PCD Deploying applications Practice Test 5 — 15 Questions

Question 1

A company is deploying a multi-region application on Cloud Run to serve global users. They want low latency and automatic failover. Which approach is best?

Accepted Answer

Deploy to multiple Cloud Run regions behind an external HTTP(S) Load Balancer with global backend.. Deploying Cloud Run services across multiple regions behind an external HTTP(S) Load Balancer with a global backend provides both low latency (via Google's global anycast IP and nearest-region routing) and automatic failover (the load balancer health checks automatically route traffic away from unhealthy backends). This architecture uses the load balancer's global external backend service to direct requests to the closest healthy Cloud Run service, ensuring high availability and performance for global users.

Answer

Deploy to multiple regions and use DNS round-robin.

Answer

Use Cloud Run for Anthos on-premises.

Answer

Deploy to a single region and use Cloud CDN.

Question 2

A team is deploying a new version of an application on GKE using a rolling update. They want to ensure that the update proceeds only if the new pods are healthy. Which two steps should they include? (Choose two.)

Accepted Answer

Set the minReadySeconds field in the deployment.. Setting `minReadySeconds` in a Deployment ensures that a newly created Pod is considered ready only after it has been stable for that duration, preventing the rolling update from proceeding if the Pod fails shortly after startup. Option B is correct because a readiness probe determines whether a Pod is ready to serve traffic; during a rolling update, the Deployment controller waits for the new Pod's readiness probe to succeed before scaling down old Pods, ensuring the update only continues when new Pods are healthy.

Answer

Define a liveness probe for the container.

Answer

Set the revisionHistoryLimit to 10.

Answer

Use a postStart lifecycle hook to test health.

Question 3

A company wants to automate the deployment of a microservice application to Cloud Run using Cloud Build. They want to ensure zero-downtime deployments and traffic migration. Which three features should they utilize? (Choose three.)

Accepted Answer

Cloud Build triggers to build and deploy on code changes.. Cloud Build triggers can be configured to automatically build and deploy a microservice to Cloud Run whenever code changes are pushed to a repository. This enables continuous delivery and ensures that the latest code is deployed without manual intervention, supporting zero-downtime deployments when combined with traffic management features.

Answer

Cloud Run min and max instance settings.

Answer

Cloud Run managed continuous deployment from a repository.

Question 4

A developer is deploying a Node.js application to App Engine flexible environment. They need to install custom dependencies and run startup scripts. Which two configuration elements should they define in the app.yaml? (Choose two.)

Accepted Answer

entrypoint. A is correct because the `entrypoint` element in app.yaml for App Engine flexible environment specifies the command to run your application, allowing you to execute custom startup scripts and install dependencies before the main process starts. This is essential for Node.js apps that require custom build steps or runtime initialization beyond the default `npm start`.

Answer

env_variables

Answer

manual_scaling

Answer

network

Question 5

A developer uses this Cloud Build configuration to deploy to Cloud Run. The build succeeds but the deployment fails with an error that the service account lacks permission. What is the most likely missing permission?

Accepted Answer

roles/iam.serviceAccountUser on the Cloud Build service account.. The Cloud Build service account (typically the default compute engine service account or a user-specified service account) needs the `roles/iam.serviceAccountUser` role on the Cloud Run service account to impersonate it during deployment. Without this permission, Cloud Build cannot act as the Cloud Run service account to deploy the revision, even though the build itself succeeds. This is a common misconfiguration when deploying to Cloud Run from Cloud Build.

Answer

roles/iam.serviceAccountUser on the Compute Engine default service account.

Answer

roles/storage.objectViewer on the container registry.

Answer

roles/run.admin on the Cloud Run service.

Question 6

During a rolling update, the new pods are failing to start because they require more memory than available on nodes. What is the most likely cause?

Accepted Answer

The resource requests and limits are misconfigured.. The most likely cause of pods failing to start due to insufficient memory is misconfigured resource requests and limits. If the memory request (spec.containers[].resources.requests.memory) is set too high, the scheduler cannot find a node with enough allocatable memory, leaving pods in a Pending state. Similarly, if the limit is set too low, the pod may be OOMKilled after starting, but the question specifically states 'failing to start,' pointing to a scheduling failure due to requests exceeding node capacity.

Answer

The maxSurge value is too low.

Answer

The replicas count is too high.

Answer

The strategy type is wrong.

Question 7

A company deploys a containerized web application to Cloud Run. The application needs to access a Cloud SQL instance but fails with a connection timeout. The VPC connector is configured and attached to the Cloud Run service. What is the most likely cause?

Accepted Answer

The VPC connector is not configured to route to the Cloud SQL private IP range.. The VPC connector is attached to the Cloud Run service, but for it to route traffic to the Cloud SQL private IP address, the connector must be configured with a subnet that has a route to the Cloud SQL private IP range (e.g., 10.0.0.0/8 or a specific allocated range). Without this route, packets destined for the Cloud SQL instance's private IP are dropped, causing a connection timeout. The VPC connector itself does not automatically know how to reach Cloud SQL; the subnet must be peered or have appropriate routes.

Answer

Cloud SQL instance does not have a public IP address.

Answer

The application is not using the Cloud SQL Auth Proxy.

Answer

The VPC firewall rules block traffic to Cloud SQL.

Question 8

A team is deploying a critical microservice on GKE. They want to minimize risk by gradually shifting traffic from old to new version. They use a Deployment with a single Service. What deployment strategy should they implement?

Accepted Answer

Create two Deployments (stable and canary) with different numbers of replicas and use the same Service label.. It implements a canary deployment pattern on GKE: two separate Deployments (stable and canary) share the same Service label, allowing the Service to distribute traffic to both based on replica counts. This enables gradual traffic shifting by adjusting the number of canary replicas, minimizing risk while the new version is validated.

Answer

Use a rolling update with maxSurge=1 and maxUnavailable=0.

Answer

Use a single Deployment with a readinessProbe that fails for the new version until ready.

Answer

Create two separate Deployments and switch the Service selector to the new version after testing.

Question 9

A startup wants to deploy a Python web application with low traffic and minimal operational overhead. They need to automatically scale down to zero when not in use. Which compute option should they choose?

Accepted Answer

App Engine Standard Environment.. Both App Engine Standard Environment and Cloud Run satisfy the requirements of low traffic, minimal operational overhead, and scaling to zero. App Engine Standard can scale to zero when no requests are incoming and supports Python, making it a valid choice. Cloud Run also scales to zero automatically and is fully managed, but for a simple Python web app, App Engine Standard offers even less configuration. Therefore, both options are correct.

Answer

Compute Engine with managed instance group and autoscaling.

Answer

Google Kubernetes Engine with cluster autoscaling.

Question 10

A team uses Cloud Build to automatically deploy a Cloud Function on push to a repository. The build fails intermittently with 'PERMISSION_DENIED' when executing gcloud functions deploy. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the necessary IAM permissions on the Cloud Functions API.. The intermittent 'PERMISSION_DENIED' error when Cloud Build runs `gcloud functions deploy` indicates that the Cloud Build service account does not have the required IAM roles (e.g., Cloud Functions Developer or Cloud Functions Admin) on the Cloud Functions API. Cloud Build uses its default compute engine service account (or a user-specified service account) to execute build steps; if this account lacks the `cloudfunctions.functions.create` or `cloudfunctions.functions.update` permission, the deployment will fail, and the intermittent nature may be due to eventual consistency or race conditions in IAM propagation.

Answer

The region specified in the build configuration does not match the function's region.

Answer

The build configuration file has a syntax error.

Answer

The Cloud Source Repository does not have the correct triggers.

Question 11

A company deploys a stateful application on GKE using a StatefulSet with PersistentVolumeClaims (PVCs). After a node failure, the pod is rescheduled to another node but the PVC remains in 'Pending' state. What is the most likely reason?

Accepted Answer

The PV's claimRef still points to the old PVC UID and is in Released state.. When a StatefulSet pod is rescheduled after a node failure, the original PersistentVolume (PV) may remain in a 'Released' state if its claimRef still points to the old PersistentVolumeClaim (PVC) UID. The PV cannot be re-bound to the new PVC (which has a different UID) until the claimRef is cleared, causing the PVC to remain 'Pending'. This is a known behavior in Kubernetes where PVs are not automatically recycled for reuse with a new PVC UID.

Answer

The PVC is bound to a PV that is still attached to the failed node.

Answer

The StorageClass has reclaimPolicy: Delete so the PV was deleted.

Answer

The StatefulSet's pod management policy prevents reattachment.

Question 12

A developer wants to deploy a Compute Engine instance using Terraform. They want to run a startup script to install software. How should they provide the script?

Accepted Answer

Use the metadata block with key 'startup-script' and the script content as value.. Terraform's `google_compute_instance` resource supports a `metadata` block where you can set the key `startup-script` with the script content as the value. When the Compute Engine instance boots, the `google-guest-agent` reads this metadata key and executes the script as the root user, which is the standard method for running startup scripts on Linux instances without additional configuration.

Answer

Use a cloud-init configuration file passed via user-data metadata.

Answer

Use the user-data metadata key with the script content.

Answer

Use the gcloud compute instances create command with --metadata-from-file flag.

Question 13

A company deploys a web app on Cloud Run and configures a custom domain mapping with a managed SSL certificate. After mapping, the domain returns 404 errors. The Cloud Run service is accessible via its default URL. What is the most likely issue?

Accepted Answer

The domain mapping is pointing to a different Cloud Run service or region.. The most likely issue is that the custom domain mapping is pointing to a different Cloud Run service or region. When a custom domain is mapped to Cloud Run, the DNS CNAME must point to the domain mapping's resolved target (e.g., `ghs.googlehosted.com`), not to the default Cloud Run URL. If the mapping points to a different service or region, the request reaches Cloud Run but the service cannot handle it, resulting in a 404 error from the Cloud Run frontend. The default URL works because it bypasses the custom domain mapping and routes directly to the correct service.

Answer

The SSL certificate is not yet provisioned.

Answer

The Cloud Run service does not have the correct IAM permissions.

Answer

The DNS CNAME record is not configured correctly.

Question 14

A team deploys a microservices architecture on GKE with Istio service mesh. They want to enforce mutual TLS (mTLS) between services. After enabling Istio with the default configuration, some services report connection errors. What is the most likely cause?

Accepted Answer

Some services do not have Istio sidecar injected, so strict mTLS fails.. Istio's default configuration enables 'STRICT' mTLS mode, which requires all services to have an Envoy sidecar proxy injected to handle TLS handshakes. If any service lacks the sidecar, it cannot participate in mTLS, causing connection errors when other services attempt to communicate with it using TLS. The error typically manifests as 'upstream connect error' or 'TLS handshake failure' in the sidecar logs.

Answer

The services need a ServiceEntry to communicate with each other.

Answer

The namespace is not labeled with istio-injection=enabled.

Answer

The services are using a different service mesh protocol.

Question 15

A team wants to deploy infrastructure as code on Google Cloud. They need a declarative language that supports modularity and state management. Which tool should they choose?

Accepted Answer

Terraform.. Terraform is the correct choice because it is a declarative infrastructure-as-code tool that supports modularity through reusable modules and state management via state files (local or remote backends like Cloud Storage). It allows teams to define Google Cloud resources in HashiCorp Configuration Language (HCL) and track resource changes over time, enabling safe, incremental updates.

Answer

Cloud Deployment Manager.

Answer

Cloud Shell.

Answer

gcloud commands.