PCDE Building and Implementing CI/CD Pipelines for a Service — 10 Questions

Question 1

A DevOps engineer wants to build a CI/CD pipeline that automatically builds and tests code every time a developer pushes a new branch to a Git repository. Which Cloud Build trigger type should they use?

Accepted Answer

Push to any branch trigger. Option C is correct because a 'Push to any branch' trigger in Cloud Build automatically initiates a build whenever a developer pushes code to any branch in the repository. This matches the requirement to build and test code on every new branch push, without manual intervention or branch-specific filters.

Answer

Scheduled trigger

Answer

Manual trigger

Answer

Pull request trigger

Question 2

A team uses Cloud Build to build a Docker image and push it to Artifact Registry. They need to cache Docker layers to speed up subsequent builds. The build runs on a private pool with access to a VPC. Which caching approach should they implement in cloudbuild.yaml?

Accepted Answer

Kaniko layer caching with cache repository in Artifact Registry. Kaniko layer caching with a cache repository in Artifact Registry is the recommended method for Cloud Build. It stores intermediate layers and reuses them when unchanged. Docker cache import/export requires a persistent volume, which is not native to Cloud Build.

Answer

Build images with --no-cache flag to ensure consistency

Answer

Docker cache import/export with a GCS bucket

Answer

Use BuildKit with inline cache

Question 3

An engineer configures Cloud Deploy to promote a container to production after manual approval. The deployment strategy must gradually shift traffic from the current version to the new version while monitoring error rates. Which deployment strategy should they select in the delivery pipeline?

Accepted Answer

Canary. Canary deployment is the correct choice because it gradually shifts traffic from the current version to the new version while allowing monitoring of error rates. In Cloud Deploy, a canary strategy uses a sequence of phases (e.g., 10%, 50%, 100%) to incrementally route traffic, enabling real-time observability and automated rollback if error thresholds are breached.

Answer

Blue/green

Answer

Rollback

Answer

Standard

Question 4

A company uses Cloud Build to deploy to Cloud Run. They need to test a new revision with a specific tag without serving any live traffic. After validation, they want to shift 10% of traffic to the new revision. Which two gcloud commands should they use?

Accepted Answer

gcloud run deploy --image ... --no-traffic --tag=test; gcloud run services update-traffic ... --to-revisions=test=10. Option A is correct because the `--no-traffic` flag deploys the new revision without routing any live traffic to it, while `--tag=test` assigns a specific tag (e.g., 'test') that allows direct URL-based validation. The second command `gcloud run services update-traffic --to-revisions=test=10` then shifts exactly 10% of traffic to that tagged revision, enabling a gradual rollout. This two-step approach ensures the revision is validated before receiving production traffic.

Answer

gcloud run deploy --image ... --no-traffic; gcloud run services update-traffic ... --to-latest=10

Answer

gcloud run deploy --image ... --traffic=10%; gcloud run revisions delete

Answer

gcloud run deploy --image ... --tag=test; gcloud run services update-traffic ... --to-revisions=test=100

Question 5

A team wants to adopt GitOps for a GKE cluster. They need a solution that automatically syncs their Kubernetes manifests from a Git repository to the cluster and ensures the cluster state matches the repo. Which Google Cloud service should they use?

Accepted Answer

Config Sync. Config Sync is the correct choice because it is the native GitOps agent within Google Cloud's Anthos platform, designed specifically to continuously reconcile the state of a GKE cluster with Kubernetes manifests stored in a Git repository. It automatically detects changes in the configured source of truth and applies them to the cluster, ensuring drift is corrected without manual intervention.

Answer

Config Connector

Answer

Cloud Deploy

Answer

Argo CD on GKE

Question 6

An engineer is configuring a Cloud Build trigger for a Java application. The build step uses Maven to compile and test, then builds a Docker image. Which cloudbuild.yaml step configuration is CORRECT for specifying the Maven command?

Accepted Answer

steps:
- name: 'maven:3'
  args: ['mvn', 'clean', 'package']. Option A is correct because Cloud Build expects the `args` field to contain the command and its arguments when the default entrypoint of the container image is used. The `maven:3` image has `mvn` as its default entrypoint, so specifying `args: ['mvn', 'clean', 'package']` correctly invokes Maven to compile, test, and package the Java application.

Answer

steps:
- name: 'maven:3'
  entrypoint: 'bash'
  args: ['mvn', 'clean', 'package']

Answer

steps:
- name: 'maven:3'
  script: 'mvn clean package'

Answer

steps:
- name: 'maven:3'
  entrypoint: 'mvn'
  args: ['clean', 'package']

Question 7

A team uses Cloud Build with a private pool to build a Docker image that requires access to a Cloud SQL instance. The build fails because the builder cannot connect to the database. The network configuration uses VPC Service Controls. What is the MOST likely cause and solution?

Accepted Answer

The private pool is not peered with the VPC containing Cloud SQL; set up VPC peering.. The most likely cause is that the private pool's underlying VPC is not peered with the VPC that hosts the Cloud SQL instance. Cloud Build private pools run in a Google-managed VPC, and to access resources in your own VPC (such as Cloud SQL), you must establish VPC peering between the two. Without this peering, the builder cannot route traffic to the Cloud SQL instance, even if VPC Service Controls are configured correctly.

Answer

Cloud SQL requires public IP; change to public IP and allowlist the builder's IP.

Answer

The Cloud Build service account lacks the Cloud SQL Client role; grant the role.

Answer

The private pool is in a different region; move the pool or Cloud SQL to the same region.

Question 8

A company uses Artifact Registry to store Docker images. They want to enforce that only images signed by a trusted authority can be deployed to their GKE cluster. Which service should they use with Artifact Registry?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment-time policy based on image signatures. Container Analysis scans for vulnerabilities, not enforcements; IAM controls access; Cloud Build is the CI service.

Answer

Identity and Access Management (IAM)

Answer

Container Analysis

Answer

Cloud Build

Question 9

An engineer is building a CI/CD pipeline for a microservice that uses feature flags via LaunchDarkly. They want to automatically enable a new feature flag in a staging environment after deployment, but not in production. How should they integrate this into Cloud Deploy?

Accepted Answer

Configure a postDeploy hook in Cloud Deploy that invokes a Cloud Run Job to enable the flag. Option C is correct because Cloud Deploy's postDeploy hooks allow you to run a Cloud Run Job after a rollout completes, which can call the LaunchDarkly REST API to enable the flag specifically for the staging target. This integrates flag management directly into the pipeline without manual steps or exposing production flags.

Answer

Use a Cloud Build step after deployment to call LaunchDarkly API

Answer

Enable the flag manually in LaunchDarkly after deployment

Answer

Use a Kubernetes ConfigMap to hold flag state, and have the app read it

Question 10

A team uses Cloud Build to deploy a Python service to Cloud Run. They need to ensure the service uses a custom domain and only accepts HTTPS traffic. Which flags should they include in the gcloud run deploy command?

Accepted Answer

No flags related to custom domain; use gcloud beta run domain-mappings create separately. Option D is correct because the `gcloud run deploy` command does not include flags for mapping a custom domain. Custom domain mapping is a separate step that must be performed using the `gcloud beta run domain-mappings create` command (or via the Cloud Run console). The `--ingress` flag controls traffic routing (e.g., all, internal, internal-and-cloud-load-balancing), not domain configuration, and HTTPS is enforced by default on Cloud Run services.

Answer

--ingress=internal --platform=managed

Answer

--ingress=all --allow-unauthenticated

Answer

--ingress=all --no-allow-unauthenticated