PCD Deploying applications Practice Test 8 — 15 Questions

Question 1

An organization deploys a critical application on GKE with multiple namespaces. They want to enforce that only certain images from approved Artifact Registry repositories can be deployed in the production namespace. Which GKE feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Binary Authorization. Binary Authorization is the correct GKE feature because it enforces deployment-time policy controls that require container images to be signed by trusted authorities and originate from approved Artifact Registry repositories. By configuring an admission webhook with Binary Authorization, the organization can create an attestation policy that blocks any pod in the production namespace from running unless its image has a valid cryptographic signature from a trusted signer and the image path matches an allowed Artifact Registry host.

Answer

Network Policies

Answer

Workload Identity

Answer

Pod Security Policies (deprecated)

Question 2

A startup wants to deploy a web application on App Engine standard environment. They need to handle sudden traffic spikes automatically. How should they configure scaling?

Accepted Answer

Use automatic scaling.. Automatic scaling is the correct choice because App Engine standard environment natively supports automatic scaling, which dynamically adds or removes instances based on request rate, latency, and other metrics. This allows the application to handle sudden traffic spikes without manual intervention, as the platform automatically provisions resources to meet demand.

Answer

Use basic scaling with idle timeout.

Answer

Use manual scaling with a fixed number of instances.

Answer

Use a combination of manual and automatic scaling.

Question 3

A company is deploying a multi-region application on Cloud Run to serve global users. They want low latency and automatic failover. Which approach is best?

Accepted Answer

Deploy to multiple Cloud Run regions behind an external HTTP(S) Load Balancer with global backend.. Deploying Cloud Run services across multiple regions behind an external HTTP(S) Load Balancer with a global backend provides both low latency (via Google's global anycast IP and nearest-region routing) and automatic failover (the load balancer health checks automatically route traffic away from unhealthy backends). This architecture uses the load balancer's global external backend service to direct requests to the closest healthy Cloud Run service, ensuring high availability and performance for global users.

Answer

Deploy to multiple regions and use DNS round-robin.

Answer

Use Cloud Run for Anthos on-premises.

Answer

Deploy to a single region and use Cloud CDN.

Question 4

A company wants to automate the deployment of a microservice application to Cloud Run using Cloud Build. They want to ensure zero-downtime deployments and traffic migration. Which three features should they utilize? (Choose three.)

Accepted Answer

Cloud Build triggers to build and deploy on code changes.. Cloud Build triggers can be configured to automatically build and deploy a microservice to Cloud Run whenever code changes are pushed to a repository. This enables continuous delivery and ensures that the latest code is deployed without manual intervention, supporting zero-downtime deployments when combined with traffic management features.

Answer

Cloud Run min and max instance settings.

Answer

Cloud Run managed continuous deployment from a repository.

Question 5

After updating the image to v2, users report that the frontend application returns errors because it cannot reach the backend service. The backend service is running on GKE with the name 'backend-service' in the same namespace. What is the most likely cause?

Accepted Answer

The application expects the backend URL from an environment variable named BACKEND_SERVICE_URL, but the deployment sets BACKEND_URL.. The most likely cause is that the frontend application expects the backend URL from an environment variable named `BACKEND_SERVICE_URL`, but the deployment sets `BACKEND_URL`. This mismatch means the frontend cannot resolve the backend endpoint, leading to connection errors. In Kubernetes, environment variables are commonly used to pass service discovery information, and a naming mismatch directly breaks the application's ability to reach the backend.

Answer

The selector labels do not match the pods.

Answer

The backend service is not listening on port 8080.

Answer

The termination grace period is too short causing connection drops.

Question 6

During a rolling update, the new pods are failing to start because they require more memory than available on nodes. What is the most likely cause?

Accepted Answer

The resource requests and limits are misconfigured.. The most likely cause of pods failing to start due to insufficient memory is misconfigured resource requests and limits. If the memory request (spec.containers[].resources.requests.memory) is set too high, the scheduler cannot find a node with enough allocatable memory, leaving pods in a Pending state. Similarly, if the limit is set too low, the pod may be OOMKilled after starting, but the question specifically states 'failing to start,' pointing to a scheduling failure due to requests exceeding node capacity.

Answer

The maxSurge value is too low.

Answer

The replicas count is too high.

Answer

The strategy type is wrong.

Question 7

A team uses Cloud Build to automatically deploy a Cloud Function on push to a repository. The build fails intermittently with 'PERMISSION_DENIED' when executing gcloud functions deploy. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the necessary IAM permissions on the Cloud Functions API.. The intermittent 'PERMISSION_DENIED' error when Cloud Build runs `gcloud functions deploy` indicates that the Cloud Build service account does not have the required IAM roles (e.g., Cloud Functions Developer or Cloud Functions Admin) on the Cloud Functions API. Cloud Build uses its default compute engine service account (or a user-specified service account) to execute build steps; if this account lacks the `cloudfunctions.functions.create` or `cloudfunctions.functions.update` permission, the deployment will fail, and the intermittent nature may be due to eventual consistency or race conditions in IAM propagation.

Answer

The region specified in the build configuration does not match the function's region.

Answer

The build configuration file has a syntax error.

Answer

The Cloud Source Repository does not have the correct triggers.

Question 8

A developer wants to deploy a Compute Engine instance using Terraform. They want to run a startup script to install software. How should they provide the script?

Accepted Answer

Use the metadata block with key 'startup-script' and the script content as value.. Terraform's `google_compute_instance` resource supports a `metadata` block where you can set the key `startup-script` with the script content as the value. When the Compute Engine instance boots, the `google-guest-agent` reads this metadata key and executes the script as the root user, which is the standard method for running startup scripts on Linux instances without additional configuration.

Answer

Use a cloud-init configuration file passed via user-data metadata.

Answer

Use the user-data metadata key with the script content.

Answer

Use the gcloud compute instances create command with --metadata-from-file flag.

Question 9

A team deploys a microservices architecture on GKE with Istio service mesh. They want to enforce mutual TLS (mTLS) between services. After enabling Istio with the default configuration, some services report connection errors. What is the most likely cause?

Accepted Answer

Some services do not have Istio sidecar injected, so strict mTLS fails.. Istio's default configuration enables 'STRICT' mTLS mode, which requires all services to have an Envoy sidecar proxy injected to handle TLS handshakes. If any service lacks the sidecar, it cannot participate in mTLS, causing connection errors when other services attempt to communicate with it using TLS. The error typically manifests as 'upstream connect error' or 'TLS handshake failure' in the sidecar logs.

Answer

The services need a ServiceEntry to communicate with each other.

Answer

The namespace is not labeled with istio-injection=enabled.

Answer

The services are using a different service mesh protocol.

Question 10

A team wants to deploy infrastructure as code on Google Cloud. They need a declarative language that supports modularity and state management. Which tool should they choose?

Accepted Answer

Terraform.. Terraform is the correct choice because it is a declarative infrastructure-as-code tool that supports modularity through reusable modules and state management via state files (local or remote backends like Cloud Storage). It allows teams to define Google Cloud resources in HashiCorp Configuration Language (HCL) and track resource changes over time, enabling safe, incremental updates.

Answer

Cloud Deployment Manager.

Answer

Cloud Shell.

Answer

gcloud commands.

Question 11

Which TWO best practices should be followed when deploying a containerized application to Cloud Run for production?

Accepted Answer

Use a minimal base image with only necessary dependencies.. Using a minimal base image (e.g., distroless or Alpine-based) reduces the attack surface, decreases image size, and speeds up cold starts. Cloud Run pulls the container image for each new instance, so a smaller image directly reduces startup latency and improves scaling responsiveness. This aligns with Google's best practices for production deployments on Cloud Run.

Answer

Set min-instances to 0 to save costs when idle.

Answer

Set max-instances to unlimited to handle traffic spikes.

Answer

Always use the latest public image from Docker Hub for dependencies.

Question 12

Which TWO Google Cloud services are suitable for deploying serverless applications that scale automatically based on demand?

Accepted Answer

Cloud Functions.. Cloud Functions (option C) is a serverless execution environment that automatically scales instances from zero to thousands in response to event triggers, such as HTTP requests or Cloud Pub/Sub messages, without requiring any infrastructure management. Cloud Run (option E) is a managed compute platform that runs stateless containers in a fully serverless manner, scaling each revision automatically based on incoming request concurrency (up to 80 concurrent requests per container instance by default). Both services abstract away underlying servers and scale to zero when idle, making them ideal for serverless applications.

Answer

Cloud Storage.

Answer

Google Kubernetes Engine.

Answer

Compute Engine with managed instance groups.

Question 13

You are deploying a Node.js application on Cloud Run. The container image is stored in Artifact Registry. After deploying with gcloud run deploy, the revision fails with 'Container failed to start. Failed to start and then listen on the port defined by the PORT environment variable.' The application listens on port 8080 by default. The Dockerfile uses EXPOSE 8080. The Cloud Run service is configured with container port 8080. You have verified that the container starts locally using docker run -p 8080:8080. What is the most likely cause of the startup failure?

Accepted Answer

The application is hardcoded to listen on port 8080 but the Cloud Run environment variable PORT may override it to a different value.. Cloud Run injects a PORT environment variable that the container must listen on; the application is hardcoded to 8080, so if Cloud Run sets PORT to a different value (e.g., 8081), the app listens on the wrong port and fails the health check. The error message explicitly references the PORT environment variable, indicating the app ignored it. Since the container works locally with port 8080, the issue is the mismatch between the hardcoded port and the dynamically assigned PORT.

Answer

The application is trying to bind to a privileged port.

Answer

The Cloud Run service is configured with container port 443 by default.

Answer

The container does not have a proper HEALTHCHECK instruction.

Question 14

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The deployment uses a Service of type LoadBalancer. After creating the Service, the external IP remains pending for several minutes. The team has verified that the cluster has sufficient node capacity and that the pod is running. What is the most likely cause?

Accepted Answer

The project's quota for external IP addresses has been exhausted.. When a Service of type LoadBalancer is created in GKE, it provisions an external IP address from the project's quota. If the quota for external IP addresses is exhausted, the IP assignment remains pending until additional quota is requested or released. The cluster having sufficient node capacity and the pod running confirms that the issue is not resource-related but rather a cloud-level quota limitation.

Answer

The Service is using an incorrect port mapping.

Answer

The pod's readiness probe is failing.

Answer

The cluster is using a regional cluster type.

Question 15

A company deploys a containerized application to Cloud Run using Cloud Build. They want to implement a rolling update strategy with zero downtime. Which two actions should they take? (Choose two.)

Accepted Answer

Gradually shift traffic to the new revision using the gcloud run services update-traffic command.. The `gcloud run services update-traffic` command allows you to gradually shift traffic from the current revision to a new revision, enabling a rolling update with zero downtime. This command supports percentage-based traffic splitting, which ensures that the new revision is incrementally exposed to users while the old revision remains active, thus maintaining service availability throughout the deployment.

Answer

Create a new Cloud Run service for the new revision.

Answer

Set the min-instances attribute to 1 to keep at least one instance running.

Answer

Use the gcloud run deploy command with the --concurrency flag.