PCD Deploying applications — Timed 15 Questions

Question 1

You are deploying a critical application on Compute Engine. The application requires high availability and must survive a zonal failure. You have created a managed instance group (MIG) with autoscaling across two zones. The application state is stored in a Cloud SQL instance with a read replica in another region. The application also uses a shared static IP address for client access. During a test, you simulate a failure of zone us-central1-a. You observe that the MIG automatically creates new instances in the remaining zone, but the application becomes unreachable for several minutes. What is the most likely cause of the downtime?

15 minute time limit — choose an answer to begin.

Accepted Answer

The load balancer's health check interval and timeout caused a delay in marking the backend instances as unhealthy and routing traffic to the new zone.. The most likely cause is that the load balancer's health check interval and timeout delayed the detection of unhealthy instances in the failed zone, preventing traffic from being rerouted to the new instances in the remaining zone. Even though the MIG created new instances quickly, the load balancer continued sending requests to the failed zone until the health check marked those backends as unhealthy, causing the application to be unreachable during that window.

Answer

The static IP address was not configured to failover to the remaining zone.

Answer

The Cloud SQL read replica did not promote to primary quickly enough.

Answer

The managed instance group's autoscaler took too long to create new instances in the remaining zone.

Question 2

An organization deploys a critical application on GKE with multiple namespaces. They want to enforce that only certain images from approved Artifact Registry repositories can be deployed in the production namespace. Which GKE feature should they use?

Accepted Answer

Binary Authorization. Binary Authorization is the correct GKE feature because it enforces deployment-time policy controls that require container images to be signed by trusted authorities and originate from approved Artifact Registry repositories. By configuring an admission webhook with Binary Authorization, the organization can create an attestation policy that blocks any pod in the production namespace from running unless its image has a valid cryptographic signature from a trusted signer and the image path matches an allowed Artifact Registry host.

Answer

Network Policies

Answer

Workload Identity

Answer

Pod Security Policies (deprecated)

Question 3

After updating the image to v2, users report that the frontend application returns errors because it cannot reach the backend service. The backend service is running on GKE with the name 'backend-service' in the same namespace. What is the most likely cause?

Accepted Answer

The application expects the backend URL from an environment variable named BACKEND_SERVICE_URL, but the deployment sets BACKEND_URL.. The most likely cause is that the frontend application expects the backend URL from an environment variable named `BACKEND_SERVICE_URL`, but the deployment sets `BACKEND_URL`. This mismatch means the frontend cannot resolve the backend endpoint, leading to connection errors. In Kubernetes, environment variables are commonly used to pass service discovery information, and a naming mismatch directly breaks the application's ability to reach the backend.

Answer

The selector labels do not match the pods.

Answer

The backend service is not listening on port 8080.

Answer

The termination grace period is too short causing connection drops.

Question 4

A team deploys a containerized web application on Google Kubernetes Engine (GKE) using a Deployment. They need to expose the application externally via a stable IP address and enable SSL termination. Which resource should they use?

Accepted Answer

Ingress with Google-managed SSL certificate. An Ingress with a Google-managed SSL certificate is the correct choice because it provides a single stable IP address via a global forwarding rule, terminates SSL at the Google Cloud HTTP(S) load balancer, and routes traffic to the GKE Deployment. This approach offloads SSL decryption from the application pods and uses a managed certificate that auto-renews, meeting both the stable IP and SSL termination requirements.

Answer

HorizontalPodAutoscaler

Answer

Service type NodePort

Answer

Service type LoadBalancer

Question 5

During a deployment to App Engine flexible environment, the new version fails to start and the logs show 'Container failed to start: context deadline exceeded'. The previous version remains serving traffic. What is the most likely cause?

Accepted Answer

The container startup time exceeds the 10-minute timeout.. The error 'context deadline exceeded' in App Engine flexible environment indicates that the container did not start within the allowed startup timeout. The default timeout for container startup in App Engine flexible is 10 minutes, and if the application takes longer (e.g., due to slow initialization, large dependency downloads, or database migrations), the platform kills the container and logs this error. The previous version continues serving because the new version failed to become healthy.

Answer

The health check is misconfigured, causing the instance to be considered unhealthy.

Answer

The app requires an environment variable that is not set.

Answer

The Dockerfile has a syntax error that prevents the container from building.

Question 6

A company has a multi-region Cloud Run service with traffic splitting between revisions. They notice that a newly rolled-out revision is receiving 0% of traffic even though they set traffic to 100% via the console. The revision shows 'Ready: Yes'. What is the most likely cause?

Accepted Answer

The revision has a tag but no traffic percentage assigned; the tag is being used for routing.. When a revision shows 'Ready: Yes' but receives 0% traffic despite setting 100% via the console, the most likely cause is that the revision has a tag assigned but no traffic percentage. In Cloud Run, tags are used for direct URL routing (e.g., for testing) and do not receive any traffic from the service's main URL unless a traffic percentage is explicitly assigned. The console's traffic splitting UI allows setting a tag without a percentage, which can lead to this confusion.

Answer

The revision has a low CPU limit causing it to be throttled.

Answer

The revision is not healthy because of a misconfigured health check.

Answer

The revision has a concurrency setting of 0, which is invalid.

Question 7

A DevOps engineer is automating deployments to Compute Engine using a CI/CD pipeline. They want to minimize downtime and ensure that if a new VM fails health checks, the old VM continues serving. Which deployment strategy should they implement?

Accepted Answer

Blue/green deployment with health checks and a managed instance group. Blue/green deployment with health checks and a managed instance group is correct because it allows the new version (green) to be fully deployed and validated against health checks before any traffic is switched from the old version (blue). If the new VM fails health checks, the managed instance group automatically keeps the old version serving, ensuring zero downtime and immediate rollback without manual intervention.

Answer

Redeploy the old version manually if the new version fails

Answer

Rolling update with a readiness probe

Answer

Canary deployment with a small percentage of traffic

Question 8

A developer deploys a Cloud Function (2nd gen) that processes messages from Pub/Sub. The function sometimes fails with 'Deadline Exceeded' for messages that take longer than 9 minutes. What should the developer do to handle these long-running messages without losing them?

Accepted Answer

Set the Pub/Sub subscription acknowledgment deadline to 10 minutes and implement a push endpoint that acknowledges after processing.. Cloud Functions (2nd gen) have a maximum timeout of 60 minutes, but Pub/Sub push subscriptions have a default acknowledgment deadline of 10 seconds. By setting the acknowledgment deadline to 10 minutes and implementing a push endpoint that acknowledges after processing, the developer ensures the message is not redelivered prematurely while allowing the function up to 10 minutes to complete. This prevents 'Deadline Exceeded' errors for messages that take longer than 9 minutes without losing messages, as the subscription will wait for the acknowledgment before considering the message as failed.

Answer

Configure the function to retry on failure and set a maximum retry count.

Answer

Increase the Cloud Function timeout to 60 minutes.

Answer

Use Cloud Tasks instead of Pub/Sub for asynchronous invocation.

Question 9

Which TWO statements about deploying applications on Google Kubernetes Engine (GKE) are correct?

Accepted Answer

HorizontalPodAutoscaler can use custom metrics from Cloud Monitoring.. HorizontalPodAutoscaler (HPA) in GKE can scale pods based on custom metrics from Cloud Monitoring (formerly Stackdriver). This is achieved by using the custom.metrics.k8s.io API, which allows HPA to query metrics like custom application latency or queue depth, not just default CPU/memory. This enables fine-grained, application-specific autoscaling.

Answer

Kubernetes Secrets are encrypted at rest by default.

Answer

A zonal GKE cluster automatically uses regional persistent disks for high availability.

Answer

To expose a Deployment externally, you must create an Ingress resource.

Question 10

Which THREE practices should be followed when deploying a containerized application to Cloud Run?

Accepted Answer

Avoid writing to the local filesystem for data that must persist across requests.. Cloud Run instances are ephemeral and the local filesystem is not persisted across requests or instance restarts. Writing to local disk for data that must survive beyond a single request will cause data loss when the instance is recycled, which is a fundamental characteristic of serverless container platforms.

Answer

Set a maximum request timeout of 10 minutes to avoid cold starts.

Answer

Hardcode port 8080 in the container.

Question 11

A developer runs the above command and receives the error. What is the most likely cause?

Accepted Answer

The cloudbuild.yaml file has a syntax error, such as incorrect indentation.. The error is most likely due to a syntax error in the cloudbuild.yaml file, such as incorrect indentation. Cloud Build uses YAML for configuration, and YAML is sensitive to indentation; a missing space or incorrect alignment can cause the build to fail with a parsing error. The command `gcloud builds submit` reads the cloudbuild.yaml file from the current directory, and if the YAML is malformed, the submission will fail before any Docker or build steps are executed.

Answer

The image tag format is incorrect.

Answer

The cloudbuild.yaml file is not present in the current directory.

Answer

The Dockerfile is missing from the repository.

Question 12

A developer deploys the above app.yaml to App Engine standard environment. The deployment succeeds, but the application fails to connect to the database. What is the most likely reason?

Accepted Answer

The application is trying to connect to a local database on localhost, which is not available in the App Engine sandbox.. In App Engine standard environment, applications run in a sandboxed environment that does not support connections to a local database on localhost. The application code is attempting to connect to a database at 127.0.0.1 or localhost, which is not available in the sandbox. Instead, the application must connect to a Cloud SQL instance using a Unix socket or a private IP, or use a fully managed database service like Firestore.

Answer

The runtime 'python39' is not supported in App Engine standard environment.

Answer

The $PORT environment variable is not set in App Engine standard environment.

Answer

The entrypoint command is incorrect because gunicorn is not allowed.

Question 13

A company wants to deploy a containerized application on Google Kubernetes Engine (GKE) with zero downtime during updates. The application is stateless and runs on a Deployment with 5 replicas. Which deployment strategy should be used?

Accepted Answer

Rolling update. A rolling update is the default deployment strategy in Kubernetes and is ideal for stateless applications requiring zero downtime. It gradually replaces old Pods with new ones, ensuring that a minimum number of replicas remain available throughout the update. This strategy is configured via the `strategy.type: RollingUpdate` field in the Deployment spec, with parameters like `maxSurge` and `maxUnavailable` controlling the pace.

Answer

Blue/green deployment

Answer

Recreate update

Answer

Canary deployment

Question 14

A developer is deploying a Cloud Run service that needs to access a Cloud SQL instance. The service is deployed with the --no-allow-unauthenticated flag. What is the recommended way to grant the service access to the database?

Accepted Answer

Grant the Cloud SQL Client role to the Cloud Run service's runtime service account.. The recommended way to grant a Cloud Run service access to a Cloud SQL instance is to grant the Cloud SQL Client role (roles/cloudsql.client) to the Cloud Run service's runtime service account. This role provides the necessary permissions (cloudsql.instances.connect and cloudsql.instances.get) to establish a secure connection via the Cloud SQL Auth Proxy or the Cloud SQL connector library. Using the runtime service account follows the principle of least privilege and avoids managing long-lived credentials.

Answer

Create a service account key and store it in Secret Manager, then mount it as a volume.

Answer

Use the default Compute Engine service account and grant it the Cloud SQL Client role.

Answer

Enable the Cloud SQL Admin API and use Application Default Credentials from the Cloud Run service.

Question 15

A company is deploying a microservices architecture on GKE. They need to expose a set of related microservices under a single external IP address with path-based routing. Which Kubernetes resource should they use?

Accepted Answer

Ingress resource. An Ingress resource is the correct choice because it provides HTTP/HTTPS layer-7 routing to expose multiple services under a single external IP address, using path-based or host-based rules. This directly meets the requirement of exposing a set of related microservices with path-based routing on GKE, whereas a Service of type LoadBalancer would create a separate external IP per service.

Answer

Service of type NodePort

Answer

NetworkPolicy

Answer

Service of type LoadBalancer