PCD Deploying applications Practice Test 9 — 15 Questions

Question 1

Your team maintains a Cloud Run service that receives bursty traffic. You have deployed the service with `--min-instances=0` and `--max-instances=100`. During a sudden spike, users experience cold-start latency of several seconds. You want to reduce cold-start latency without changing the application code or over-provisioning. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set `--min-instances=1` so that at least one instance is always warm.. Cold starts occur when Cloud Run creates a new instance to handle a request after scaling to zero. Keeping at least one instance warm with a minimum instance setting ensures that requests are served by an already running container, removing the startup delay. Increasing maximum instances or adjusting concurrency does not prevent the first request from hitting a cold instance.

Answer

Deploy the service with `--cpu-boost` enabled.

Answer

Set `--concurrency=1` to ensure each instance handles only one request at a time.

Answer

Increase `--max-instances` to 200 to allow more concurrent instances.

Question 2

Your team maintains a Java service on App Engine standard. A new library requires a native binary that the standard runtime does not include, and you must keep using app.yaml for configuration. You need the smallest deployment change that lets the native binary run. What should you do?

Accepted Answer

Deploy the service to App Engine flexible environment with a custom runtime and a Dockerfile that installs the native binary.. The native binary needs an environment where you control the OS packages and can install shared libraries. App Engine flexible environment with a custom runtime provides that control through a Dockerfile while preserving app.yaml-based configuration. The other approaches assume the standard sandbox can host arbitrary native code, which it cannot, so they fail to satisfy the dependency.

Answer

Add the native binary as a static file in the app directory and reference it from app.yaml using the handlers section.

Answer

Package the native binary inside a JAR and load it at runtime using System.loadLibrary from a Java servlet.

Answer

Switch the service to the Java 17 standard runtime and add the binary to the CLASSPATH environment variable in app.yaml.

Question 3

You are deploying a new version of a Java web application to App Engine standard environment. The previous version is still serving 100% of traffic. You want to test the new version with a small subset of users before shifting all traffic. Which approach should you take?

Accepted Answer

Deploy the new version with `gcloud app deploy --no-promote`, then use the version-specific URL to test, and finally migrate traffic using `gcloud app services set-traffic`.. Deploying with --no-promote creates a new version without routing traffic to it, allowing you to test via the version-specific URL. After validation, you can shift traffic gradually using gcloud app services set-traffic, which supports splitting by IP or cookie. This provides a safe rollout and rollback capability.

Answer

Use `gcloud app deploy --promote` to deploy the new version and automatically split traffic 50/50 between old and new versions.

Answer

Create a new App Engine service for the test version, deploy there, and use a load balancer to route a percentage of traffic to the new service.

Answer

Deploy the new version normally, then immediately use `gcloud app versions stop` on the old version to force all traffic to the new version.

Question 4

You are deploying a containerized application to Cloud Run. The application must connect to a Cloud SQL for PostgreSQL instance. You want to use the built-in integration that provides secure connectivity without exposing the database to the public internet. What should you do?

Accepted Answer

Use the Cloud SQL Auth proxy by adding the `--add-cloudsql-instances` flag to the `gcloud run deploy` command and connect via the Unix socket.. Cloud Run has built-in support for the Cloud SQL Auth proxy. When you deploy with --add-cloudsql-instances, Cloud Run runs the proxy as a sidecar, creating a Unix socket. Your application connects via that socket, and authentication is handled by IAM. This method is secure, simple, and does not require public IPs or manual VPC setup.

Answer

Assign a public IP to the Cloud SQL instance and configure the Cloud Run service to connect using the instance's public IP address with SSL encryption.

Answer

Enable the Cloud SQL Admin API and add a volume mount for the Cloud SQL socket in the Cloud Run service configuration.

Answer

Configure the Cloud Run service to use a Serverless VPC Access connector and set the Cloud SQL connection to use a private IP.

Question 5

You manage a Cloud Run service that receives traffic from users worldwide. The service is deployed in the us-central1 region. Users in Asia report high latency. You want to reduce latency for these users without changing the application code. What should you do?

Accepted Answer

Deploy the service to multiple regions and use a global external HTTP(S) load balancer with a serverless NEG backend to route users to the closest region.. Deploying the service to multiple regions and using a global external HTTP(S) load balancer with serverless NEGs allows Google's global network to route users to the nearest Cloud Run region, minimizing latency. This approach leverages Google's edge network and automatic failover, and does not require application code changes. Other options address scaling or caching but do not reduce geographic latency.

Answer

Configure the Cloud Run service to use a larger CPU and memory allocation to process requests faster.

Answer

Increase the maximum number of instances for the Cloud Run service to handle more concurrent requests.

Answer

Enable CDN caching on the Cloud Run service by setting the cache-control header in responses.

Question 6

You are deploying a microservices application to Google Kubernetes Engine (GKE). The application consists of several services that need to communicate with each other. You want to enforce mutual TLS (mTLS) between services and gain fine-grained traffic control without modifying application code. Which GKE feature should you use?

Accepted Answer

Anthos Service Mesh. Anthos Service Mesh provides a uniform way to secure, connect, and monitor microservices. It automatically enables mTLS between services, encrypting traffic and authenticating both ends. It also offers advanced traffic management features like canary deployments, retries, and circuit breaking. These are achieved via sidecar proxies, without modifying application code, making it ideal for the scenario.

Answer

Cloud VPN

Answer

GKE Ingress

Answer

Network policies

Question 7

You are deploying a Python application to App Engine flexible environment. The application requires a custom runtime with specific system packages. You need to ensure that the deployment includes these packages. What should you do?

Accepted Answer

Create a custom runtime by providing a Dockerfile that installs the necessary system packages and sets up the application.. App Engine flexible environment allows custom runtimes through a Dockerfile. By writing a Dockerfile, you can install any system packages using the package manager of the base image. The Dockerfile is used to build the container image during deployment. This approach provides the flexibility needed for custom system dependencies while still leveraging App Engine's managed infrastructure.

Answer

Use the standard Python runtime and include a `requirements.txt` file to install the packages.

Answer

Include a `app.yaml` file with a `system_packages` section listing the required packages.

Answer

Use the `gcloud app deploy` command with the `--install-packages` flag to specify the system packages to install.

Question 8

You manage a Cloud Run service that receives bursty traffic. You want to minimize cold starts while keeping costs predictable. The service has a container startup time of about 8 seconds. You need to ensure that at least two instances are always running and ready to serve requests. What should you do?

Accepted Answer

Set the minimum instance count to 2 using `gcloud run deploy --min-instances=2`.. To ensure a minimum number of instances are always running, you must set the minimum instance count. Cloud Run's min-instances parameter keeps the specified number of instances warm, avoiding cold starts. Other options either limit scaling, control concurrency, or use external triggers that do not provide the same guarantee.

Answer

Configure a Cloud Run service with a concurrency setting of 2 and deploy.

Answer

Use a Cloud Scheduler job to send a request to the service every minute.

Answer

Set the maximum instance count to 2 and enable CPU always allocated.

Question 9

You are configuring a Cloud Deploy pipeline to promote a release from a staging target to a production target on GKE. You need the promotion to be gated by an approval and to apply manifests from the same rendered release. Which two actions should you take? (Choose two.)

Accepted Answer

Enable requireApproval on the promoteRelease stage so the rollout waits for a manual approval.. Cloud Deploy promotes rendered releases between targets, so you need a distinct production target referenced by a promoteRelease stage. Adding requireApproval to that stage pauses the rollout until a human approves, satisfying the gate requirement. Rebuilding images or regenerating manifests at promotion time breaks release fidelity, and deploying outside Cloud Deploy removes the audit trail and approval control.

Answer

Add a Cloud Build trigger that runs on every commit to the production branch and deploys directly with kubectl apply.

Answer

Configure the production target with a different Skaffold profile so the manifests are regenerated at promotion time.

Answer

Re-run the build step with a new image tag before each promotion to ensure the production manifests differ from staging.

Question 10

You are deploying a new version of a service to Cloud Run. You want to perform a canary deployment to gradually shift traffic to the new revision. Which two actions should you perform? (Choose two.)

Accepted Answer

Deploy the new revision with the `--no-traffic` flag to prevent it from receiving any traffic initially.. A canary deployment in Cloud Run involves deploying the new revision without traffic using --no-traffic, then gradually shifting traffic with gcloud run services update-traffic. This allows you to test the new revision and roll back if issues arise. The other options either do not apply to Cloud Run's native traffic management or are not part of the canary process.

Answer

Use `gcloud run deploy` with the `--tag` flag to assign a unique tag to the new revision for testing.

Answer

Configure a load balancer to distribute traffic between the old and new revisions based on weights.

Answer

Set the `--concurrency` parameter to control the number of concurrent requests per revision.

Question 11

A development team stores its application code in a GitHub repository. The team wants every push to the main branch to automatically build a container image and deploy it to a Google Kubernetes Engine cluster. They want to minimize operational overhead for managing build infrastructure and prefer a Google Cloud-native solution. Which approach should they use?

Accepted Answer

Create a Cloud Build trigger connected to the GitHub repository that builds the image, pushes it to Artifact Registry, and applies Kubernetes manifests.. Cloud Build triggers natively integrate with GitHub and can perform builds, push to Artifact Registry, and deploy to GKE. This provides a fully managed CI/CD pipeline with minimal operational overhead. Cloud Deploy handles delivery but not building from source, while self-hosted runners and Jenkins require managing infrastructure, which is contrary to the team's preference for a managed Google Cloud-native approach.

Answer

Use Cloud Deploy to create a delivery pipeline that builds and deploys the application directly from source code.

Answer

Configure a GitHub Actions workflow that uses a self-hosted runner on Compute Engine to build and deploy the application.

Answer

Set up a Jenkins server on GKE and configure a webhook from GitHub to trigger builds and deployments.

Question 12

Your organization uses Google Cloud Deploy to promote releases across dev, staging, and prod targets in GKE. A release has passed dev and is awaiting promotion to staging, but a developer accidentally deleted the staging target resource. You need to restore the ability to promote the existing release without recreating the release. What should you do?

Accepted Answer

Recreate the staging target with `gcloud deploy targets create` using the same name and configuration, then retry the promotion.. Google Cloud Deploy stores targets as independent resources referenced by name during promotion. Recreating the deleted target with the same name and configuration restores the promotion path without altering releases or rollouts. This preserves audit history and avoids unnecessary release recreation or pipeline changes.

Answer

Delete the release and recreate the delivery pipeline so that the staging target is regenerated automatically.

Answer

Create a new release from the same source commit, then promote the new release to staging.

Answer

Run `gcloud deploy rollouts undo` on the dev rollout to reset the pipeline state, then promote to staging.

Question 13

You are deploying a new Cloud Run service that must read secrets from Secret Manager at runtime. You want to avoid embedding secret values in the container image or in environment variables visible in the console. What should you do?

Accepted Answer

Mount the secret as a volume and reference it from the Cloud Run service configuration.. Mounting a Secret Manager secret as a volume lets the Cloud Run revision read the value from a file at runtime, so it never appears in the image or as a console-visible environment variable. The revision's service account needs secretAccessor on the secret. Plaintext variables, baked-in values, and public storage all expose the secret or complicate rotation.

Answer

Bake the secret into the container image at build time using a Cloud Build substitution variable.

Answer

Set the secret as a plaintext environment variable in the Cloud Run service YAML and rely on IAM to restrict who can view the revision.

Answer

Store the secret in a Cloud Storage bucket and have the service download it on each request without authentication.

Question 14

You are deploying a containerized application to Cloud Run. The application requires a database connection string that must be kept secret. You want to avoid hardcoding the secret in the container image and ensure that the secret is rotated regularly without redeploying the service. What should you do?

Accepted Answer

Use Secret Manager to store the secret and reference it as an environment variable in the Cloud Run service configuration.. Secret Manager is the recommended service for storing and managing secrets on Google Cloud. Cloud Run can reference a secret from Secret Manager as an environment variable or as a mounted volume. When the secret is rotated, new Cloud Run instances automatically retrieve the latest version, so you don't need to redeploy. This approach keeps secrets out of the image and source code, and provides centralized management and auditing.

Answer

Store the secret in an environment variable in the Cloud Run service YAML file and commit it to a private Git repository.

Answer

Store the secret in a Cloud Storage bucket and mount it as a volume in the Cloud Run service.

Answer

Pass the secret as a build-time argument in the Dockerfile and build the image with the secret embedded.

Question 15

A developer is deploying a new version of a service to Cloud Run. The service is expected to receive a sudden spike in traffic immediately after deployment. The developer wants to ensure that the new revision is fully warmed up and ready to handle requests before it receives production traffic. What should the developer do?

Accepted Answer

Deploy the new revision with the --no-traffic flag, then send synthetic requests to the revision's URL to warm it up, and finally migrate traffic.. To warm up a new revision before production traffic, deploy with --no-traffic, send test requests to the revision URL, then shift traffic. This ensures the revision is initialized and ready. Other options either do not guarantee warm-up or are not supported features in Cloud Run.

Answer

Set the minimum number of instances to a high value before deploying the new revision.

Answer

Deploy the new revision with the --allow-unauthenticated flag to reduce latency during startup.

Answer

Configure a readiness probe in the Cloud Run service to delay traffic until the application is ready.