PCD Deploying applications Practice Test 4 — 15 Questions

Question 1

You deploy a service to Cloud Run from a container image in Artifact Registry. The first revision works, but a later deploy fails with the message that the container failed to start. You must find the exact reason the container exited. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the image locally with docker run and the same PORT environment variable, then inspect the container logs.. The fastest way to see why a Cloud Run container exits is to reproduce the startup locally with the same PORT environment variable Cloud Run injects. That exposes the entrypoint, port-binding, and file-path errors directly. Memory, CPU boost, and log sinks do not reveal the cause and may mask the real failure, so local reproduction with the injected PORT is the correct first step.

Answer

Attach a Cloud Logging log sink to the Cloud Run service and wait for the next deployment to fail.

Answer

Increase the Cloud Run memory limit to the maximum and redeploy the same revision.

Answer

Enable the Cloud Run startup CPU boost and set the minimum instance count to one.

Question 2

You are deploying a containerized microservice to GKE Autopilot. The service must mount a shared read-write file store that multiple replicas can access concurrently, and the store must survive pod restarts while remaining in a single zone to minimize latency. You plan to use a PersistentVolumeClaim. Which storageClass should you specify in the PVC to meet these requirements?

Accepted Answer

`standard-rwx` (Filestore, ReadWriteMany). GKE Autopilot offers `standard-rwx` and `premium-rwx` storage classes backed by Filestore for ReadWriteMany access. Compute Engine persistent disk classes only support ReadWriteOnce, so they cannot be shared concurrently by replicas on different nodes. For a single-zone shared file store, `standard-rwx` satisfies both the access mode and the latency requirement.

Answer

`standard-rwo` (Compute Engine persistent disk, ReadWriteOnce)

Answer

`premium-rwx` (Filestore, ReadWriteMany)

Answer

`premium-rwo` (Compute Engine persistent disk, ReadWriteOnce)

Question 3

You are deploying a new version of a microservice to Google Kubernetes Engine (GKE). The service must be updated with zero downtime, and you need to validate the new version with a small percentage of live traffic before full rollout. You also want the ability to roll back quickly if issues arise. What should you do?

Accepted Answer

Use Anthos Service Mesh to configure traffic splitting between the old and new versions, and gradually increase the percentage of traffic to the new version.. Anthos Service Mesh enables fine-grained traffic splitting between service versions using Istio APIs. You can deploy the new version as a separate Kubernetes Deployment and use a VirtualService to route a percentage of traffic to it. This allows canary testing with live traffic, zero downtime, and instant rollback by adjusting weights. Other options lack the ability to split traffic by percentage or are not natively supported for canary releases.

Answer

Use a Kubernetes Service with session affinity and deploy the new version as a separate Deployment.

Answer

Use a Kubernetes Deployment with a RollingUpdate strategy and set maxSurge and maxUnavailable to 25%.

Answer

Use a Kubernetes Ingress with a canary annotation to split traffic between two Services.

Question 4

You are deploying a containerized application to Cloud Run. The application needs to connect to a Cloud SQL for PostgreSQL instance using a private IP address. The Cloud Run service and the Cloud SQL instance are in the same project and region. Which two configurations are required to enable this connectivity? (Choose two.)

Accepted Answer

Configure the Cloud Run service to use the VPC connector and set the Cloud SQL connection name as an environment variable.. Connecting Cloud Run to Cloud SQL over private IP requires a Serverless VPC Access connector to route traffic into the VPC, and the Cloud Run service must be configured to use that connector. The Cloud SQL connection name must also be provided to the application. IAM roles are important for authentication but do not establish network connectivity.

Answer

Set the Cloud Run service to use a static outbound IP address and whitelist it in Cloud SQL.

Answer

Assign the Cloud SQL Client role to the Cloud Run service account.

Answer

Create a firewall rule allowing ingress from the Cloud Run service's IP range to the Cloud SQL instance.

Question 5

Your team uses Cloud Build to build container images. A build step needs to pull a base image from a private Artifact Registry repository in the same project, but the build fails with a permissions error even though the Cloud Build service account has Artifact Registry Reader. Logs show the step runs as a different identity than expected. What should you do to allow the build to authenticate to Artifact Registry?

Accepted Answer

Add a build step that runs gcloud auth configure-docker before the image build step, using the Cloud Build service account credentials already available in the build environment.. Cloud Build executes build steps with the Cloud Build service account by default, and gcloud and docker can authenticate to Artifact Registry when the credential helper is configured. Explicitly running gcloud auth configure-docker for the registry host makes the pull use the Cloud Build service account credentials. Granting roles to unrelated accounts, injecting service account keys, or enabling APIs does not fix the identity mismatch.

Answer

Grant the Compute Engine default service account the Artifact Registry Reader role, because Cloud Build steps run as that identity by default.

Answer

Enable the Artifact Registry API and rerun the build, because the API must be enabled before any build step can pull images.

Answer

Store a JSON service account key in Secret Manager and mount it into the build, then set GOOGLE_APPLICATION_CREDENTIALS in the build step environment.

Question 6

You are deploying a new version of an internal API to App Engine standard environment. The application must be reachable only from within your VPC network and other App Engine services in the same project, and must not be exposed to the public internet. You have already created the service and its app.yaml. Which configuration should you apply to the app.yaml to meet these requirements?

Accepted Answer

Add an Ingress control setting of 'internal-and-cloud-load-balancing' to the service's app.yaml.. To restrict an App Engine standard service to internal traffic only, you configure the ingress control setting in app.yaml. The value 'internal-and-cloud-load-balancing' allows requests from your VPC network and from Cloud Load Balancing, while blocking direct public access. This matches the requirement of reachability only from within the VPC and other App Engine services.

Answer

Deploy the service with the '--no-allow-unauthenticated' flag, which blocks all public access.

Answer

Set the service to use a private IP address by adding 'network: private' to the app.yaml.

Answer

Set inbound_services to include only 'warmup' and 'mail'.

Question 7

You are using Google Cloud Deploy to manage deployments to a GKE cluster. You need to ensure that a deployment to the production target requires manual approval before it proceeds. What should you do?

Accepted Answer

Configure the production target in the delivery pipeline with a `requireApproval` field set to true.. Cloud Deploy allows you to define approval requirements for specific targets in the delivery pipeline. By setting requireApproval to true for the production target, the rollout will pause and wait for a manual approval before proceeding.

Answer

Assign the Cloud Deploy Approver role to the production target's service account.

Answer

Set the `--require-approval` flag when creating the delivery pipeline with `gcloud deploy delivery-pipelines create`.

Answer

Use a Cloud Build trigger that runs a manual approval step before deploying to production.

Question 8

You are deploying a Node.js API to Cloud Run. The API must connect to a Cloud SQL for PostgreSQL instance using a private IP address and must not expose the database to the public internet. You want the Cloud Run service to reach the database over a private network path. Which configuration should you apply?

Accepted Answer

Attach the Cloud Run service to a Serverless VPC Access connector and configure the Cloud SQL connection using the instance's private IP.. Cloud Run reaches private resources through Serverless VPC Access connectors, which route egress traffic into a VPC network. Combined with Cloud SQL private IP, this keeps database traffic internal. The Cloud SQL Auth Proxy sidecar pattern applies to GKE, and public IP with authorized networks contradicts the private-only requirement.

Answer

Configure the Cloud Run service with `--vpc-egress all-traffic` without a connector and rely on the default VPC peering to Cloud SQL.

Answer

Assign a public IP to the Cloud SQL instance and restrict access using authorized networks that include the Cloud Run egress IP range.

Answer

Enable the Cloud SQL Auth Proxy sidecar in the Cloud Run revision and connect using the instance connection name.

Question 9

A developer needs to deploy a containerized web application to Cloud Run. The application must be able to connect to a Cloud SQL for PostgreSQL instance using its private IP address. The developer has already created the Cloud SQL instance and a Serverless VPC Access connector. What should the developer do to enable the connection when deploying the Cloud Run service?

Accepted Answer

Set the --vpc-connector flag to the connector name and ensure the Cloud SQL instance's private IP is reachable from the connector's VPC network.. Cloud Run services need a Serverless VPC Access connector to reach private IPs in a VPC network. By specifying the --vpc-connector flag during deployment, the service's egress traffic is routed through the connector, enabling connectivity to the Cloud SQL instance's private IP. The connection name is not required for private IP connections; that is used for the Cloud SQL Auth proxy over public IP.

Answer

Set the --ingress flag to 'internal' and provide the Cloud SQL instance's connection name as an environment variable.

Answer

Add the --add-cloudsql-instances flag with the instance connection name and set the --vpc-connector flag to the connector name.

Answer

Use the --set-env-vars flag to set DB_HOST to the private IP address, and grant the Cloud Run service account the Cloud SQL Client role.

Question 10

You deploy a new revision of a Cloud Run service that must process background work for up to 15 minutes per request. The service currently uses the default request timeout, and requests are being terminated early. You need to configure the service so long-running requests can complete. What should you do?

Accepted Answer

Increase the Cloud Run request timeout to the maximum allowed value and ensure the service is configured to allow the extended request duration.. Cloud Run lets you configure the request timeout per service, and the supported maximum accommodates requests up to 60 minutes. Raising the timeout from the default allows the 15-minute background request to finish rather than being cut off. Concurrency, CPU allocation, and minimum instances affect resource behavior but do not extend how long a request may run.

Answer

Configure Cloud Run to use CPU always allocated and set the minimum instance count to 1.

Answer

Set the Cloud Run service request timeout to 3600 seconds and deploy a new revision.

Answer

Set the Cloud Run service concurrency to 80 so requests are queued and each request gets more time to finish.

Question 11

You are deploying a new application to Google Cloud using Cloud Deploy. You need to set up a delivery pipeline that automatically promotes releases through multiple environments (dev, staging, prod) with approval gates. Which two actions should you perform? (Choose two.)

Accepted Answer

Configure approval gates by setting the 'requireApproval' field in the delivery pipeline's promotion configuration.. To set up a Cloud Deploy delivery pipeline with multiple environments and approval gates, you must create a delivery pipeline resource that defines the sequence of targets and promotion order. Additionally, you configure approval gates by setting the 'requireApproval' field in the promotion configuration for specific targets. These two actions establish the automated promotion workflow with manual approvals where needed.

Answer

Define a delivery pipeline in a Skaffold configuration file that specifies the deployment stages and the target environments.

Answer

Manually create a new release for each environment and use Cloud Deploy's promote command to advance it.

Answer

Use Cloud Build triggers to automatically promote releases when a new image is pushed to Artifact Registry.

Question 12

You are using Google Cloud Deploy to manage the deployment of an application to multiple GKE clusters across different environments (dev, staging, prod). You want to ensure that the prod deployment requires manual approval before it proceeds. What should you configure in the delivery pipeline?

Accepted Answer

Add a `requireApproval` field to the prod target in the delivery pipeline configuration.. In Google Cloud Deploy, you can set `requireApproval: true` on a target. When a rollout reaches that target, it will pause and wait for a manual approval before continuing. This is the straightforward, native way to enforce a manual gate for production deployments, ensuring that a human authorizes the release.

Answer

Use a canary deployment strategy for the prod target.

Answer

Set the prod target to use a different service account with limited permissions.

Answer

Configure a Cloud Build trigger that runs a manual approval step before the prod deployment.

Question 13

A team uses Google Cloud Deploy to promote a release through dev, staging, and prod targets. The prod target requires a manual approval before the rollout proceeds. The team wants the approval to be required only for prod, not for dev or staging. What should they configure?

Accepted Answer

Configure the prod target with a requireApproval property in the target definition, so only rollouts to that target pause for approval.. Approval requirements in Google Cloud Deploy are attached to targets, so marking only the prod target as requiring approval makes rollouts pause there while dev and staging continue automatically. This keeps the promotion flow intact and scopes the manual gate to the environment that needs it, without duplicating pipelines or relying on rollout-level state that is set at runtime.

Answer

Add a requireApproval field set to true in the prod target's deploy parameters in the delivery pipeline definition.

Answer

Create a separate delivery pipeline for prod that references the same targets, and enable approval on that pipeline only.

Answer

Set the rollout's approval state to APPROVED in the delivery pipeline for dev and staging, and to NEEDS_APPROVAL for prod.

Question 14

You maintain a Go service that runs on Cloud Run and connects to Cloud SQL for PostgreSQL. Your team requires that the database connection does not traverse the public internet and that the connection remains stable during traffic spikes. You have already created a Serverless VPC Access connector named 'projects/my-proj/locations/us-central1/connectors/cr-conn' in the same region as the Cloud Run service. Which deployment configuration should you apply?

Accepted Answer

Deploy the Cloud Run service with the Serverless VPC Access connector and set egress to 'all-traffic', then connect to Cloud SQL using its private IP.. To keep Cloud SQL traffic off the public internet from Cloud Run, you must route egress through the VPC using a Serverless VPC Access connector and connect to Cloud SQL's private IP. Setting egress to all-traffic ensures even non-RFC1918 destinations use the connector. The built-in Cloud SQL connection uses a secure proxy but does not by itself prevent public IP usage if the application specifies it.

Answer

Deploy the Cloud Run service with the flag --add-cloudsql-instances and connect to the database using its public IP.

Answer

Deploy the Cloud Run service with a Cloud SQL Auth Proxy sidecar container listening on localhost.

Answer

Set the Cloud Run service's egress to 'private-ranges-only' and add the connector as a network interface.

Question 15

A developer is using Google Cloud Deploy to manage releases to a GKE cluster. They want to ensure that a new release is only deployed to the production target after manual approval. Which configuration should they use?

Accepted Answer

In the delivery pipeline definition, set `requireApproval: true` on the production target.. Google Cloud Deploy allows you to define targets with an approval requirement. Setting `requireApproval: true` in the target's configuration causes the pipeline to wait for a manual approval before proceeding to that target. This is the intended feature for gating production deployments and ensures that a human reviews and approves the release before it reaches production.

Answer

Configure the production target to use a separate service account that requires two-factor authentication.

Answer

Add a `predeploy` hook in the `skaffold.yaml` that checks for an approval flag in a Cloud Storage bucket.

Answer

Use a Cloud Build trigger that only runs after a manual trigger from the Cloud Console.