PCD Deploying applications Practice Test 6 — 15 Questions

Question 1

A developer is deploying a Cloud Run service that needs to access a Cloud SQL instance. The service is deployed with the --no-allow-unauthenticated flag. What is the recommended way to grant the service access to the database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the Cloud SQL Client role to the Cloud Run service's runtime service account.. The recommended way to grant a Cloud Run service access to a Cloud SQL instance is to grant the Cloud SQL Client role (roles/cloudsql.client) to the Cloud Run service's runtime service account. This role provides the necessary permissions (cloudsql.instances.connect and cloudsql.instances.get) to establish a secure connection via the Cloud SQL Auth Proxy or the Cloud SQL connector library. Using the runtime service account follows the principle of least privilege and avoids managing long-lived credentials.

Answer

Create a service account key and store it in Secret Manager, then mount it as a volume.

Answer

Use the default Compute Engine service account and grant it the Cloud SQL Client role.

Answer

Enable the Cloud SQL Admin API and use Application Default Credentials from the Cloud Run service.

Question 2

A company is deploying a microservices architecture on GKE. They need to expose a set of related microservices under a single external IP address with path-based routing. Which Kubernetes resource should they use?

Accepted Answer

Ingress resource. An Ingress resource is the correct choice because it provides HTTP/HTTPS layer-7 routing to expose multiple services under a single external IP address, using path-based or host-based rules. This directly meets the requirement of exposing a set of related microservices with path-based routing on GKE, whereas a Service of type LoadBalancer would create a separate external IP per service.

Answer

Service of type NodePort

Answer

NetworkPolicy

Answer

Service of type LoadBalancer

Question 3

A developer needs to deploy a Python application to App Engine flexible environment. The application requires a specific version of a system package (libssl-dev) that is not included in the default runtime image. How should the developer install this package?

Accepted Answer

Create a Dockerfile that uses the base runtime image and runs apt-get install.. The App Engine flexible environment runs your application in a Docker container based on a Google-provided runtime image. To install system packages like libssl-dev that are not included in the default image, you must customize the container by creating a Dockerfile that starts FROM the base runtime image and then runs apt-get install. This is the standard method for adding OS-level dependencies in the flexible environment.

Answer

Use a custom runtime that already includes the package.

Answer

Specify the package in the app.yaml file under the 'libraries' section.

Answer

Add the package name to the requirements.txt file.

Question 4

Which TWO of the following are best practices when deploying applications on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across nodes.. Option C is correct because pod anti-affinity (e.g., requiredDuringSchedulingIgnoredDuringExecution or preferredDuringSchedulingIgnoredDuringExecution with topologyKey kubernetes.io/hostname) prevents multiple replicas of the same workload from landing on the same node, improving availability and fault tolerance across nodes and zones. Option D is correct because defining CPU/memory requests lets the GKE scheduler place pods on nodes with sufficient capacity, while limits cap resource usage and prevent noisy-neighbor problems and OOMKills or CPU throttling. Option A is not a best practice because sensitive data in environment variables can leak via process listings, logs, or pod specs; GKE recommends Secret Manager or Kubernetes Secrets mounted as volumes. Option B is wrong because liveness and readiness probes are essential even for stateless apps to detect failures and control traffic routing. Option E is wrong because using the default Compute Engine service account grants overly broad permissions; Workload Identity or a dedicated least-privilege service account should be used.

Answer

Store sensitive configuration data in environment variables.

Answer

Skip liveness and readiness probes for stateless applications.

Answer

Use the default Compute Engine service account for pods.

Question 5

Your company is deploying a web application on Cloud Run using a continuous deployment pipeline from Cloud Build. The application is built as a Docker container and pushed to Container Registry. The Cloud Run service is configured with the '--no-allow-unauthenticated' flag. You have set up Cloud Build triggers to build and deploy on commits to the main branch. The deployment works correctly for the first few commits, but after adding a new environment variable in the Cloud Build configuration file (cloudbuild.yaml), the deployment fails with an error that the Cloud Run service cannot be updated because the new revision fails health checks. The application code has not changed. What is the most likely cause?

Accepted Answer

The new environment variable causes the application to fail its startup or health check.. The application code has not changed, yet the deployment fails health checks immediately after adding a new environment variable. This indicates that the application is likely reading that variable at startup and crashing or failing its readiness probe due to an invalid value, missing dependency, or misconfiguration. Cloud Run requires the new revision to pass health checks (e.g., HTTP GET on the configured port) before it can serve traffic; if the variable causes the app to exit or hang, the revision is considered unhealthy and the update is rejected.

Answer

The Cloud Build service account does not have permission to update the Cloud Run service.

Answer

The new environment variable exceeds the maximum size limit for environment variables in Cloud Run.

Answer

The health check configuration in the Cloud Run service was overwritten by the new deployment.

Question 6

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) in the correct order.

Accepted Answer

Create GKE cluster, authenticate kubectl with the cluster, apply Kubernetes manifest files, expose the application via Service or Ingress. Deploying to GKE requires creating a cluster, authenticating, then applying manifests and exposing the service.

Answer

Authenticate kubectl with the cluster, create GKE cluster, apply Kubernetes manifest files, expose the application via Service or Ingress

Answer

Create GKE cluster, apply Kubernetes manifest files, authenticate kubectl with the cluster, expose the application via Service or Ingress

Answer

Create GKE cluster, expose the application via Service or Ingress, authenticate kubectl with the cluster, apply Kubernetes manifest files

Question 7

Drag and drop the steps to set up a Firestore database in native mode in the correct order.

Accepted Answer

Enable Firestore API, then Create Firestore database in native mode, then Add data to the database. Firestore native mode is selected during database creation, then data can be added.

Answer

Create Firestore database in native mode, then Enable Firestore API, then Add data to the database

Answer

Enable Firestore API, then Add data to the database, then Create Firestore database in native mode

Answer

Create Firestore database in native mode, then Add data to the database, then Enable Firestore API

Question 8

A developer wants to deploy a containerized application to Google Kubernetes Engine (GKE) and ensure that new pods are automatically created if an existing pod fails. Which Kubernetes resource should be used?

Accepted Answer

Deployment. A Deployment is the correct Kubernetes resource for ensuring declarative updates and self-healing for stateless applications. It manages a ReplicaSet, which maintains the desired number of pod replicas; if a pod fails, the ReplicaSet controller automatically creates a replacement pod to match the desired state.

Answer

Job

Answer

DaemonSet

Answer

StatefulSet

Question 9

A company has a monolithic application that needs to be migrated to Cloud Run. The application currently writes logs to a local file. What is the best practice for handling logs in Cloud Run?

Accepted Answer

Write logs to stdout and stderr; Cloud Run automatically sends them to Cloud Logging.. Cloud Run is a serverless compute platform that automatically integrates with Cloud Logging. The best practice is to write logs to stdout and stderr because Cloud Run's runtime captures these streams and forwards them to Cloud Logging without any additional agents or sidecars. This approach aligns with the 12-factor app methodology and ensures logs are available for monitoring and troubleshooting.

Answer

Use a third-party logging agent installed in the container image.

Answer

Use a sidecar container to ship logs to Stackdriver.

Answer

Continue writing to a local file; Cloud Run will persist it.

Question 10

A developer is deploying an application on Compute Engine and needs to automatically apply security patches without downtime. The application runs behind a TCP load balancer. What is the best deployment strategy?

Accepted Answer

Use a rolling update on the instance group.. A rolling update on a managed instance group allows the developer to update instances incrementally, applying security patches without downtime. The TCP load balancer automatically distributes traffic only to healthy instances, so as each instance is updated and passes health checks, traffic is seamlessly redirected away from instances being patched.

Answer

Use a canary deployment with a separate instance group.

Answer

Stop all instances, apply patches, then restart them.

Answer

Use a managed instance group with autohealing.

Question 11

A team is deploying a microservice on Cloud Run that requires environment variables with sensitive information, such as database passwords. What is the recommended way to provide these secrets?

Accepted Answer

Use Secret Manager to store the secrets and refer to them in the Cloud Run service.. Secret Manager is Google Cloud's dedicated service for securely storing and managing sensitive data like API keys and database passwords. Cloud Run natively integrates with Secret Manager, allowing you to reference secret versions by name in your service configuration without exposing the secret value in plaintext. This approach ensures secrets are encrypted at rest and in transit, and access can be tightly controlled via IAM permissions.

Answer

Inject them directly in the Cloud Run YAML configuration.

Answer

Embed them in the container image as environment variables.

Answer

Store them in a Cloud Storage bucket and mount as a volume.

Question 12

A developer is troubleshooting a deployment on Cloud Run. The service fails with 'Container failed to start' error. The container image is built from a Dockerfile that uses CMD ['npm', 'start']. What is the most likely cause?

Accepted Answer

The application does not listen on the port specified by the PORT environment variable.. Cloud Run requires the containerized application to listen on the port specified by the PORT environment variable (default 8080). If the application is hardcoded to listen on a different port (e.g., 3000) or does not read the PORT variable, Cloud Run's health checks and routing will fail, resulting in a 'Container failed to start' error. The CMD instruction is correct for starting npm, but the application must bind to the correct port.

Answer

The Dockerfile uses CMD instead of ENTRYPOINT.

Answer

The container image is too large and exceeds the memory limit.

Answer

The Cloud Run service does not have permission to pull the image from Container Registry.

Question 13

An organization runs a stateful application on GKE that uses PersistentVolumes. They want to perform a rolling update of the application without disrupting the underlying persistent data. What should they use?

Accepted Answer

A StatefulSet with a PersistentVolumeClaim template.. A StatefulSet is the correct choice because it is designed for stateful applications that require stable, unique network identifiers and persistent storage. By including a PersistentVolumeClaim template in the StatefulSet spec, each Pod gets its own dedicated PersistentVolume that persists across rescheduling and rolling updates, ensuring data is not disrupted.

Answer

A ReplicaSet with a headless service.

Answer

A DaemonSet with a PodDisruptionBudget.

Answer

A Deployment with a PersistentVolumeClaim template.

Question 14

A developer wants to automatically deploy a new version of an application to App Engine Standard every time code is pushed to the main branch of a Cloud Source Repositories repository. Which service should be used?

Accepted Answer

Cloud Build. Cloud Build is the correct service because it is a fully managed CI/CD platform that integrates natively with Cloud Source Repositories and App Engine Standard. You can configure a Cloud Build trigger to automatically build and deploy your application whenever code is pushed to the main branch, using a cloudbuild.yaml file that specifies the build steps and the `gcloud app deploy` command.

Answer

Cloud Run

Answer

Cloud Scheduler

Answer

Cloud Deploy

Question 15

A company has a multi-region deployment on GKE and needs to route traffic to the closest regional cluster based on user location. They want to minimize latency. Which approach should they use?

Accepted Answer

Use a global external HTTP(S) Load Balancer with backend services pointing to NEGs in each region.. A global external HTTP(S) Load Balancer uses Anycast IP addresses and is backed by backend services that reference Network Endpoint Groups (NEGs) in each regional GKE cluster. This allows the load balancer to direct traffic to the closest healthy backend based on the user's geographic location and the load balancer's proximity algorithm, minimizing latency without requiring DNS-based routing.

Answer

Create separate internal load balancers in each region and use Cloud DNS geo-routing.

Answer

Configure an external TCP/UDP Network Load Balancer in each region and use Cloud DNS geo-routing.

Answer

Deploy a single regional cluster and use Cloud CDN to cache content globally.