PCD Deploying applications Practice Test 6 — 15 Questions

Question 1

Which TWO best practices should be followed when deploying a containerized application to Cloud Run for production?

Accepted Answer

Use a minimal base image with only necessary dependencies.. Using a minimal base image (e.g., distroless or Alpine-based) reduces the attack surface, decreases image size, and speeds up cold starts. Cloud Run pulls the container image for each new instance, so a smaller image directly reduces startup latency and improves scaling responsiveness. This aligns with Google's best practices for production deployments on Cloud Run.

Answer

Set min-instances to 0 to save costs when idle.

Answer

Set max-instances to unlimited to handle traffic spikes.

Answer

Always use the latest public image from Docker Hub for dependencies.

Question 2

Which THREE methods are valid ways to deploy a containerized application to Google Kubernetes Engine (GKE)?

Accepted Answer

Use Helm to install a chart.. Helm is a package manager for Kubernetes that simplifies deploying containerized applications by using pre-configured charts. A Helm chart packages all the necessary Kubernetes resource definitions (e.g., Deployments, Services) into a single deployable unit, and running `helm install` on a GKE cluster will deploy the application correctly.

Answer

Use gcloud container clusters create to deploy the application.

Answer

Upload the container image to Cloud Storage and use a trigger to deploy.

Question 3

Which TWO Google Cloud services are suitable for deploying serverless applications that scale automatically based on demand?

Accepted Answer

Cloud Functions.. Cloud Functions (option C) is a serverless execution environment that automatically scales instances from zero to thousands in response to event triggers, such as HTTP requests or Cloud Pub/Sub messages, without requiring any infrastructure management. Cloud Run (option E) is a managed compute platform that runs stateless containers in a fully serverless manner, scaling each revision automatically based on incoming request concurrency (up to 80 concurrent requests per container instance by default). Both services abstract away underlying servers and scale to zero when idle, making them ideal for serverless applications.

Answer

Cloud Storage.

Answer

Google Kubernetes Engine.

Answer

Compute Engine with managed instance groups.

Question 4

Your company runs a multi-tier application on GKE. The frontend is a Deployment with 5 replicas, backend is a StatefulSet with 3 replicas, and a database runs on Cloud SQL. Recently, after a cluster upgrade, the frontend pods are failing with 'Connection refused' errors when trying to reach the backend service. The backend pods are running and healthy. You have verified that the Service and Endpoints objects exist. The backend service is of type ClusterIP on port 8080, and the frontend uses the service name 'backend-svc'. The frontend pods are in a different namespace 'frontend-ns', while the backend is in 'backend-ns'. What is the most likely cause of the error?

Accepted Answer

The frontend pods are not using the correct DNS name that includes the namespace.. When a frontend pod in namespace 'frontend-ns' uses the service name 'backend-svc' to reach a backend service in namespace 'backend-ns', the DNS resolution will only work if the fully qualified domain name (FQDN) is used: 'backend-svc.backend-ns.svc.cluster.local'. Without the namespace qualifier, the DNS query resolves to a non-existent service in the same namespace, causing 'Connection refused'. Option A is incorrect because ClusterIP services are accessible cluster-wide provided the correct DNS name is used; an Ingress is not required. Option B is incorrect because we verified that Endpoints exist for the backend service, indicating the StatefulSet pods are correctly selected. Option C is incorrect because a NetworkPolicy blocking traffic would typically result in a timeout or no route, not an immediate 'Connection refused'; the error here is due to DNS resolution to a nonexistent endpoint.

Answer

The backend Service is not exposed via an Ingress, so it is not reachable from other namespaces.

Answer

The StatefulSet pods are not part of the backend Service's selector.

Answer

A NetworkPolicy is blocking traffic between the namespaces.

Question 5

You are deploying a Node.js application on Cloud Run. The container image is stored in Artifact Registry. After deploying with gcloud run deploy, the revision fails with 'Container failed to start. Failed to start and then listen on the port defined by the PORT environment variable.' The application listens on port 8080 by default. The Dockerfile uses EXPOSE 8080. The Cloud Run service is configured with container port 8080. You have verified that the container starts locally using docker run -p 8080:8080. What is the most likely cause of the startup failure?

Accepted Answer

The application is hardcoded to listen on port 8080 but the Cloud Run environment variable PORT may override it to a different value.. Cloud Run sets the PORT environment variable to 8080 by default, but if the application is hardcoded to listen on 8080 instead of reading PORT, it may fail if the variable is not set or incorrect. Option B is wrong because the DEFAULT port variable is not used. Option C is wrong because the container port is set correctly. Option D is wrong because port 8080 is not privileged.

Answer

The application is trying to bind to a privileged port.

Answer

The Cloud Run service is configured with container port 443 by default.

Answer

The container does not have a proper HEALTHCHECK instruction.

Question 6

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The deployment uses a Service of type LoadBalancer. After creating the Service, the external IP remains pending for several minutes. The team has verified that the cluster has sufficient node capacity and that the pod is running. What is the most likely cause?

Accepted Answer

The project's quota for external IP addresses has been exhausted.. When a Service of type LoadBalancer is created in GKE, it provisions an external IP address from the project's quota. If the quota for external IP addresses is exhausted, the IP assignment remains pending until additional quota is requested or released. The cluster having sufficient node capacity and the pod running confirms that the issue is not resource-related but rather a cloud-level quota limitation.

Answer

The Service is using an incorrect port mapping.

Answer

The pod's readiness probe is failing.

Answer

The cluster is using a regional cluster type.

Question 7

A developer is deploying a Python web application to App Engine Flexible Environment. The application requires a specific third-party binary that is not pre-installed on the runtime image. Which two steps should the developer take to ensure the binary is available? (Choose two.)

Accepted Answer

Use a startup script in the app.yaml to install the binary.. App Engine Flexible Environment supports a `startup_script` field in `app.yaml` that runs shell commands during instance initialization, allowing installation of third-party binaries. Option E is correct because using a custom runtime with a Dockerfile gives full control over the base image and dependencies, enabling the developer to install any required binary via `RUN` commands.

Answer

Configure a VM-level startup script in the Google Cloud Console.

Answer

Specify the binary as a dependency in the requirements.txt file.

Answer

Include the binary in the application's Git repository and reference it in the app.yaml.

Question 8

A company is deploying a microservices architecture on Google Cloud using Cloud Run. They need to ensure that services can communicate securely with each other and with other Google Cloud services, such as Cloud Storage and Secret Manager. Which three steps should they take? (Choose three.)

Accepted Answer

Use Cloud Run's direct VPC egress to access resources in a VPC network.. To securely communicate with other Google Cloud services like Cloud Storage and Secret Manager, Cloud Run services can use direct VPC egress to route traffic through your VPC. Additionally, to access resources in a VPC, you can use a VPC connector. Using service accounts with least privilege ensures secure access control. These three steps together provide secure communication.

Answer

Enable Cloud Service Mesh for sidecar proxy injection.

Answer

Configure Cloud Run services to use internal load balancing.

Question 9

A company is deploying a static website on Cloud Storage with a custom domain. They want to serve the website over HTTPS. They have created a bucket with the same name as the domain and uploaded the files. They have verified the domain ownership in Search Console and added the bucket as a CNAME record in their DNS. Users report that when they navigate to the domain, they get a 404 error. The company has verified that the bucket's main page suffix is set to index.html. The team is confident the files are uploaded correctly. They need to resolve the 404 error and serve the site over HTTPS. What should they do?

Accepted Answer

Create a Cloud Load Balancer with the bucket as backend and update DNS.. To serve a static website hosted on Cloud Storage with a custom domain over HTTPS, you must configure an external HTTP(S) load balancer with the bucket as the backend. The load balancer handles SSL termination and provides a static IP address or hostname. You then update your DNS to point the custom domain to the load balancer's IP (using an A record) or to the load balancer's hostname. Option B is incorrect because a DNS A record pointing directly to a load balancer IP still requires the load balancer; the CNAME is not the issue. Option C is incorrect because Cloud CDN alone does not enable HTTPS for a custom domain; it requires a load balancer or other origin. Option D is incorrect because making objects publicly readable does not provide HTTPS support; the bucket's static website feature only supports HTTP.

Answer

Add a DNS A record pointing to the load balancer IP instead of a CNAME.

Answer

Enable Cloud CDN on the bucket.

Answer

Set the bucket's default object ACL to public read.

Question 10

A team is deploying a containerized application to Google Kubernetes Engine using a Deployment and a Service of type LoadBalancer. The application is a web server that should be accessible on port 80. After deployment, the external IP is assigned, but when they try to access http://<EXTERNAL_IP>:80, they get a connection timeout. The pods are running, and the logs show the web server is listening on port 8080. The team has verified that the cluster firewall rules allow traffic on port 80. They have also confirmed that the pods are healthy and no network policies are in place. What is the most likely cause?

Accepted Answer

The Deployment's containerPort is set to 8080, but the Service's port is set to 80 and targetPort is not specified.. If the Service's targetPort is not specified, it defaults to the same value as the port (80). However, the container is listening on port 8080, so traffic forwarded to port 80 on the pod results in a connection timeout. Option A is incorrect because the team verified that no network policies are in place, and firewall rules allow traffic on port 80. Option C is incorrect because externalTrafficPolicy: Local affects client IP preservation, not basic connectivity. Option D is incorrect because the team did not explicitly set targetPort; it defaults to 80. If it were set to 80, that would also cause the timeout, but the issue is the default behavior.

Answer

The cluster has a network policy that blocks incoming traffic.

Answer

The Service is missing the externalTrafficPolicy: Local setting.

Answer

The Service's targetPort is set to 80 instead of 8080.

Question 11

A company is migrating a legacy Java application to Cloud Run. The application requires a specific Java version (Java 11) and writes temporary files to disk. The application also uses a proprietary library that is not available in public repositories. The team has created a Dockerfile that installs Java 11, copies the JAR file, and sets the entrypoint. They are using Cloud Build to build the container and deploying to Cloud Run. The deployment succeeds, but when they send requests, the application fails with a "Permission denied" error when trying to write to /tmp. The team has verified that the Cloud Run service has the correct permissions via a service account. They have also checked that the filesystem is writable at /tmp by default. What is the most likely cause of the error?

Accepted Answer

Change the base image to one that includes Java 11 and ensures the /tmp directory is writable.. The most common cause of write permission errors in Cloud Run is using a base image that does not have a writable /tmp directory or has the wrong filesystem permissions. Official base images like gcr.io/distroless/java or OpenJDK images are configured with a writable /tmp. Option A is incorrect because running chmod inside the Dockerfile may not fix the underlying issue if the filesystem is read-only or if the user doesn't have sufficient privileges; plus, Cloud Run may enforce security policies that prevent such operations. Option B is incorrect because memory limits do not affect filesystem write permissions; they relate to memory allocation. Option D is incorrect because Cloud Storage FUSE is an overcomplication; the issue is simply the base image's /tmp configuration.

Answer

Add a RUN chmod 777 /tmp command in the Dockerfile before the entrypoint.

Answer

Increase the memory limit of the Cloud Run service.

Answer

Use a Cloud Storage FUSE mount for temporary storage.

Question 12

A startup is deploying a Node.js application on App Engine Standard Environment. They have configured the application in app.yaml with runtime: nodejs16. After deploying with gcloud app deploy, the deployment succeeds, but when they access the application, they get a 502 Bad Gateway error. They check the logs and see "Failed to start container" and "Error: Cannot find module 'express'". The application uses Express. The team has confirmed that the package.json file includes express as a dependency. What is the most likely cause?

Accepted Answer

The node_modules folder was not uploaded because it is in the .gcloudignore file.. The error 'Cannot find module express' indicates that the Express module is not available to the application. In App Engine Standard Environment, dependencies are automatically installed based on package.json during deployment. However, if the node_modules folder is present in the project directory and is excluded via .gcloudignore, the automatic installation may be skipped or overridden, leading to missing modules. The most likely cause is that node_modules is listed in .gcloudignore, so it wasn't uploaded and the automatic install didn't run correctly. Option B correctly identifies this issue.

Answer

The application is running on a different port than the one specified in the environment variable PORT.

Answer

The package.json file is missing the express dependency.

Answer

The request exceeds the 60-second timeout.

Question 13

A company is deploying a batch job that runs once a day on Compute Engine. They are using a startup script to install dependencies and run the job. The job writes output to Cloud Storage. Recently, the job started failing intermittently with "No space left on device" errors, even though the persistent disk has 100 GB free. The team has verified that the disk is not fragmented and that the inode usage is low. The job processes large files and creates many temporary files in /tmp. They suspect the /tmp directory is filling up. What is the most likely cause?

Accepted Answer

The /tmp partition is using a small temporary disk that is separate from the persistent disk.. On many Compute Engine images, /tmp is mounted as a tmpfs (in-memory filesystem) which has a limited size, often a fraction of the instance's memory. When the job creates many temporary files, it can fill the tmpfs, causing "No space left on device" even though the persistent disk has ample free space. Option B is incorrect because while cleanup would help, the root cause is limited space in /tmp. Option C is incorrect because insufficient RAM would cause swapping, not a filesystem full error. Option D is incorrect because Cloud Storage quota would produce errors when writing to the bucket, not on the local filesystem.

Answer

The instance's RAM is insufficient, causing swap to fill the disk.

Answer

The startup script is not cleaning up temporary files.

Answer

The Cloud Storage bucket quota is exceeded.

Question 14

A company deploys a containerized application to Cloud Run using Cloud Build. They want to implement a rolling update strategy with zero downtime. Which two actions should they take? (Choose two.)

Accepted Answer

Gradually shift traffic to the new revision using the gcloud run services update-traffic command.. The `gcloud run services update-traffic` command allows you to gradually shift traffic from the current revision to a new revision, enabling a rolling update with zero downtime. This command supports percentage-based traffic splitting, which ensures that the new revision is incrementally exposed to users while the old revision remains active, thus maintaining service availability throughout the deployment.

Answer

Create a new Cloud Run service for the new revision.

Answer

Set the min-instances attribute to 1 to keep at least one instance running.

Answer

Use the gcloud run deploy command with the --concurrency flag.

Question 15

Refer to the exhibit. A Cloud Build pipeline that deploys a Cloud Run service fails with the above error. The Cloud Build service account has the roles/run.admin role at the project level. What is the most likely cause?

Accepted Answer

The Cloud Run API is not enabled in the project.. The error message indicates that Cloud Run is not available, which typically occurs when the Cloud Run API has not been enabled in the project. Without the API enabled, any attempt to deploy a Cloud Run service via Cloud Build will fail, regardless of the service account's IAM roles. Enabling the API is a prerequisite for using Cloud Run resources.

Answer

The service account used by Cloud Build does not have the Cloud Run Invoker role.

Answer

The Cloud Run service was deleted manually before the pipeline ran.

Answer

The region specified in the deploy step does not have Cloud Run enabled.