks incoming traffic.

Answer

The Service is missing the externalTrafficPolicy: Local setting.

Answer

The Service's targetPort is set to 80 instead of 8080.

Question 7

A company is migrating a legacy Java application to Cloud Run. The application requires a specific Java version (Java 11) and writes temporary files to disk. The application also uses a proprietary library that is not available in public repositories. The team has created a Dockerfile that installs Java 11, copies the JAR file, and sets the entrypoint. They are using Cloud Build to build the container and deploying to Cloud Run. The deployment succeeds, but when they send requests, the application fails with a "Permission denied" error when trying to write to /tmp. The team has verified that the Cloud Run service has the correct permissions via a service account. They have also checked that the filesystem is writable at /tmp by default. What is the most likely cause of the error?

Accepted Answer

Change the base image to one that includes Java 11 and ensures the /tmp directory is writable.. The most common cause of write permission errors in Cloud Run is using a base image that does not have a writable /tmp directory or has the wrong filesystem permissions. Official base images like gcr.io/distroless/java or OpenJDK images are configured with a writable /tmp. Option A is incorrect because running chmod inside the Dockerfile may not fix the underlying issue if the filesystem is read-only or if the user doesn't have sufficient privileges; plus, Cloud Run may enforce security policies that prevent such operations. Option B is incorrect because memory limits do not affect filesystem write permissions; they relate to memory allocation. Option D is incorrect because Cloud Storage FUSE is an overcomplication; the issue is simply the base image's /tmp configuration.

Answer

Add a RUN chmod 777 /tmp command in the Dockerfile before the entrypoint.

Answer

Increase the memory limit of the Cloud Run service.

Answer

Use a Cloud Storage FUSE mount for temporary storage.

Question 8

A startup is deploying a Node.js application on App Engine Standard Environment. They have configured the application in app.yaml with runtime: nodejs16. After deploying with gcloud app deploy, the deployment succeeds, but when they access the application, they get a 502 Bad Gateway error. They check the logs and see "Failed to start container" and "Error: Cannot find module 'express'". The application uses Express. The team has confirmed that the package.json file includes express as a dependency. What is the most likely cause?

Accepted Answer

The node_modules folder was not uploaded because it is in the .gcloudignore file.. The error 'Cannot find module 'express'' indicates that the Node.js runtime cannot locate the express package at startup. In App Engine Standard, the deployment process uploads your source code and then runs npm install during the build phase. However, if node_modules is excluded via .gcloudignore, the runtime may not have the dependencies installed, especially if the build step is skipped or misconfigured. The most likely cause is that node_modules was ignored, preventing express from being available.

Answer

The application is running on a different port than the one specified in the environment variable PORT.

Answer

The package.json file is missing the express dependency.

Answer

The request exceeds the 60-second timeout.

Question 9

A company is deploying a batch job that runs once a day on Compute Engine. They are using a startup script to install dependencies and run the job. The job writes output to Cloud Storage. Recently, the job started failing intermittently with "No space left on device" errors, even though the persistent disk has 100 GB free. The team has verified that the disk is not fragmented and that the inode usage is low. The job processes large files and creates many temporary files in /tmp. They suspect the /tmp directory is filling up. What is the most likely cause?

Accepted Answer

The /tmp partition is using a small temporary disk that is separate from the persistent disk.. On Compute Engine, the /tmp directory is mounted on a small dedicated temporary disk (tmpfs or a small local SSD-backed mount) that is separate from the boot persistent disk. This temporary disk is sized based on the instance's memory (typically a fraction of RAM) and is not visible in the persistent disk's free space reporting. Since the job creates many large temporary files in /tmp, it exhausts this small temporary space while the 100 GB persistent disk remains free, producing the 'No space left on device' error.

Answer

The instance's RAM is insufficient, causing swap to fill the disk.

Answer

The startup script is not cleaning up temporary files.

Answer

The Cloud Storage bucket quota is exceeded.

Question 10

Refer to the exhibit. A Cloud Build pipeline that deploys a Cloud Run service fails with the above error. The Cloud Build service account has the roles/run.admin role at the project level. What is the most likely cause?

Accepted Answer

The Cloud Run API is not enabled in the project.. The error message indicates that Cloud Run is not available, which typically occurs when the Cloud Run API has not been enabled in the project. Without the API enabled, any attempt to deploy a Cloud Run service via Cloud Build will fail, regardless of the service account's IAM roles. Enabling the API is a prerequisite for using Cloud Run resources.

Answer

The service account used by Cloud Build does not have the Cloud Run Invoker role.

Answer

The Cloud Run service was deleted manually before the pipeline ran.

Answer

The region specified in the deploy step does not have Cloud Run enabled.

Question 11

A company runs a Java microservice on Google Kubernetes Engine (GKE) using a standard cluster with 3 nodes. They use Cloud Build to build the Docker image and push it to Artifact Registry, then apply a Kubernetes Deployment manifest that references the new image tag. The Deployment has a rolling update strategy with maxSurge=1 and maxUnavailable=0. After a recent deployment, the new pods crash with 'CrashLoopBackOff'. The old pods are still running successfully. The application logs show a connection refused error when trying to connect to a Cloud SQL instance. The Cloud SQL instance is in the same project and region. The GKE cluster nodes have the appropriate scopes to access Cloud SQL. The application uses a Cloud SQL proxy sidecar container to establish the connection. The previous deployment worked fine. What is the most likely cause of the failure?

Accepted Answer

The Cloud SQL proxy sidecar container is not included in the new Deployment revision.. The Cloud SQL proxy sidecar container is missing from the new Deployment revision. Since the application relies on the sidecar to establish a secure connection to Cloud SQL, its absence causes the connection refused error. The old pods continue to run because they still have the sidecar from the previous Deployment revision, while the new pods crash due to the missing proxy.

Answer

The GKE cluster nodes do not have the Cloud SQL Client role.

Answer

The Kubernetes Secret containing the service account key was not updated to include the new pod's service account.

Answer

The new image tag points to a broken build that has incorrect code for Cloud SQL connection.

Question 12

Your team uses Cloud Build to build container images. The build config includes a step that runs unit tests, and you want the build to fail immediately if any test fails, before pushing the image to Artifact Registry. Which Cloud Build feature should you configure in the build step?

Accepted Answer

Ensure the test command exits with a non-zero code on failure.. Cloud Build executes each step as a container. If a step's command returns a non-zero exit code, the build fails and subsequent steps are skipped. Therefore, ensuring the test command exits non-zero on failure is the correct approach to halt the build before pushing the image.

Answer

Set `allowFailure` to `false` on the test step.

Answer

Set `waitFor` to `['-']` on the test step.

Answer

Set `allowExitCodes` to `[0]` on the test step.

Question 13

You are using Cloud Deploy to manage deployments to GKE. You want to ensure that a deployment to production only proceeds after a manual approval. Which Cloud Deploy configuration should you use?

Accepted Answer

Add an `approval` field to the target definition in the delivery pipeline.. Cloud Deploy allows you to define an `approval` field in a target within the delivery pipeline. When a rollout reaches that target, it pauses and waits for manual approval before proceeding. This is the intended way to require manual approval for production deployments.

Answer

Configure a Cloud Deploy webhook to call a Cloud Function for approval.

Answer

Use a Cloud Build trigger with a manual approval step.

Answer

Define a `requireApproval` field in the delivery pipeline's target.

Question 14

Your team maintains a Java service on Cloud Run that reads a configuration value from an environment variable named DB_HOST. A developer updates the service by running `gcloud run deploy my-service --source .` but forgets to include the `--set-env-vars DB_HOST=10.0.0.5` flag used in the original deployment. After the revision becomes active, the service throws NullPointerException on startup and health checks fail. You need to restore the DB_HOST value for the new revision with minimal disruption. What should you do?

Accepted Answer

Run `gcloud run services update my-service --set-env-vars DB_HOST=10.0.0.5` to apply the variable to the service, creating a new revision.. Cloud Run services store configuration such as environment variables at the service level, separate from the container image. Updating the service with the missing variable creates a new revision that uses the existing image plus the corrected configuration, which is the least disruptive fix. Rebuilding from source works but is slower and unnecessary when only configuration changed.

Answer

Run `gcloud run deploy my-service --source . --set-env-vars DB_HOST=10.0.0.5` to rebuild and redeploy with the variable.

Answer

Roll back to the previous revision using `gcloud run services update-traffic my-service --to-revisions` and keep that revision indefinitely.

Answer

SSH into the Cloud Run instance and edit the container's environment file to add DB_HOST, then restart the process.

Question 15

You are deploying a new version of a microservice to a GKE cluster using a Deployment. The new version has a known issue that causes it to fail readiness probes after 30 seconds. You want to automatically roll back to the previous version if the new version does not become ready within 60 seconds. Which Kubernetes feature should you configure?

Accepted Answer

Set `progressDeadlineSeconds` to 60 in the Deployment spec.. The `progressDeadlineSeconds` field allows the Deployment controller to detect when a rollout has not made progress within a specified time. While it does not automatically roll back, it marks the rollout as failed, which can trigger alerts or automation. In this scenario, setting it to 60 seconds ensures that the failure is detected promptly, and you can then use `kubectl rollout undo` or a CI/CD pipeline to revert.

Answer

Configure a `readinessProbe` with `initialDelaySeconds` of 60.

Answer

Use a `RollingUpdate` strategy with `maxUnavailable` set to 0.

Answer

Set `revisionHistoryLimit` to 1 to keep only the previous revision.