PCD Deploying applications Practice Test 4 — 15 Questions

Question 1

You are setting up Cloud Build to automatically deploy a container to Cloud Run when code is pushed to the main branch of a GitHub repository. What is the minimal configuration required?

Accepted Answer

Create a Cloud Build trigger connected to GitHub, and include a cloudbuild.yaml with steps to build and deploy.. Cloud Build triggers can be configured to automatically execute a build pipeline when code is pushed to a GitHub repository. The minimal configuration requires a trigger connected to GitHub and a cloudbuild.yaml file that defines the steps to build the container image and deploy it to Cloud Run using the `gcloud run deploy` command or the `cloudrun` builder. This setup provides a fully automated CI/CD pipeline without additional services.

Answer

Set up GitHub Actions to push images to Container Registry and then use Cloud Run.

Answer

Create a Cloud Build trigger without a build config file, using the inline builder.

Answer

Use Artifact Registry to store images and then manually trigger deployment.

Question 2

Your Cloud Run service experiences high latency during traffic spikes. You need to reduce p95 latency without over-provisioning. Which action should you take?

Accepted Answer

Set min-instances to at least 5 for consistent baseline capacity.. Setting min-instances to at least 5 ensures that a baseline number of container instances are always warm and ready to handle incoming requests. This eliminates cold starts and reduces latency during traffic spikes because new requests can be immediately served by pre-warmed instances, rather than waiting for new containers to spin up. This approach directly reduces p95 latency without over-provisioning, as you only pay for the baseline instances when they are idle.

Answer

Set max-instances to a low number to ensure consistent resources.

Answer

Reduce the max-concurrency per container to 1.

Answer

Disable CPU throttling to always allocate CPU.

Question 3

You are deploying a Cassandra database on GKE. Which resource type should you use to ensure stable network identities and persistent storage per pod?

Accepted Answer

StatefulSet with volumeClaimTemplates. StatefulSet is the correct resource because it provides stable, unique network identities (via headless Service and ordinal pod names) and persistent storage per pod through volumeClaimTemplates, which dynamically create PersistentVolumeClaims for each replica. This is essential for Cassandra, which requires stable node identities and dedicated storage to maintain cluster state and data consistency.

Answer

Job with persistent disk

Answer

Deployment with persistent volume claims

Answer

DaemonSet with hostPath volumes

Question 4

A developer needs to deploy a Cloud Run service from a container image in Artifact Registry. What IAM role should be granted to the Cloud Run service account?

Accepted Answer

roles/artifactregistry.reader. The Cloud Run service account needs permission to read the container image from Artifact Registry during deployment. The `roles/artifactregistry.reader` role grants the `artifactregistry.repositories.downloadArtifacts` permission, which is required to pull the image. Without this role, the deployment fails with an access denied error.

Answer

roles/storage.objectViewer

Answer

roles/cloudbuild.builds.builder

Answer

roles/run.invoker

Question 5

You are deploying a Python Cloud Function using the Google Cloud CLI. The deployment fails with 'ERROR: (gcloud.functions.deploy) ResponseError: status=[404], code=[OK], message=[The function ... does not exist]' but the function already exists. What is the most likely cause?

Accepted Answer

The gcloud config's region does not match the region where the function was deployed.. The 404 error indicates the deployment command cannot locate the function in the specified region. When you deploy a Cloud Function using the gcloud CLI, the command uses the default region set in your gcloud configuration (or the --region flag). If the function was originally deployed in a different region, the CLI will look for it in the wrong region and fail with a 404, even though the function exists elsewhere. This is the most common cause of this specific error message.

Answer

The function was already deployed with the same name, causing a conflict.

Answer

The Python runtime version is not supported in that region.

Answer

The Cloud Functions API is not enabled.

Question 6

Which TWO security best practices should be implemented when using Cloud Build to deploy applications? (Choose 2.)

Accepted Answer

Use Cloud KMS to encrypt sensitive environment variables.. Cloud Build does not automatically encrypt environment variables stored in build config files or the console. Using Cloud KMS allows you to encrypt sensitive data like API keys or passwords, then decrypt them at build time via the `gcloud kms decrypt` step, ensuring secrets are never stored in plaintext.

Answer

Add SSH keys to Cloud Build for private Git repos.

Answer

Use container image tags instead of digests in build configs.

Answer

Store secrets in Cloud Build's default substitution variables.

Question 7

Which THREE common issues cause deployment failures on App Engine? (Choose 3.)

Accepted Answer

Using a runtime version that is not available in the app's region.. App Engine requires that the runtime version specified in your app.yaml is available in the region where the application is deployed. If you select a runtime version that has been deprecated or is not yet rolled out to that region, the deployment will fail with an error indicating the runtime is unavailable. This is a common issue when using newer runtime versions that are only available in certain regions.

Answer

Setting the app to scale to 0 instances.

Answer

Creating a resource with backend type set to 'backend' instead of 'frontend'.

Question 8

Which TWO features are provided by Google Cloud Deploy? (Choose 2.)

Accepted Answer

Rollback to a previous deployment revision.. Google Cloud Deploy is a managed continuous delivery service that automates the rollout of applications to Google Kubernetes Engine (GKE) or GKE Enterprise clusters. It supports rollback to a previous deployment revision (A) by reverting the target cluster to the last known good state, and it provides automated canary analysis (C) by integrating with Cloud Monitoring to verify deployment health metrics before progressing traffic shifts.

Answer

Run containers without managing infrastructure.

Answer

Build container images from source code.

Answer

Manage Kubernetes clusters across multi-cloud environments.

Question 9

A developer deploys a containerized application on Cloud Run. The application needs to access a Cloud SQL instance securely without exposing it to the internet. What is the best practice?

Accepted Answer

Use Cloud Run's VPC connector and configure private IP for Cloud SQL.. Cloud Run services cannot directly connect to Cloud SQL using private IP without a VPC connector. The VPC connector allows Cloud Run to send traffic to a VPC network, where the Cloud SQL instance with a private IP resides, ensuring traffic never traverses the public internet. This is the recommended pattern for secure, low-latency access to Cloud SQL from serverless environments.

Answer

Whitelist the Cloud Run IP range in Cloud SQL authorized networks.

Answer

Use a Cloud SQL proxy sidecar container in the same pod.

Answer

Use Cloud NAT to route traffic.

Question 10

An application running on Compute Engine instances behind a Cloud Load Balancer experiences intermittent 502 errors. The health checks pass but sometimes requests time out. What is the most likely cause?

Accepted Answer

The connection draining timeout is too short.. A connection draining timeout that is too short can cause the load balancer to close connections prematurely while backend instances are still processing requests. This results in intermittent 502 errors and timeouts, even though health checks pass, as the instances are healthy but connections are being terminated before responses are sent.

Answer

The load balancer is misconfigured with wrong backend type.

Answer

The backend instances are running out of memory.

Answer

The SSL certificate has expired.

Question 11

A company deploys a stateful application using StatefulSets on GKE. They need to store persistent data on regional persistent disks for high availability. However, during zonal failures, pods are not rescheduled quickly. What is the best approach to improve recovery time?

Accepted Answer

Configure podDisruptionBudget and use persistent disk with regional replication.. Configuring a podDisruptionBudget ensures that a minimum number of Pods remain available during voluntary disruptions, while using regional persistent disks (which replicate data across zones) allows the StatefulSet controller to quickly reschedule Pods in another zone without waiting for the failed zone's disk to become available. This combination minimizes downtime during zonal failures by maintaining quorum and ensuring data is already accessible in the surviving zone.

Answer

Increase the number of replicas in the StatefulSet.

Answer

Use a headless service with external persistent storage like Filestore.

Answer

Use a Deployment instead of StatefulSet.

Question 12

A developer wants to deploy a Cloud Function that connects to a Cloud SQL database. What is the simplest way to securely inject database credentials?

Accepted Answer

Use Secret Manager to store and access the database password.. Secret Manager provides a secure, centralized service for storing sensitive data like database passwords, and the Cloud Function can access the secret at runtime via the Secret Manager API or by mounting it as a volume. This avoids hardcoding credentials in code or environment variables, which can be exposed in logs or source control. It is the simplest and most secure approach recommended by Google Cloud for injecting database credentials into Cloud Functions.

Answer

Store credentials in the Cloud Function code as environment variables.

Answer

Use Cloud Key Management Service to encrypt credentials and pass them via HTTP headers.

Answer

Embed credentials in the database connection string in the source code.

Question 13

A company uses Cloud Build for CI/CD. They need to deploy a containerized app to Cloud Run automatically on every push to the main branch. Which Cloud Build configuration step is necessary?

Accepted Answer

Add a step to run 'gcloud run deploy' command.. Cloud Build requires an explicit step to run the `gcloud run deploy` command in order to trigger a deployment to Cloud Run. While Cloud Build can build and push images, it does not automatically deploy to Cloud Run unless a deploy step is included in the build configuration. This step uses the built image (from Artifact Registry) and deploys it as a new revision to the specified Cloud Run service.

Answer

Add a step to build the container with Dockerfile.

Answer

Add a step to push the image to Artifact Registry only.

Answer

Add a step to run unit tests.

Question 14

A startup wants to deploy a web application on App Engine standard environment. They need to handle sudden traffic spikes automatically. How should they configure scaling?

Accepted Answer

Use automatic scaling.. Automatic scaling is the correct choice because App Engine standard environment natively supports automatic scaling, which dynamically adds or removes instances based on request rate, latency, and other metrics. This allows the application to handle sudden traffic spikes without manual intervention, as the platform automatically provisions resources to meet demand.

Answer

Use basic scaling with idle timeout.

Answer

Use manual scaling with a fixed number of instances.

Answer

Use a combination of manual and automatic scaling.

Question 15

A developer deploys a service on Cloud Run with a concurrency setting of 1. The service makes external API calls. Under heavy load, the service starts returning 503 errors. What is the most likely cause?

Accepted Answer

Instance concurrency is too low causing request queuing and timeout.. With concurrency set to 1, each Cloud Run instance can handle only one request at a time. Under heavy load, new requests must wait for an available instance, and if the queue wait time exceeds the request timeout (default 5 minutes, max 60 minutes), the requests are dropped with a 503 HTTP status. This is the most direct cause of the 503 errors, as the service cannot scale fast enough or the queue depth exceeds limits.

Answer

The container image is too large.

Answer

The Cloud Run service is hitting the maximum number of requests per second limit.

Answer

The API endpoint rate limits the requests.