PCDE Building and Implementing CI/CD Pipelines for a Service — 20 Questions

Question 1

A DevOps engineer wants to build a CI/CD pipeline that automatically builds and tests code every time a developer pushes a new branch to a Git repository. Which Cloud Build trigger type should they use?

Accepted Answer

Push to any branch trigger. Option C is correct because a 'Push to any branch' trigger in Cloud Build automatically initiates a build whenever a developer pushes code to any branch in the repository. This matches the requirement to build and test code on every new branch push, without manual intervention or branch-specific filters.

Answer

Scheduled trigger

Answer

Manual trigger

Answer

Pull request trigger

Question 2

A team uses Cloud Build to build a Docker image and push it to Artifact Registry. They need to cache Docker layers to speed up subsequent builds. The build runs on a private pool with access to a VPC. Which caching approach should they implement in cloudbuild.yaml?

Accepted Answer

Kaniko layer caching with cache repository in Artifact Registry. Kaniko layer caching with a cache repository in Artifact Registry is the recommended method for Cloud Build. It stores intermediate layers and reuses them when unchanged. Docker cache import/export requires a persistent volume, which is not native to Cloud Build.

Answer

Build images with --no-cache flag to ensure consistency

Answer

Docker cache import/export with a GCS bucket

Answer

Use BuildKit with inline cache

Question 3

An engineer configures Cloud Deploy to promote a container to production after manual approval. The deployment strategy must gradually shift traffic from the current version to the new version while monitoring error rates. Which deployment strategy should they select in the delivery pipeline?

Accepted Answer

Canary. Canary deployment is the correct choice because it gradually shifts traffic from the current version to the new version while allowing monitoring of error rates. In Cloud Deploy, a canary strategy uses a sequence of phases (e.g., 10%, 50%, 100%) to incrementally route traffic, enabling real-time observability and automated rollback if error thresholds are breached.

Answer

Blue/green

Answer

Rollback

Answer

Standard

Question 4

A company uses Cloud Build to deploy to Cloud Run. They need to test a new revision with a specific tag without serving any live traffic. After validation, they want to shift 10% of traffic to the new revision. Which two gcloud commands should they use?

Accepted Answer

gcloud run deploy --image ... --no-traffic --tag=test; gcloud run services update-traffic ... --to-revisions=test=10. Option A is correct because the `--no-traffic` flag deploys the new revision without routing any live traffic to it, while `--tag=test` assigns a specific tag (e.g., 'test') that allows direct URL-based validation. The second command `gcloud run services update-traffic --to-revisions=test=10` then shifts exactly 10% of traffic to that tagged revision, enabling a gradual rollout. This two-step approach ensures the revision is validated before receiving production traffic.

Answer

gcloud run deploy --image ... --no-traffic; gcloud run services update-traffic ... --to-latest=10

Answer

gcloud run deploy --image ... --traffic=10%; gcloud run revisions delete

Answer

gcloud run deploy --image ... --tag=test; gcloud run services update-traffic ... --to-revisions=test=100

Question 5

A team wants to adopt GitOps for a GKE cluster. They need a solution that automatically syncs their Kubernetes manifests from a Git repository to the cluster and ensures the cluster state matches the repo. Which Google Cloud service should they use?

Accepted Answer

Config Sync. Config Sync is the correct choice because it is the native GitOps agent within Google Cloud's Anthos platform, designed specifically to continuously reconcile the state of a GKE cluster with Kubernetes manifests stored in a Git repository. It automatically detects changes in the configured source of truth and applies them to the cluster, ensuring drift is corrected without manual intervention.

Answer

Config Connector

Answer

Cloud Deploy

Answer

Argo CD on GKE

Question 6

An engineer is configuring a Cloud Build trigger for a Java application. The build step uses Maven to compile and test, then builds a Docker image. Which cloudbuild.yaml step configuration is CORRECT for specifying the Maven command?

Accepted Answer

steps:
- name: 'maven:3'
  args: ['mvn', 'clean', 'package']. Option A is correct because Cloud Build expects the `args` field to contain the command and its arguments when the default entrypoint of the container image is used. The `maven:3` image has `mvn` as its default entrypoint, so specifying `args: ['mvn', 'clean', 'package']` correctly invokes Maven to compile, test, and package the Java application.

Answer

steps:
- name: 'maven:3'
  entrypoint: 'bash'
  args: ['mvn', 'clean', 'package']

Answer

steps:
- name: 'maven:3'
  script: 'mvn clean package'

Answer

steps:
- name: 'maven:3'
  entrypoint: 'mvn'
  args: ['clean', 'package']

Question 7

A team uses Cloud Build with a private pool to build a Docker image that requires access to a Cloud SQL instance. The build fails because the builder cannot connect to the database. The network configuration uses VPC Service Controls. What is the MOST likely cause and solution?

Accepted Answer

The private pool is not peered with the VPC containing Cloud SQL; set up VPC peering.. The most likely cause is that the private pool's underlying VPC is not peered with the VPC that hosts the Cloud SQL instance. Cloud Build private pools run in a Google-managed VPC, and to access resources in your own VPC (such as Cloud SQL), you must establish VPC peering between the two. Without this peering, the builder cannot route traffic to the Cloud SQL instance, even if VPC Service Controls are configured correctly.

Answer

Cloud SQL requires public IP; change to public IP and allowlist the builder's IP.

Answer

The Cloud Build service account lacks the Cloud SQL Client role; grant the role.

Answer

The private pool is in a different region; move the pool or Cloud SQL to the same region.

Question 8

A company uses Artifact Registry to store Docker images. They want to enforce that only images signed by a trusted authority can be deployed to their GKE cluster. Which service should they use with Artifact Registry?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment-time policy based on image signatures. Container Analysis scans for vulnerabilities, not enforcements; IAM controls access; Cloud Build is the CI service.

Answer

Identity and Access Management (IAM)

Answer

Container Analysis

Answer

Cloud Build

Question 9

An engineer is building a CI/CD pipeline for a microservice that uses feature flags via LaunchDarkly. They want to automatically enable a new feature flag in a staging environment after deployment, but not in production. How should they integrate this into Cloud Deploy?

Accepted Answer

Configure a postDeploy hook in Cloud Deploy that invokes a Cloud Run Job to enable the flag. Option C is correct because Cloud Deploy's postDeploy hooks allow you to run a Cloud Run Job after a rollout completes, which can call the LaunchDarkly REST API to enable the flag specifically for the staging target. This integrates flag management directly into the pipeline without manual steps or exposing production flags.

Answer

Use a Cloud Build step after deployment to call LaunchDarkly API

Answer

Enable the flag manually in LaunchDarkly after deployment

Answer

Use a Kubernetes ConfigMap to hold flag state, and have the app read it

Question 10

A team uses Cloud Build to deploy a Python service to Cloud Run. They need to ensure the service uses a custom domain and only accepts HTTPS traffic. Which flags should they include in the gcloud run deploy command?

Accepted Answer

No flags related to custom domain; use gcloud beta run domain-mappings create separately. Option D is correct because the `gcloud run deploy` command does not include flags for mapping a custom domain. Custom domain mapping is a separate step that must be performed using the `gcloud beta run domain-mappings create` command (or via the Cloud Run console). The `--ingress` flag controls traffic routing (e.g., all, internal, internal-and-cloud-load-balancing), not domain configuration, and HTTPS is enforced by default on Cloud Run services.

Answer

--ingress=internal --platform=managed

Answer

--ingress=all --allow-unauthenticated

Answer

--ingress=all --no-allow-unauthenticated

Question 11

A company uses Cloud Build to build a multi-module Maven project. They want to run unit tests for module A and integration tests for module B in parallel. In cloudbuild.yaml, how should they configure the steps to run in parallel?

Accepted Answer

steps:
- id: 'unit'
  waitFor: ['-']
  ...
- id: 'integration'
  waitFor: ['-']
  .... Option A is correct because in Cloud Build, setting `waitFor: ['-']` on a step makes it start immediately without waiting for any other step, effectively allowing both the 'unit' and 'integration' steps to run in parallel. This configuration meets the requirement to run unit tests for module A and integration tests for module B concurrently.

Answer

steps:
- id: 'unit'
  ...
- id: 'integration'
  waitFor: ['-']
  ...

Answer

steps:
- id: 'unit'
  waitFor: ['previous']
  ...
- id: 'integration'
  waitFor: ['unit']
  ...

Answer

Steps run sequentially by default; parallelism is not supported.

Question 12

A developer needs to push a Docker image to Artifact Registry from their local machine. They have installed the gcloud CLI. Which command should they run first to authenticate Docker with Artifact Registry?

Accepted Answer

gcloud auth configure-docker. gcloud auth configure-docker configures Docker to use gcloud as a credential helper for all supported registries. gcloud auth login authenticates the user but does not configure Docker.

Answer

gcloud container clusters get-credentials

Answer

gcloud auth login

Answer

docker login -u oauth2accesstoken -p "$(gcloud auth print-access-token)" https://LOCATION-docker.pkg.dev

Question 13

A company uses Cloud Deploy for a CD pipeline to Cloud Run. They want to implement a canary deployment that automatically rolls back if the error rate increases by more than 5% during the canary phase. Which TWO actions should they take?

Accepted Answer

Configure a canary deployment strategy in the delivery pipeline with phases and metrics. Option B is correct because Cloud Deploy's canary strategy allows you to define phases with specific metrics (e.g., error rate) that are evaluated during the rollout. If the error rate exceeds the defined threshold (e.g., 5% increase), Cloud Deploy automatically rolls back the canary without manual intervention. This is configured in the delivery pipeline YAML under the `strategy` section with `canary` and `phases`.

Answer

Use a blue/green strategy instead, as it supports automatic rollback

Answer

Delegate rollback to the developer who must manually approve or reject

Answer

Set up a preDeploy hook to run a load test

Question 14

A team uses Cloud Build to build and deploy a Go application to GKE. They need to inject the Git commit SHA as an environment variable in the deployment. Which THREE steps should they take?

Accepted Answer

Grant the Cloud Build service account permission to update the Deployment. Option A is correct because the Cloud Build service account needs the `container.deployments.update` permission (or a role like `roles/container.developer`) to modify the Deployment object in GKE. Without this IAM permission, the `kubectl set env` command in the build step will fail with a forbidden error, even if the image was successfully deployed.

Answer

Use Cloud Deploy instead of kubectl

Answer

Create a new Docker image tag with the commit SHA

Question 15

A company wants to enforce that only approved images from Artifact Registry can be deployed to their GKE clusters. They also want to ensure that images are scanned for vulnerabilities. Which TWO services should they use together?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment policies based on attestations; Container Analysis scans images for vulnerabilities. Artifact Registry stores images; Cloud Build builds them; IAM controls access.

Answer

Cloud IAM

Answer

Cloud Build

Answer

Artifact Registry

Question 16

An engineering team wants to automatically build a Docker image every time a developer pushes code to the main branch of their GitHub repository. They are using Cloud Build. Which configuration should they use?

Accepted Answer

Cloud Build trigger with push event and branch pattern 'main'. Cloud Build build triggers can be configured to respond to push events on a branch. The trigger is created in the Cloud Console or via gcloud and specifies the repository and branch pattern.

Answer

Cloud Build trigger with manual invocation

Answer

Cloud Build trigger with scheduled event

Answer

Cloud Build trigger with pull request event

Question 17

A developer needs to authenticate to Artifact Registry from a CI/CD pipeline that runs on Compute Engine. The pipeline does not have access to user credentials. Which authentication method should they use?

Accepted Answer

Configure Workload Identity on the Compute Engine VM. Workload Identity allows a Compute Engine VM to act as a service account without needing to manage keys. The VM's service account can be granted permissions to access Artifact Registry.

Answer

Create a service account key and store it in Cloud Storage

Answer

Use a personal access token in the pipeline

Answer

Use gcloud auth login with a user account

Question 18

A team uses Cloud Deploy to manage deployments to GKE. They want to automatically roll back to the previous revision if a canary deployment fails health checks. What should they configure?

Accepted Answer

Set 'rollback-on-failure: true' in the delivery pipeline definition. Cloud Deploy supports automatic rollback on failure for canary deployments by setting `rollback-on-failure: true` in the delivery pipeline definition. When a canary deployment fails health checks, Cloud Deploy automatically reverts to the previous stable revision without manual intervention, ensuring minimal downtime and consistent release governance.

Answer

Configure a manual approval gate before promotion

Answer

Set the deployment strategy to blue/green

Answer

Use a Cloud Build step to run kubectl rollout undo

Question 19

A company wants to enforce that only container images signed by their CI/CD pipeline can be deployed to GKE. Which two services should they use together?

Accepted Answer

Binary Authorization and Container Analysis. Binary Authorization enforces that only container images signed by trusted authorities (like a CI/CD pipeline) can be deployed to GKE. Container Analysis (now part of Artifact Analysis) scans images for vulnerabilities and stores attestations, which Binary Authorization uses to verify signatures before allowing deployment. Together, they provide a complete enforcement chain: signing during CI/CD and verification at deploy time.

Answer

Cloud Build and Artifact Registry

Answer

Security Command Center and Artifact Registry

Answer

Cloud Deploy and Cloud Run

Question 20

A DevOps engineer is configuring a Cloud Build pipeline that needs to deploy to a Cloud Run service in a VPC Service Controls perimeter. The build must access resources within the VPC. What should they use?

Accepted Answer

Configure Cloud Build to use a private pool in the same VPC. Cloud Build private pools run in your VPC, allowing access to internal resources. This is required when the build needs to interact with resources protected by VPC Service Controls.

Answer

Use Cloud Build with a Shared VPC

Answer

Use Cloud Build public pool with a service account

Answer

Add a NAT gateway to the project