PCD Deploying applications Practice Test 5 — 15 Questions

Question 1

You are deploying a Java application to App Engine standard environment. The application uses a custom runtime and requires the Java 17 runtime. You have written the app.yaml with 'runtime: java17'. During deployment, you receive an error that the runtime is not supported. You need to resolve this and successfully deploy. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the app.yaml includes 'runtime: java17' and that the application is packaged as an executable JAR or WAR file, and that the 'entrypoint' is correctly set if needed.. App Engine standard environment supports the Java 17 runtime. The error indicating an unsupported runtime typically arises from an incorrectly formatted app.yaml or missing application artifacts. Ensuring the runtime field is correct and the application is properly packaged as a JAR or WAR, with an entrypoint if required, will allow successful deployment.

Answer

Switch to the App Engine flexible environment, which supports Java 17, by adding 'env: flex' to the app.yaml.

Answer

Change the runtime to 'java11' because Java 17 is not available in App Engine standard.

Answer

Add 'runtime_config: operating_system: ubuntu22' to the app.yaml to specify the correct operating system.

Question 2

You are preparing a Cloud Build configuration to deploy a containerized service to Cloud Run. You want the build to build the image, push it to Artifact Registry, and deploy a new Cloud Run revision, all with least privilege. Which two actions should you take? (Choose two.)

Accepted Answer

Grant the Cloud Build service account the Artifact Registry Writer role so it can push the built image to the repository.. To build and push an image, the Cloud Build service account needs write access to Artifact Registry, which the Artifact Registry Writer role provides. To deploy a new revision, it needs permission to update the Cloud Run service, which the Cloud Run Admin role provides. Broad roles like Owner violate least privilege, and the other roles address different operations not required by this pipeline.

Answer

Grant the Cloud Build service account the Storage Object Viewer role so it can read the build context from Cloud Storage.

Answer

Grant the Cloud Build service account the Service Account User role on the Cloud Run runtime service account so it can act as that identity.

Answer

Grant the Cloud Build service account the Owner role on the project to avoid permission errors during the build.

Question 3

A company is deploying a new application to Google Kubernetes Engine (GKE). The application consists of a frontend Deployment and a backend Deployment. The frontend needs to communicate with the backend using a stable internal DNS name. The backend should not be accessible from outside the cluster. Which two Kubernetes resources should the team create to meet these requirements? (Choose two.)

Accepted Answer

A Service of type ClusterIP for the backend.. To enable internal communication, a ClusterIP Service provides a stable DNS name and internal IP for the backend. To ensure the backend is not accessible from outside and only the frontend can connect, a NetworkPolicy should be applied to restrict ingress traffic to the backend pods from the frontend pods. Together, these resources meet the requirements for stable internal DNS and network isolation.

Answer

A Service of type LoadBalancer for the backend.

Answer

An Ingress resource for the frontend.

Answer

A Service of type NodePort for the backend.

Question 4

You are deploying a new revision of a Cloud Run service that must access a Cloud SQL for PostgreSQL instance. The service is in a project with a Shared VPC, and the Cloud SQL instance has a private IP. You want to minimize latency and avoid exposing the database to the public internet. Which configuration should you use?

Accepted Answer

Configure the Cloud Run service with a Serverless VPC Access connector in the Shared VPC host project and connect to the Cloud SQL private IP.. To reach a Cloud SQL private IP from Cloud Run, the service needs VPC connectivity. In a Shared VPC, the Serverless VPC Access connector must be created in the host project where the VPC network resides. Using the connector in the host project allows the service to access the private IP without public exposure. Other options either lack VPC connectivity or misplace the connector.

Answer

Configure the Cloud Run service to use the Cloud SQL Auth proxy with the instance connection name and connect over the public IP.

Answer

Configure the Cloud Run service with a Serverless VPC Access connector in the service project and connect to the Cloud SQL private IP.

Answer

Configure the Cloud Run service to use Direct VPC egress and connect to the Cloud SQL private IP.

Question 5

A developer is deploying a containerized application to Cloud Run. The application requires access to a Cloud SQL for MySQL instance. The developer wants to connect securely without exposing the database to the public internet. Which two actions should the developer take? (Choose two.)

Accepted Answer

Enable the Cloud SQL Admin API and create a Cloud SQL instance with a private IP address.. To connect Cloud Run to Cloud SQL without public exposure, you need a private network path. Creating a Cloud SQL instance with a private IP and enabling the Admin API sets up the database securely. Then, configuring a Serverless VPC Access connector and attaching it to the Cloud Run service allows outbound traffic to reach the private IP. These two actions together provide secure, private connectivity.

Answer

Set the Cloud Run service's ingress to 'internal' to allow only internal traffic.

Answer

Assign the Cloud Run service account the Cloud SQL Client role (`roles/cloudsql.client`).

Answer

Use the Cloud SQL Auth proxy as a sidecar container in the Cloud Run service.

Question 6

A company is using Google Cloud Deploy to manage deployments to multiple GKE clusters across different environments. They need to ensure that a new release is automatically promoted to the next environment only after the previous environment's deployment is verified. Which two configurations should they implement to achieve this? (Choose two.)

Accepted Answer

Define a delivery pipeline with multiple stages, each targeting a different GKE cluster.. To automatically promote a release after verification, you need a delivery pipeline with multiple stages targeting different clusters, and each stage must include a verification job. The verification job runs tests after deployment, and if successful, Cloud Deploy promotes the release to the next stage. This creates a gated, automated promotion flow.

Answer

Use Cloud Build triggers to manually promote the release after verifying the deployment.

Answer

Configure the delivery pipeline to automatically promote releases by setting the 'requireApproval' field to false for each stage.

Answer

Set the 'suspend' field to true in the delivery pipeline to pause promotion until verification completes.

Question 7

You are deploying a new version of a service to Google Kubernetes Engine (GKE) using a Deployment. You want to ensure that the rollout is automatically paused if the new pods fail their readiness probes, and that the old pods are not terminated until the new ones are ready. Which two actions should you take? (Choose two.)

Accepted Answer

Set the Deployment's spec.strategy.rollingUpdate.maxUnavailable to 0.. To pause a rollout when new pods fail readiness and prevent old pods from being terminated, you need a readiness probe to detect failure and maxUnavailable set to 0 to ensure old pods stay until new ones are ready. maxSurge and liveness probes do not provide this gating behavior. progressDeadlineSeconds only marks failure after a timeout.

Answer

Add a liveness probe to the new pods that restarts the container if it becomes unresponsive.

Answer

Set the Deployment's spec.progressDeadlineSeconds to 600.

Answer

Set the Deployment's spec.strategy.rollingUpdate.maxSurge to 1.

Question 8

A developer is deploying a Python application to App Engine standard environment. The application requires a specific version of a third-party library that is not included in the App Engine standard runtime. The developer needs to ensure the library is available at runtime. What should the developer do?

Accepted Answer

Add the library to the requirements.txt file and deploy the application.. In App Engine standard environment for Python, third-party libraries are managed by listing them in a requirements.txt file. During deployment, App Engine installs these dependencies into the runtime, making them available to the application. This is the supported and recommended approach. Other methods like vendoring or custom runtimes are either not applicable or not supported in the standard environment.

Answer

Upload the library as a Cloud Storage object and reference it in the application code.

Answer

Include the library in a lib/ directory and add the path to the app.yaml file.

Answer

Use a custom runtime by specifying a Dockerfile in the app.yaml file.

Question 9

You are deploying a new version of an application to Google Kubernetes Engine (GKE). You want to ensure that the new version receives no production traffic until it passes a series of automated tests. You also want to be able to quickly roll back if issues are detected. Which two actions should you take? (Choose two.)

Accepted Answer

Use a blue/green Deployment strategy with two separate Deployments and switch the Service selector to the new version after tests pass.. Canary and blue/green deployments both allow you to test a new version without exposing it to all production traffic. Canary gradually shifts traffic, while blue/green keeps two environments and switches traffic after validation. Both support quick rollback. RollingUpdate with zero surge/unavailable blocks deployment, and StatefulSet is for stateful workloads, not traffic isolation.

Answer

Create a new Deployment with the new version and set the Service selector to match only the new version's labels.

Answer

Use a StatefulSet with podManagementPolicy set to Parallel and a headless Service.

Answer

Use a RollingUpdate strategy with maxSurge and maxUnavailable set to 0.

Question 10

A developer is deploying a Python application to App Engine standard environment. The application reads a configuration file from a Cloud Storage bucket at startup. The developer wants to minimize cold start time and ensure the configuration is available immediately. Which approach should the developer take?

Accepted Answer

Store the configuration file in the application's source code and deploy it with the application.. To minimize cold start and ensure immediate availability, the configuration file should be included in the application source code. This eliminates network calls during instance startup. While environment variables can be used for small values, a file is better suited for structured configuration. Bundling the file is the most efficient approach for static configuration.

Answer

Use the Cloud Storage client library to download the file in the application's main function before handling requests.

Answer

Mount the Cloud Storage bucket as a filesystem using Cloud Storage FUSE in the app.yaml.

Answer

Store the configuration in environment variables set via the app.yaml and read them at runtime.

Question 11

A team deploys a containerized web application on Google Kubernetes Engine (GKE) using a Deployment. They need to expose the application externally via a stable IP address and enable SSL termination. Which resource should they use?

Accepted Answer

Ingress with Google-managed SSL certificate. An Ingress with a Google-managed SSL certificate is the correct choice because it provides a single stable IP address via a global forwarding rule, terminates SSL at the Google Cloud HTTP(S) load balancer, and routes traffic to the GKE Deployment. This approach offloads SSL decryption from the application pods and uses a managed certificate that auto-renews, meeting both the stable IP and SSL termination requirements.

Answer

HorizontalPodAutoscaler

Answer

Service type NodePort

Answer

Service type LoadBalancer

Question 12

During a deployment to App Engine flexible environment, the new version fails to start and the logs show 'Container failed to start: context deadline exceeded'. The previous version remains serving traffic. What is the most likely cause?

Accepted Answer

The container startup time exceeds the 10-minute timeout.. The error 'context deadline exceeded' in App Engine flexible environment indicates that the container did not start within the allowed startup timeout. The default timeout for container startup in App Engine flexible is 10 minutes, and if the application takes longer (e.g., due to slow initialization, large dependency downloads, or database migrations), the platform kills the container and logs this error. The previous version continues serving because the new version failed to become healthy.

Answer

The health check is misconfigured, causing the instance to be considered unhealthy.

Answer

The app requires an environment variable that is not set.

Answer

The Dockerfile has a syntax error that prevents the container from building.

Question 13

Which TWO statements about deploying applications on Google Kubernetes Engine (GKE) are correct?

Accepted Answer

HorizontalPodAutoscaler can use custom metrics from Cloud Monitoring.. Option A is correct because GKE's HorizontalPodAutoscaler can scale workloads based on custom metrics exported to Cloud Monitoring (via the custom metrics adapter / Stackdriver adapter), not just CPU or memory. Option D is correct because a PodDisruptionBudget defines the minimum available or maximum unavailable pods, which constrains voluntary disruptions such as node drains during node repair or upgrades, helping maintain availability. Option B is not correct as stated because Kubernetes Secrets are only base64-encoded by default; encryption at rest requires configuring a KMS key (application-layer encryption) on GKE. Option C is not correct because a zonal GKE cluster uses zonal persistent disks by default; regional PDs are used with regional clusters for higher availability. Option E is not correct because a Deployment can be exposed externally via a Service of type LoadBalancer or NodePort, and an Ingress is only one optional approach, not a requirement.

Answer

Kubernetes Secrets are encrypted at rest by default.

Answer

A zonal GKE cluster automatically uses regional persistent disks for high availability.

Answer

To expose a Deployment externally, you must create an Ingress resource.

Question 14

Which THREE practices should be followed when deploying a containerized application to Cloud Run?

Accepted Answer

Avoid writing to the local filesystem for data that must persist across requests.. Option A is correct because Cloud Run instances have an in-memory filesystem that is ephemeral and can be discarded when an instance is stopped or replaced, so any data written locally will not persist across requests or instances. Option D is correct because Cloud Run scales horizontally by creating and destroying instances, so the application must be stateless and store session state in an external service such as Firestore, Memorystore, or Cloud SQL. Option E is correct because Cloud Run provides built-in autoscaling (including scale to zero) that automatically adjusts the number of container instances based on incoming traffic, making it the intended mechanism for handling traffic bursts. Option B is incorrect because the request timeout is not a cold-start mitigation; Cloud Run request timeouts default to 300 seconds and can be configured up to 60 minutes, and cold starts are addressed through minimum instances or startup CPU boost. Option C is incorrect because Cloud Run injects the PORT environment variable and expects the container to listen on that port (default 8080), so the port should be read from $PORT rather than hardcoded.

Answer

Set a maximum request timeout of 10 minutes to avoid cold starts.

Answer

Hardcode port 8080 in the container.

Question 15

A company wants to deploy a containerized application on Google Kubernetes Engine (GKE) with zero downtime during updates. The application is stateless and runs on a Deployment with 5 replicas. Which deployment strategy should be used?

Accepted Answer

Rolling update. A rolling update is the default deployment strategy in Kubernetes and is ideal for stateless applications requiring zero downtime. It gradually replaces old Pods with new ones, ensuring that a minimum number of replicas remain available throughout the update. This strategy is configured via the `strategy.type: RollingUpdate` field in the Deployment spec, with parameters like `maxSurge` and `maxUnavailable` controlling the pace.

Answer

Blue/green deployment

Answer

Recreate update

Answer

Canary deployment