PCD Deploying applications Practice Test 7 — 15 Questions

Question 1

A developer is deploying a microservice on GKE that needs to be accessible only from within the same VPC network. The microservice must have a stable, internal IP address that does not change when pods are updated. Which options should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Service of type LoadBalancer with the annotation 'cloud.google.com/load-balancer-type: Internal'.. Deploying a Service of type LoadBalancer with the annotation 'cloud.google.com/load-balancer-type: Internal' creates an internal TCP/UDP load balancer within the VPC network. This provides a stable, internal IP address that persists across pod updates, as the load balancer's IP is independent of the underlying pods and is managed by Google Cloud's networking layer.

Answer

Use a Service of type NodePort with a static reservation.

Answer

Use a Service of type ClusterIP with a static IP.

Answer

Use a Service of type ExternalName pointing to the pods' internal IPs.

Question 2

Which TWO strategies can be used to reduce cold start latency in Cloud Run? (Choose 2)

Accepted Answer

Set a minimum number of instances (min-instances) to keep instances warm.. Setting a minimum number of instances (min-instances) ensures that a specified number of container instances are always running and ready to serve requests, eliminating the cold start latency that occurs when an instance must be started from scratch. This pre-warming strategy directly reduces the time users wait for the first request to be processed.

Answer

Increase the maximum number of concurrent requests per instance.

Answer

Deploy the Cloud Run service in a region closer to the users.

Answer

Use a VPC connector to access resources in a VPC network.

Question 3

Which TWO statements about Cloud Run for Anthos are correct? (Choose 2)

Accepted Answer

Cloud Run for Anthos allows users to autoscale their containerized applications without worrying about underlying GKE nodes.. Cloud Run for Anthos leverages the Knative Serving autoscaler to automatically scale container instances up or down based on incoming request traffic, including scaling to zero when idle. This autoscaling operates at the pod level within the GKE cluster, abstracting away the underlying node management from the user.

Answer

Cloud Run for Anthos is a multi-region service by default.

Answer

Cloud Run for Anthos supports only HTTP requests, not gRPC.

Answer

Cloud Run for Anthos requires you to bring your own load balancer.

Question 4

A developer runs the command above. What is the effect of the --promote flag in this deployment?

Accepted Answer

It causes the new version (v2) to receive 100% of traffic after deployment.. The --promote flag in a Google Cloud App Engine deployment command (gcloud app deploy --promote) causes the newly deployed version (v2) to immediately receive 100% of traffic, effectively making it the default serving version. This is the standard behavior unless the --no-promote flag is explicitly used to keep traffic on the previous version.

Answer

It creates a new default service version with split traffic.

Answer

It promotes the previous version to receive traffic.

Answer

It enables automatic scaling for the new version.

Question 5

You are deploying a stateful application to GKE. The deployment fails with an error: 'pods failed to fit in any node due to insufficient CPU'. The cluster has 3 nodes with 4 vCPUs each. The deployment requests 2 vCPUs per pod with 5 replicas. What is the most likely issue?

Accepted Answer

Other workloads or system components are consuming CPU resources.. The cluster has 3 nodes with 4 vCPUs each, totaling 12 vCPUs. The deployment requests 2 vCPUs per pod with 5 replicas, totaling 10 vCPUs. While 10 vCPUs is less than 12, Kubernetes reserves some CPU for system components (kubelet, kube-proxy, etc.) and other workloads may already be running. The error 'insufficient CPU' indicates that no single node has enough allocatable CPU to fit a pod, likely because other workloads or system components are consuming CPU, leaving less than 2 vCPUs available on each node. Thus, the most likely issue is that other workloads or system components are consuming CPU resources.

Answer

The cluster autoscaler is not enabled.

Answer

The deployment does not specify resource limits.

Answer

The nodes have taints that prevent pod scheduling.

Question 6

You need to deploy a critical update to a production service on GKE with zero downtime. Which deployment strategy should you use?

Accepted Answer

Blue/green deployment using a Kubernetes Service and label selector. Blue/green deployment creates two identical environments (blue and green) and switches traffic atomically by updating the Kubernetes Service's label selector to point to the new version. This ensures zero downtime because the old version remains fully serving until the new version is verified, and traffic cutover is instantaneous with no overlapping broken requests.

Answer

Recreate strategy

Answer

Canary deployment with 10% traffic

Answer

Rolling update with maxSurge=25%, maxUnavailable=25%

Question 7

You are deploying a Cassandra database on GKE. Which resource type should you use to ensure stable network identities and persistent storage per pod?

Accepted Answer

StatefulSet with volumeClaimTemplates. StatefulSet is the correct resource because it provides stable, unique network identities (via headless Service and ordinal pod names) and persistent storage per pod through volumeClaimTemplates, which dynamically create PersistentVolumeClaims for each replica. This is essential for Cassandra, which requires stable node identities and dedicated storage to maintain cluster state and data consistency.

Answer

Job with persistent disk

Answer

Deployment with persistent volume claims

Answer

DaemonSet with hostPath volumes

Question 8

A developer needs to deploy a Cloud Run service from a container image in Artifact Registry. What IAM role should be granted to the Cloud Run service account?

Accepted Answer

roles/artifactregistry.reader. The Cloud Run service account needs permission to read the container image from Artifact Registry during deployment. The `roles/artifactregistry.reader` role grants the `artifactregistry.repositories.downloadArtifacts` permission, which is required to pull the image. Without this role, the deployment fails with an access denied error.

Answer

roles/storage.objectViewer

Answer

roles/cloudbuild.builds.builder

Answer

roles/run.invoker

Question 9

You are deploying a Python Cloud Function using the Google Cloud CLI. The deployment fails with 'ERROR: (gcloud.functions.deploy) ResponseError: status=[404], code=[OK], message=[The function ... does not exist]' but the function already exists. What is the most likely cause?

Accepted Answer

The gcloud config's region does not match the region where the function was deployed.. The 404 error indicates the deployment command cannot locate the function in the specified region. When you deploy a Cloud Function using the gcloud CLI, the command uses the default region set in your gcloud configuration (or the --region flag). If the function was originally deployed in a different region, the CLI will look for it in the wrong region and fail with a 404, even though the function exists elsewhere. This is the most common cause of this specific error message.

Answer

The function was already deployed with the same name, causing a conflict.

Answer

The Python runtime version is not supported in that region.

Answer

The Cloud Functions API is not enabled.

Question 10

Which TWO security best practices should be implemented when using Cloud Build to deploy applications? (Choose 2.)

Accepted Answer

Use Cloud KMS to encrypt sensitive environment variables.. Cloud Build does not automatically encrypt environment variables stored in build config files or the console. Using Cloud KMS allows you to encrypt sensitive data like API keys or passwords, then decrypt them at build time via the `gcloud kms decrypt` step, ensuring secrets are never stored in plaintext.

Answer

Add SSH keys to Cloud Build for private Git repos.

Answer

Use container image tags instead of digests in build configs.

Answer

Store secrets in Cloud Build's default substitution variables.

Question 11

Which THREE common issues cause deployment failures on App Engine? (Choose 3.)

Accepted Answer

Using a runtime version that is not available in the app's region.. App Engine requires that the runtime version specified in your app.yaml is available in the region where the application is deployed. If you select a runtime version that has been deprecated or is not yet rolled out to that region, the deployment will fail with an error indicating the runtime is unavailable. This is a common issue when using newer runtime versions that are only available in certain regions.

Answer

Setting the app to scale to 0 instances.

Answer

Creating a resource with backend type set to 'backend' instead of 'frontend'.

Question 12

Which TWO features are provided by Google Cloud Deploy? (Choose 2.)

Accepted Answer

Rollback to a previous deployment revision.. Google Cloud Deploy is a managed continuous delivery service that automates the rollout of applications to Google Kubernetes Engine (GKE) or GKE Enterprise clusters. It supports rollback to a previous deployment revision (A) by reverting the target cluster to the last known good state, and it provides automated canary analysis (C) by integrating with Cloud Monitoring to verify deployment health metrics before progressing traffic shifts.

Answer

Run containers without managing infrastructure.

Answer

Build container images from source code.

Answer

Manage Kubernetes clusters across multi-cloud environments.

Question 13

A developer deploys a containerized application on Cloud Run. The application needs to access a Cloud SQL instance securely without exposing it to the internet. What is the best practice?

Accepted Answer

Use Cloud Run's VPC connector and configure private IP for Cloud SQL.. Cloud Run services cannot directly connect to Cloud SQL using private IP without a VPC connector. The VPC connector allows Cloud Run to send traffic to a VPC network, where the Cloud SQL instance with a private IP resides, ensuring traffic never traverses the public internet. This is the recommended pattern for secure, low-latency access to Cloud SQL from serverless environments.

Answer

Whitelist the Cloud Run IP range in Cloud SQL authorized networks.

Answer

Use a Cloud SQL proxy sidecar container in the same pod.

Answer

Use Cloud NAT to route traffic.

Question 14

A developer wants to deploy a Cloud Function that connects to a Cloud SQL database. What is the simplest way to securely inject database credentials?

Accepted Answer

Use Secret Manager to store and access the database password.. Secret Manager provides a secure, centralized service for storing sensitive data like database passwords, and the Cloud Function can access the secret at runtime via the Secret Manager API or by mounting it as a volume. This avoids hardcoding credentials in code or environment variables, which can be exposed in logs or source control. It is the simplest and most secure approach recommended by Google Cloud for injecting database credentials into Cloud Functions.

Answer

Store credentials in the Cloud Function code as environment variables.

Answer

Use Cloud Key Management Service to encrypt credentials and pass them via HTTP headers.

Answer

Embed credentials in the database connection string in the source code.

Question 15

A company uses Cloud Build for CI/CD. They need to deploy a containerized app to Cloud Run automatically on every push to the main branch. Which Cloud Build configuration step is necessary?

Accepted Answer

Add a step to run 'gcloud run deploy' command.. Cloud Build requires an explicit step to run the `gcloud run deploy` command in order to trigger a deployment to Cloud Run. While Cloud Build can build and push images, it does not automatically deploy to Cloud Run unless a deploy step is included in the build configuration. This step uses the built image (from Artifact Registry) and deploys it as a new revision to the specified Cloud Run service.

Answer

Add a step to build the container with Dockerfile.

Answer

Add a step to push the image to Artifact Registry only.

Answer

Add a step to run unit tests.