Building and Implementing CI/CD Pipelines for a Service

A DevOps engineer wants to build a CI/CD pipeline that automatically builds and tests code every time a developer pushes a new branch to a Git repository. Which Cloud Build trigger type should they use?

A team uses Cloud Build to build a Docker image and push it to Artifact Registry. They need to cache Docker layers to speed up subsequent builds. The build runs on a private pool with access to a VPC. Which caching approach should they implement in cloudbuild.yaml?

An engineer configures Cloud Deploy to promote a container to production after manual approval. The deployment strategy must gradually shift traffic from the current version to the new version while monitoring error rates. Which deployment strategy should they select in the delivery pipeline?

A company uses Cloud Build to deploy to Cloud Run. They need to test a new revision with a specific tag without serving any live traffic. After validation, they want to shift 10% of traffic to the new revision. Which two gcloud commands should they use?

A team wants to adopt GitOps for a GKE cluster. They need a solution that automatically syncs their Kubernetes manifests from a Git repository to the cluster and ensures the cluster state matches the repo. Which Google Cloud service should they use?

An engineer is configuring a Cloud Build trigger for a Java application. The build step uses Maven to compile and test, then builds a Docker image. Which cloudbuild.yaml step configuration is CORRECT for specifying the Maven command?

A team uses Cloud Build with a private pool to build a Docker image that requires access to a Cloud SQL instance. The build fails because the builder cannot connect to the database. The network configuration uses VPC Service Controls. What is the MOST likely cause and solution?

A company uses Artifact Registry to store Docker images. They want to enforce that only images signed by a trusted authority can be deployed to their GKE cluster. Which service should they use with Artifact Registry?

An engineer is building a CI/CD pipeline for a microservice that uses feature flags via LaunchDarkly. They want to automatically enable a new feature flag in a staging environment after deployment, but not in production. How should they integrate this into Cloud Deploy?

A team uses Cloud Build to deploy a Python service to Cloud Run. They need to ensure the service uses a custom domain and only accepts HTTPS traffic. Which flags should they include in the gcloud run deploy command?

A company uses Cloud Build to build a multi-module Maven project. They want to run unit tests for module A and integration tests for module B in parallel. In cloudbuild.yaml, how should they configure the steps to run in parallel?

A developer needs to push a Docker image to Artifact Registry from their local machine. They have installed the gcloud CLI. Which command should they run first to authenticate Docker with Artifact Registry?

A company uses Cloud Deploy for a CD pipeline to Cloud Run. They want to implement a canary deployment that automatically rolls back if the error rate increases by more than 5% during the canary phase. Which TWO actions should they take?

A team uses Cloud Build to build and deploy a Go application to GKE. They need to inject the Git commit SHA as an environment variable in the deployment. Which THREE steps should they take?

A company wants to enforce that only approved images from Artifact Registry can be deployed to their GKE clusters. They also want to ensure that images are scanned for vulnerabilities. Which TWO services should they use together?

An engineering team wants to automatically build a Docker image every time a developer pushes code to the main branch of their GitHub repository. They are using Cloud Build. Which configuration should they use?

A developer needs to authenticate to Artifact Registry from a CI/CD pipeline that runs on Compute Engine. The pipeline does not have access to user credentials. Which authentication method should they use?

A team uses Cloud Deploy to manage deployments to GKE. They want to automatically roll back to the previous revision if a canary deployment fails health checks. What should they configure?

A company wants to enforce that only container images signed by their CI/CD pipeline can be deployed to GKE. Which two services should they use together?

A DevOps engineer is configuring a Cloud Build pipeline that needs to deploy to a Cloud Run service in a VPC Service Controls perimeter. The build must access resources within the VPC. What should they use?

A team uses Skaffold for local development and wants to integrate it into their CI/CD pipeline on Cloud Build for continuous deployment to GKE. What is the recommended approach?

An organization uses Config Sync to manage Kubernetes resources across multiple GKE clusters. They want to automatically remediate configuration drift. What must they ensure?

A developer wants to deploy a containerized application to Cloud Run with a requirement that the service has at least 2 instances always running to handle low-latency requests. Which flag should they use with gcloud run deploy?

A CI/CD pipeline uses Cloud Build to build a Docker image. The Dockerfile copies dependencies from a private repository in the same VPC. The build takes a long time due to repeated downloads. How can the engineer optimize the build?

A team uses Cloud Deploy with a canary deployment strategy to GKE. They want to automatically promote the canary to full production if the error rate is below 1% for 10 minutes. What should they configure?

An engineer needs to create a build trigger in Cloud Build that runs tests on every pull request to the 'develop' branch. They also want to prevent the build from running if the PR is from a forked repository. What should they do?

A company uses Cloud Build to build and deploy microservices to GKE. Each microservice has environment-specific configurations (dev, staging, prod). They want to manage these configurations using Kustomize. How should they structure the pipeline?

A team wants to implement a GitOps workflow for deploying applications to GKE. They want to use a tool that continuously reconciles the cluster state with a Git repository. Which TWO tools can they use? (Select TWO)

An organization wants to enforce security policies on container images before deployment. They need to scan images for vulnerabilities and ensure only images that pass the scan can be deployed. Which TWO services should they use? (Select TWO)

A DevOps engineer is designing a CI/CD pipeline for a Cloud Run service. They need to implement a canary deployment that sends 10% of traffic to a new revision initially, then gradually increases to 100% if metrics are healthy. They also need to roll back instantly if the canary fails. Which THREE configurations should they use? (Select THREE)

A DevOps engineer wants to trigger a Cloud Build pipeline automatically whenever a developer pushes a new Git tag in the format 'v*.*.*'. Which trigger configuration should be used?

You are configuring a Cloud Build pipeline that builds a Docker image, pushes it to Artifact Registry, and deploys to Cloud Run. The build requires network access to a private VPC to download dependencies. Which approach should you use to provide VPC access?

A team uses Cloud Deploy with a delivery pipeline that deploys to GKE clusters across dev, staging, and prod targets. They want to automatically roll back a release if the canary deployment in staging fails to meet a defined service-level objective (SLO) for error rate. Which Cloud Deploy feature enables this?

A developer wants to use a pre-existing Docker image from Artifact Registry in a Cloud Build step. How should they authenticate the build step to pull the image?

A company uses Cloud Build to build a container image with Kaniko. They want to speed up builds by caching the base image layers. Which configuration should they add to their cloudbuild.yaml?

You are deploying a containerized application to Cloud Run using gcloud run deploy. You need to ensure that revisions are tagged with a custom identifier for testing purposes, without allocating any traffic to them. Which flag should you use?

An organization uses Binary Authorization with Container Analysis to enforce that only images that have passed vulnerability scanning and have been signed by an approved authority can be deployed to GKE. A DevOps engineer notices that an unsigned image is still being deployed. What is the most likely cause?

A team uses Kustomize to manage environment-specific configurations for their GKE deployments. They have a base overlay and overlays for dev, staging, and prod. Which command should they use to generate the final Kubernetes manifests for the staging environment?

An engineer wants to deploy a set of GCP resources (e.g., Cloud SQL, Pub/Sub topics) alongside their Kubernetes workloads using a GitOps approach with Config Connector. What is the primary benefit of using Config Connector over deploying these resources manually?

You are designing a CI/CD pipeline for a microservice application that uses feature flags to decouple deployment from release. The team wants to automatically enable a feature flag after the deployment is verified in production for a subset of users. Which tool or approach should you integrate into the pipeline to manage feature flags?

A company uses Cloud Build with GitHub triggers. The build pipeline runs tests, builds a Docker image, and pushes it to Artifact Registry. Recently, builds started failing with '403 Forbidden' when pushing to Artifact Registry. The Cloud Build service account has the Artifact Registry Writer role. What else could be causing the failure?

A DevOps engineer wants to implement a GitOps workflow for a GKE cluster using a tool that automatically syncs the cluster state with a Git repository. Which Google Cloud service is designed for this purpose?

A company wants to implement a CI/CD pipeline for a multi-service application where each service is built from a separate repository. They need to run unit tests, build container images, and deploy to both Cloud Run and GKE. Which two Google Cloud services should be combined to achieve this?

A team uses Cloud Deploy to manage deployments to GKE across dev, staging, and prod. They want to implement a canary deployment strategy that automatically progresses based on latency metrics and includes a manual approval step before the full rollout. Which three Cloud Deploy features should they use together?

An organization is moving to a GitOps model for managing both application deployments and GCP infrastructure. They want to use a single tool to sync Kubernetes manifests and manage GCP resources like Cloud SQL and Pub/Sub. Which two Google Cloud services should they combine?

An engineer wants to automatically build a Docker image in Cloud Build whenever code is pushed to the main branch of a repository. Which configuration is correct?

A team uses Cloud Build with a private pool to access resources in a VPC. After configuring the private pool, builds fail with a timeout error when pulling images from Artifact Registry. What is the most likely cause?

A company is implementing Binary Authorization with Cloud Deploy. They want to ensure that only images signed by the CI system (using Cloud Build) are deployed to production. What must be configured?

A DevOps engineer needs to deploy the same application to multiple GKE clusters across environments (dev, staging, prod) with environment-specific configurations. They want to use a single source of truth for Kubernetes manifests. Which approach is most suitable?

A team uses Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to automatically deploy to staging after a successful deployment to dev, but require manual approval before promoting to prod. How should they configure this?

An engineer wants to run two Cloud Build steps in parallel to speed up the build. How should they configure the cloudbuild.yaml?

A company uses Cloud Run and wants to deploy a new revision that initially receives 5% of traffic, and only if it's healthy, gradually increase to 100%. Which gcloud command should they use?

A team uses GitOps with Config Sync to manage multiple GKE clusters. They want to ensure that if a configuration change is applied to the git repository, it is automatically synced to all clusters within minutes. What must be configured?

An engineer wants to cache Docker layers in Cloud Build to speed up subsequent builds. The build uses Kaniko to build images. What should they include in the cloudbuild.yaml?

A company uses Cloud Build to deploy to Google Kubernetes Engine (GKE). They want to use a Helm chart stored in a Cloud Storage bucket. What should they do in the cloudbuild.yaml?

A deployment pipeline uses Cloud Deploy with canary strategy targeting Cloud Run. The engineer wants to run a data migration job before the new revision receives traffic. How should they implement this?

A team wants to use Cloud Build to build a Maven application and store the artifact in Artifact Registry. Which repository format should they use?

An organization uses Cloud Build and wants to inject a secret API key into a build step without exposing it in the cloudbuild.yaml. Which approach should they use?

A company uses Argo CD on GKE for GitOps deployments. They want to ensure that when a developer pushes a change to a Kubernetes manifest, Argo CD automatically syncs the cluster. What must be configured?

An engineer uses Cloud Build with a private pool to build an application that needs to connect to a Cloud SQL database. The build step fails with a connection timeout. What is the most likely cause?

Which TWO options are valid ways to authenticate to Artifact Registry from a CI/CD pipeline? (Choose two.)

Which THREE are valid Cloud Deploy deployment strategies? (Choose three.)

Which TWO actions should be taken to enable layer caching for Docker builds using Kaniko in Cloud Build? (Choose two.)

A DevOps engineer wants to automatically trigger a Cloud Build pipeline when a pull request is opened against the main branch. The pipeline should run unit tests and provide results as a status check on the PR. Which type of trigger should they configure?

An engineer is configuring a cloudbuild.yaml file. They want two build steps (unit tests and linting) to run simultaneously, and after both complete, a third step (package) should run. How should they configure waitFor in the package step?

A company uses Cloud Build to build Docker images. They want to cache intermediate layers to speed up subsequent builds. The build runs on a private pool with access to Artifact Registry. Which caching approach should they use?

A team is implementing Binary Authorization for containers deployed to GKE. They want to enforce that only images signed by their CI pipeline can be deployed. The CI pipeline runs in Cloud Build. What must they configure to allow Cloud Build to sign images?

A DevOps engineer is using Cloud Deploy to promote a release from staging to production. They want to require a manual approval before the release is deployed to production. What should they configure in the delivery pipeline?

An organization is deploying a containerized application to Cloud Run. They want to gradually roll out a new revision to 10% of traffic, monitor for errors, and then fully promote if stable. Which Cloud Run feature should they use?

A team uses Kustomize to manage Kubernetes manifests for multiple environments (dev, staging, prod). They have a base directory and overlays for each environment. When deploying to a cluster, they run kustomize build and pipe to kubectl apply. How can they integrate this into Cloud Build?

An organization is implementing GitOps using Config Sync. They have a Git repository containing Kubernetes manifests for multiple GKE clusters. They want to ensure that only authorized engineers can modify the configuration and that changes are automatically applied to clusters. What is the recommended way to secure Config Sync?

A company is using Cloud Deploy to manage releases to GKE. They want to implement a deployment strategy where the new version is rolled out to a small subset of pods and traffic is gradually shifted based on prometheus metrics. Which deployment strategy should they configure in the delivery pipeline?

A DevOps engineer is setting up Docker credential helper for Artifact Registry on a Cloud Build worker. They want the build steps to authenticate to Artifact Registry without storing service account keys. What is the recommended approach?

A company is deploying a microservice to Cloud Run. They need to ensure that the service can handle sudden traffic spikes without cold starts. The service has a memory requirement of 2 GB and CPU usage is bursty. What should they configure?

A team is using Skaffold for local development and CI/CD. They want to use Skaffold profiles to handle differences between local and production environments. In the CI pipeline (Cloud Build), they want Skaffold to build and deploy using the production profile. How should they invoke Skaffold in the cloudbuild.yaml?

A company is adopting GitOps for their GKE clusters using Config Sync. They need to meet the following requirements: (1) automatically sync the cluster state to a Git repository every 5 minutes, (2) ensure that any changes made directly to the cluster are reverted to the desired state defined in Git. Which Config Sync settings should they configure? (Choose TWO).

A DevOps team uses Cloud Build to build a multi-service application. They have three services: frontend, backend, and worker. They want to run builds for all three services in parallel to speed up the pipeline. Which of the following cloudbuild.yaml configurations are valid for achieving parallel execution? (Choose TWO).

A company uses Cloud Deploy to deploy to multiple GKE clusters (dev, staging, prod). They want to implement a canary deployment strategy for the prod target. The canary should deploy 10% of pods initially, then after 30 minutes and a manual approval, promote to 100%. Which configurations are necessary? (Choose THREE).

An engineer wants to trigger a Cloud Build pipeline automatically whenever a pull request is created against the main branch of a GitHub repository. Which type of build trigger should they configure?

A team uses Cloud Build with a cloudbuild.yaml that builds a Docker image. They want to speed up builds by caching the Docker layers using Kaniko cache in Artifact Registry. Which configuration change is required?

An organization has a Cloud Deploy delivery pipeline with a canary deployment strategy to GKE. They want to automatically pause the rollout if the canary revision's error rate exceeds 5% for 5 minutes. Which feature should they use?

A team uses Cloud Deploy to manage deployments to multiple GKE clusters in different environments. They need to ensure that only a specific service account can promote releases to the production target. What should they configure?

A developer wants to deploy a containerized application to Cloud Run using the command line. They need to set the maximum number of concurrent requests per container instance to 80. Which flag should they use with 'gcloud run deploy'?

An organization uses Artifact Registry to store Docker images. They want to enforce that only images that have passed vulnerability scanning and are signed can be deployed to GKE. Which two services should they use together?

A team uses Cloud Build to deploy to Cloud Run via gcloud run deploy. They need to perform a canary deployment where 10% of traffic goes to the new revision for 10 minutes before shifting to 100%. The deployment must be automated without manual steps. What approach should they take?

A company uses Helm charts to manage Kubernetes deployments. They want to integrate Skaffold into their CI/CD pipeline for local development and continuous deployment to GKE. Which Skaffold feature is MOST relevant for applying environment-specific configurations?

An engineer needs to create a build trigger in Cloud Build that runs every day at midnight. Which type of trigger should they use?

A team uses Cloud Deploy with a delivery pipeline that has multiple targets (dev, staging, prod). They want to automatically roll back to the previous release if the new release fails a post-deployment health check. Which configuration should they use?

A company uses Config Sync to manage GKE clusters in a GitOps fashion. They need to ensure that resources are automatically synced from a Git repository to the cluster, and that any drift from the desired state is corrected. Which Config Sync mode should they enable?

A developer wants to manually promote a release from a staging target to a production target using Cloud Deploy. Which gcloud command should they use?

A company uses Cloud Deploy to manage deployments to multiple GKE clusters. They want to implement a canary deployment strategy where the new revision receives 10% of traffic initially, and after 5 minutes with no errors, it receives 100%. Which TWO actions are required to achieve this?

A team uses Cloud Build to build and push Docker images to Artifact Registry. They need to ensure that only images built from the main branch and signed by a trusted key can be deployed to GKE using Binary Authorization. Which THREE components must be in place?

An organization uses GitOps with Config Sync to manage multiple GKE clusters. They want to ensure that any change to the Git repository is automatically applied to the clusters, and that no manual kubectl apply commands are used. Which TWO resources should they configure?

A DevOps engineer wants to automatically trigger a Cloud Build pipeline whenever a pull request is created against the main branch of a repository. Which type of build trigger should they use?

An organization wants to store Docker images in a private Google Cloud repository with vulnerability scanning enabled. Which service should they use?

A team uses Cloud Build to build a container image using Kaniko. They want to cache layers to speed up subsequent builds. What should they configure in their cloudbuild.yaml to enable Kaniko layer caching?

A company uses Cloud Deploy to manage deployments to GKE. They want to automatically roll back a release if a deployment fails. How should they configure this?

An engineer needs to deploy an application to Cloud Run with a canary traffic split: 95% to the stable revision and 5% to a new revision. They also want to test the new revision with specific headers without affecting user traffic. Which approach meets these requirements?

A team uses Helm charts to deploy applications to GKE. They need to manage environment-specific configurations (e.g., dev, staging, prod) using a single chart. Which tool should they use?

A company wants to enforce Binary Authorization on images deployed to GKE. Images must be signed by an approved authority. What must be configured in the CI/CD pipeline to ensure images are signed before deployment?

A developer wants to use Cloud Build to deploy a container to Cloud Run. They have written a cloudbuild.yaml file with a step that runs gcloud run deploy. The build fails with a permission error. What is the most likely cause?

An organization wants to implement GitOps for their GKE clusters. They need to automatically sync the cluster state with a Git repository. Which Google Cloud service should they use?

A company uses Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to require manual approval before promoting a release to prod. How should they configure this?

A team uses Cloud Build private pools to build Docker images that need access to on-premises resources via VPC peering. The build step fails with a 'connection refused' error. What is the most likely missing configuration?

An engineer is configuring Cloud Build to use a substitution variable for the Docker image tag. They want the tag to be the short commit SHA. Which built-in substitution should they use?

A company wants to deploy a microservice to Google Cloud. They require canary deployments with automatic rollback if error rate increases. Which TWO services should they use together?

A team uses Skaffold for local development and CI/CD. They want to run integration tests against the deployed application before releasing to production. Which THREE Skaffold features can they use?

An organization wants to implement feature flags to gradually roll out new features in production. Which TWO approaches can they use on Google Cloud?

An engineer wants to trigger a Cloud Build pipeline whenever a new pull request(PR) is opened against the 'main' branch of a repository. Which type of build trigger should they configure?

A team is using Cloud Build to build Docker images and push them to Artifact Registry. They want to speed up builds by caching the Docker layers. Which approach is recommended for caching in Cloud Build?

An organization uses Cloud Deploy to promote releases across dev, staging, and prod. They want to automatically run integration tests after a deployment to a Cloud Run target, before proceeding to the next stage. How should they implement this?

A DevOps engineer is building a CI/CD pipeline and needs to securely pass a database password to a Cloud Build step. The password is stored in Secret Manager. What is the correct way to access it in cloudbuild.yaml?

A company wants to deploy a containerized application to Cloud Run and gradually shift traffic from the current revision to a new revision. They want to send 10% of traffic to the new revision initially. Which command should they use?

A team is using Helm charts to deploy to GKE. They want to manage environment-specific values (dev, staging, prod) while keeping a single chart. Which approach is recommended?

An organization uses GitOps with Config Sync to manage multiple GKE clusters. They want to automatically deploy a new version of a microservice by pushing to a Git repository. Which component validates and applies the changes to the clusters?

A company is using Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to require manual approval before deploying to prod. What should they add?

An engineer wants to use Skaffold for local development and for CI/CD on Google Cloud. Which feature allows Skaffold to run on Cloud Build and deploy to GKE?

A team is setting up a Cloud Build private pool to build Docker images that need access to resources in a VPC. After creating the private pool, builds fail with network errors. What is the most likely missing step?

A company uses Cloud Build to deploy to Cloud Run. They want to use a custom service account for the deployment step, not the default Cloud Build service account. How should they configure this?

An organization is implementing Binary Authorization for GKE. They need to ensure that only container images signed by their CI system are deployed. Which service must be enabled and configured to enforce this?

A company is migrating CI/CD pipelines to Google Cloud. They want to deploy containerized applications to GKE using GitOps principles with Config Sync. Which two components are required? (Choose 2)

A team is designing a CI/CD pipeline for a microservice that requires canary deployments with metrics-based rollback. They want to use Cloud Deploy and Cloud Run. Which three features must they configure? (Choose 3)

A developer is using Cloud Build to build a Docker image and wants to use build substitutions to dynamically set the image tag. Which built-in substitutions can they use? (Choose 2)

A DevOps engineer wants to trigger a Cloud Build pipeline automatically every time a pull request is created against the main branch of a Cloud Source Repositories repository. Which type of build trigger should they configure?

An engineer needs to build a Docker image using Cloud Build and ensure the image is cached across builds to speed up subsequent runs. The build uses Kaniko. What should the engineer add to the cloudbuild.yaml to enable layer caching?

A company uses Cloud Deploy to manage deployments to multiple GKE clusters across environments. They want to implement a canary deployment strategy where 10% of traffic goes to the new version initially, and after manual approval, the remaining 90% rolls out. What should be included in the delivery pipeline configuration?

An organization wants to deploy a Cloud Run service using Cloud Deploy. They need to run a database migration script before each new revision starts serving traffic. Which Cloud Deploy feature should they use?

A team uses GitOps with Config Sync to manage multiple GKE clusters. They want to ensure that if a cluster's state drifts from the desired state in the Git repository, it is automatically corrected. Config Sync is installed with the default settings. What else must be configured?

A developer needs to deploy a containerized application to Cloud Run using the gcloud command. Which two flags are required to successfully deploy?

An organization uses Cloud Build to build and deploy applications. They need to ensure that build secrets (e.g., API tokens) are securely injected into build steps without being exposed in the build logs. Which two actions should they take?

A company wants to implement Binary Authorization for containers deployed to GKE. They need to ensure that only images signed by their internal CI system are allowed to run. Which three components are required?

A DevOps team wants to use Cloud Deploy to promote releases across multiple targets. They need to define a delivery pipeline that includes a canary deployment for a GKE cluster and a standard deployment for Cloud Run. Which two strategies can they use in the same pipeline?

An engineer is configuring a Cloud Build build pool to connect to resources in a VPC network. They need to ensure the build can access a private Artifact Registry repository. Which three steps should they take?

A team uses Helm charts to deploy applications to GKE. They want to use Kustomize to manage environment-specific overlays for different clusters. Which two tools or approaches can they combine to achieve this?

An organization wants to use Cloud Build to automatically build and test code changes when a developer pushes to any branch in a Cloud Source Repositories repository. Which two configurations are needed?