PCD Deploying applications Practice Test 5 — 15 Questions

Question 1

A team is deploying a new version of an application on GKE using a rolling update. They want to ensure that the update proceeds only if the new pods are healthy. Which two steps should they include? (Choose two.)

Accepted Answer

Set the minReadySeconds field in the deployment.. Option A is correct because setting `minReadySeconds` in a Deployment ensures that a newly created Pod is considered ready only after it has been stable for that duration, preventing the rolling update from proceeding if the Pod fails shortly after startup. Option B is correct because a readiness probe determines whether a Pod is ready to serve traffic; during a rolling update, the Deployment controller waits for the new Pod's readiness probe to succeed before scaling down old Pods, ensuring the update only continues when new Pods are healthy.

Answer

Define a liveness probe for the container.

Answer

Set the revisionHistoryLimit to 10.

Answer

Use a postStart lifecycle hook to test health.

Question 2

A company wants to automate the deployment of a microservice application to Cloud Run using Cloud Build. They want to ensure zero-downtime deployments and traffic migration. Which three features should they utilize? (Choose three.)

Accepted Answer

Cloud Build triggers to build and deploy on code changes.. Cloud Build triggers automate building and deploying, Cloud Run traffic splitting enables gradual rollout, and deploying with --no-traffic allows creating a new revision without serving traffic, then shifting traffic gradually.

Answer

Cloud Run min and max instance settings.

Answer

Cloud Run managed continuous deployment from a repository.

Question 3

A developer is deploying a Node.js application to App Engine flexible environment. They need to install custom dependencies and run startup scripts. Which two configuration elements should they define in the app.yaml? (Choose two.)

Accepted Answer

entrypoint. A is correct because the `entrypoint` element in app.yaml for App Engine flexible environment specifies the command to run your application, allowing you to execute custom startup scripts and install dependencies before the main process starts. This is essential for Node.js apps that require custom build steps or runtime initialization beyond the default `npm start`.

Answer

env_variables

Answer

manual_scaling

Answer

network

Question 4

After updating the image to v2, users report that the frontend application returns errors because it cannot reach the backend service. The backend service is running on GKE with the name 'backend-service' in the same namespace. What is the most likely cause?

Accepted Answer

The application expects the backend URL from an environment variable named BACKEND_SERVICE_URL, but the deployment sets BACKEND_URL.. The environment variable is set to BACKEND_URL, but the application likely expects a different variable name like BACKEND_SERVICE_URL. This mismatch causes the application to fail to find the backend URL.

Answer

The selector labels do not match the pods.

Answer

The backend service is not listening on port 8080.

Answer

The termination grace period is too short causing connection drops.

Question 5

A developer uses this Cloud Build configuration to deploy to Cloud Run. The build succeeds but the deployment fails with an error that the service account lacks permission. What is the most likely missing permission?

Accepted Answer

roles/iam.serviceAccountUser on the Cloud Build service account.. Cloud Build uses its own service account (the Cloud Build service account) to execute deployments. To deploy to Cloud Run, that service account needs the 'roles/iam.serviceAccountUser' role on the runtime service account (default Compute Engine service account) to act as that service account.

Answer

roles/iam.serviceAccountUser on the Compute Engine default service account.

Answer

roles/storage.objectViewer on the container registry.

Answer

roles/run.admin on the Cloud Run service.

Question 6

During a rolling update, the new pods are failing to start because they require more memory than available on nodes. What is the most likely cause?

Accepted Answer

The resource requests and limits are misconfigured.. The resource requests specify 1Gi memory and 500m CPU. If nodes do not have enough memory to satisfy the request (plus existing pods), new pods will fail to schedule. The requests may be too high for the cluster's node resources.

Answer

The maxSurge value is too low.

Answer

The replicas count is too high.

Answer

The strategy type is wrong.

Question 7

A company deploys a containerized web application to Cloud Run. The application needs to access a Cloud SQL instance but fails with a connection timeout. The VPC connector is configured and attached to the Cloud Run service. What is the most likely cause?

Accepted Answer

The VPC connector is not configured to route to the Cloud SQL private IP range.. Option C is correct because the VPC connector allows egress to VPC but Cloud SQL requires Private Services Access or a Serverless VPC Access connector with the 'private network' configuration to reach the Cloud SQL private IP. Option A is wrong because public IP access is not needed if private network is used. Option B is wrong because Cloud SQL Auth Proxy can be used but not required. Option D is wrong because firewall rules are not the primary issue.

Answer

Cloud SQL instance does not have a public IP address.

Answer

The application is not using the Cloud SQL Auth Proxy.

Answer

The VPC firewall rules block traffic to Cloud SQL.

Question 8

A team is deploying a critical microservice on GKE. They want to minimize risk by gradually shifting traffic from old to new version. They use a Deployment with a single Service. What deployment strategy should they implement?

Accepted Answer

Create two Deployments (stable and canary) with different numbers of replicas and use the same Service label.. Option D is correct because it implements a canary deployment pattern on GKE: two separate Deployments (stable and canary) share the same Service label, allowing the Service to distribute traffic to both based on replica counts. This enables gradual traffic shifting by adjusting the number of canary replicas, minimizing risk while the new version is validated.

Answer

Use a rolling update with maxSurge=1 and maxUnavailable=0.

Answer

Use a single Deployment with a readinessProbe that fails for the new version until ready.

Answer

Create two separate Deployments and switch the Service selector to the new version after testing.

Question 9

A startup wants to deploy a Python web application with low traffic and minimal operational overhead. They need to automatically scale down to zero when not in use. Which compute option should they choose?

Accepted Answer

Cloud Run.. Cloud Run is the correct choice because it is a fully managed serverless platform that automatically scales your containerized application to zero when there are no incoming requests, and it charges only for the resources used during request processing. This aligns perfectly with the startup's requirements for low traffic, minimal operational overhead, and the ability to scale down to zero when not in use.

Answer

App Engine Standard Environment.

Answer

Compute Engine with managed instance group and autoscaling.

Answer

Google Kubernetes Engine with cluster autoscaling.

Question 10

A team uses Cloud Build to automatically deploy a Cloud Function on push to a repository. The build fails intermittently with 'PERMISSION_DENIED' when executing gcloud functions deploy. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the necessary IAM permissions on the Cloud Functions API.. Option A is correct because the Cloud Build service account needs the Cloud Functions Developer role. Option B is wrong because repository access is not the issue. Option C is wrong because region mismatch would give a different error. Option D is wrong because build configuration syntax error would give a parsing error.

Answer

The region specified in the build configuration does not match the function's region.

Answer

The build configuration file has a syntax error.

Answer

The Cloud Source Repository does not have the correct triggers.

Question 11

A company deploys a stateful application on GKE using a StatefulSet with PersistentVolumeClaims (PVCs). After a node failure, the pod is rescheduled to another node but the PVC remains in 'Pending' state. What is the most likely reason?

Accepted Answer

The PV's claimRef still points to the old PVC UID and is in Released state.. Option D is correct because the PersistentVolume (PV) is in 'Released' state and cannot be reused without manual intervention. Option A is wrong because the PVC is not bound to a PV. Option B is wrong because pod rescheduling does not delete PV. Option C is wrong because reclaim policy can be Retain or Delete.

Answer

The PVC is bound to a PV that is still attached to the failed node.

Answer

The StorageClass has reclaimPolicy: Delete so the PV was deleted.

Answer

The StatefulSet's pod management policy prevents reattachment.

Question 12

A developer wants to deploy a Compute Engine instance using Terraform. They want to run a startup script to install software. How should they provide the script?

Accepted Answer

Use the metadata block with key 'startup-script' and the script content as value.. Option A is correct because Terraform's metadata block with startup-script key is standard. Option B is wrong because cloud-init is not native to Compute Engine. Option C is wrong because compute startup scripts are not in user-data. Option D is wrong because gcloud compute instances create with --metadata-from-file is not Terraform.

Answer

Use a cloud-init configuration file passed via user-data metadata.

Answer

Use the user-data metadata key with the script content.

Answer

Use the gcloud compute instances create command with --metadata-from-file flag.

Question 13

A company deploys a web app on Cloud Run and configures a custom domain mapping with a managed SSL certificate. After mapping, the domain returns 404 errors. The Cloud Run service is accessible via its default URL. What is the most likely issue?

Accepted Answer

The domain mapping is pointing to a different Cloud Run service or region.. Option B is correct because the domain mapping may point to a service that does not exist in that region. Option A is wrong because SSL certificate provisioning would cause SSL errors, not 404. Option C is wrong because the service exists. Option D is wrong because DNS records are typically verified during mapping.

Answer

The SSL certificate is not yet provisioned.

Answer

The Cloud Run service does not have the correct IAM permissions.

Answer

The DNS CNAME record is not configured correctly.

Question 14

A team deploys a microservices architecture on GKE with Istio service mesh. They want to enforce mutual TLS (mTLS) between services. After enabling Istio with the default configuration, some services report connection errors. What is the most likely cause?

Accepted Answer

Some services do not have Istio sidecar injected, so strict mTLS fails.. Option C is correct because Istio's default configuration enables 'STRICT' mTLS mode, which requires all services to have an Envoy sidecar proxy injected to handle TLS handshakes. If any service lacks the sidecar, it cannot participate in mTLS, causing connection errors when other services attempt to communicate with it using TLS. The error typically manifests as 'upstream connect error' or 'TLS handshake failure' in the sidecar logs.

Answer

The services need a ServiceEntry to communicate with each other.

Answer

The namespace is not labeled with istio-injection=enabled.

Answer

The services are using a different service mesh protocol.

Question 15

A team wants to deploy infrastructure as code on Google Cloud. They need a declarative language that supports modularity and state management. Which tool should they choose?

Accepted Answer

Terraform.. Option C is correct because Terraform supports modules, state management, and declarative configuration. Option A is wrong because Deployment Manager is also declarative but less modular. Option B is wrong because Cloud Shell is not a deployment tool. Option D is wrong because gcloud commands are imperative.

Answer

Cloud Deployment Manager.

Answer

Cloud Shell.

Answer

gcloud commands.