PCDE Building and Implementing CI/CD Pipelines for a Service Practice Test 2 — 15 Questions

Question 1

An engineering team wants to automatically build a Docker image every time a developer pushes code to the main branch of their GitHub repository. They are using Cloud Build. Which configuration should they use?

Accepted Answer

Cloud Build trigger with push event and branch pattern 'main'. Cloud Build build triggers can be configured to respond to push events on a branch. The trigger is created in the Cloud Console or via gcloud and specifies the repository and branch pattern.

Answer

Cloud Build trigger with manual invocation

Answer

Cloud Build trigger with scheduled event

Answer

Cloud Build trigger with pull request event

Question 2

A developer needs to authenticate to Artifact Registry from a CI/CD pipeline that runs on Compute Engine. The pipeline does not have access to user credentials. Which authentication method should they use?

Accepted Answer

Configure Workload Identity on the Compute Engine VM. Workload Identity allows a Compute Engine VM to act as a service account without needing to manage keys. The VM's service account can be granted permissions to access Artifact Registry.

Answer

Create a service account key and store it in Cloud Storage

Answer

Use a personal access token in the pipeline

Answer

Use gcloud auth login with a user account

Question 3

A team uses Cloud Deploy to manage deployments to GKE. They want to automatically roll back to the previous revision if a canary deployment fails health checks. What should they configure?

Accepted Answer

Set 'rollback-on-failure: true' in the delivery pipeline definition. Cloud Deploy supports automatic rollback on failure for canary deployments by setting `rollback-on-failure: true` in the delivery pipeline definition. When a canary deployment fails health checks, Cloud Deploy automatically reverts to the previous stable revision without manual intervention, ensuring minimal downtime and consistent release governance.

Answer

Configure a manual approval gate before promotion

Answer

Set the deployment strategy to blue/green

Answer

Use a Cloud Build step to run kubectl rollout undo

Question 4

A company wants to enforce that only container images signed by their CI/CD pipeline can be deployed to GKE. Which two services should they use together?

Accepted Answer

Binary Authorization and Container Analysis. Binary Authorization enforces that only container images signed by trusted authorities (like a CI/CD pipeline) can be deployed to GKE. Container Analysis (now part of Artifact Analysis) scans images for vulnerabilities and stores attestations, which Binary Authorization uses to verify signatures before allowing deployment. Together, they provide a complete enforcement chain: signing during CI/CD and verification at deploy time.

Answer

Cloud Build and Artifact Registry

Answer

Security Command Center and Artifact Registry

Answer

Cloud Deploy and Cloud Run

Question 5

A DevOps engineer is configuring a Cloud Build pipeline that needs to deploy to a Cloud Run service in a VPC Service Controls perimeter. The build must access resources within the VPC. What should they use?

Accepted Answer

Configure Cloud Build to use a private pool in the same VPC. Cloud Build private pools run in your VPC, allowing access to internal resources. This is required when the build needs to interact with resources protected by VPC Service Controls.

Answer

Use Cloud Build with a Shared VPC

Answer

Use Cloud Build public pool with a service account

Answer

Add a NAT gateway to the project

Question 6

A team uses Skaffold for local development and wants to integrate it into their CI/CD pipeline on Cloud Build for continuous deployment to GKE. What is the recommended approach?

Accepted Answer

Use 'skaffold run' in a Cloud Build step. Skaffold can be run as a step in cloudbuild.yaml. It handles building, tagging, and deploying based on skaffold.yaml configuration. Using 'skaffold run' in a Cloud Build step is the standard integration.

Answer

Use Cloud Build's built-in kubectl deployer

Answer

Run 'skaffold dev' in the Cloud Build step

Answer

Convert skaffold.yaml to a Helm chart

Question 7

An organization uses Config Sync to manage Kubernetes resources across multiple GKE clusters. They want to automatically remediate configuration drift. What must they ensure?

Accepted Answer

Use a GitOps tool like Config Sync with 'sync-mode' set to 'force'. Config Sync's 'sync-mode' set to 'force' ensures that any manual changes to the cluster (configuration drift) are automatically reverted to match the desired state defined in the Git repository. This mode overwrites any modifications made outside of Config Sync, enforcing strict reconciliation. Without 'force', Config Sync may detect drift but not automatically correct it, leaving the cluster in a non-compliant state.

Answer

Set the Config Sync policy to 'allow-drift'

Answer

Enable 'sync' and set 'sync-repo' to the desired repository

Answer

Configure 'source-format' as 'structured'

Question 8

A developer wants to deploy a containerized application to Cloud Run with a requirement that the service has at least 2 instances always running to handle low-latency requests. Which flag should they use with gcloud run deploy?

Accepted Answer

--min-instances=2. Option C is correct because the `--min-instances` flag in `gcloud run deploy` specifies the minimum number of container instances that must remain warm and ready to serve requests at all times. Setting `--min-instances=2` ensures Cloud Run keeps at least two instances always running, which eliminates cold starts and guarantees low-latency responses for incoming traffic.

Answer

--concurrency=2

Answer

--cpu-throttling

Answer

--max-instances=2

Question 9

A CI/CD pipeline uses Cloud Build to build a Docker image. The Dockerfile copies dependencies from a private repository in the same VPC. The build takes a long time due to repeated downloads. How can the engineer optimize the build?

Accepted Answer

Enable Kaniko layer caching and push cache to Artifact Registry. Option C is correct because Kaniko layer caching stores intermediate Docker image layers in Artifact Registry, allowing subsequent builds to reuse cached layers instead of re-downloading dependencies from the private repository. This directly addresses the repeated downloads causing long build times, as Kaniko checks the cache before executing each RUN command in the Dockerfile.

Answer

Use a larger machine type

Answer

Increase the build timeout

Answer

Use Cloud Build's local SSD for temporary storage

Question 10

A team uses Cloud Deploy with a canary deployment strategy to GKE. They want to automatically promote the canary to full production if the error rate is below 1% for 10 minutes. What should they configure?

Accepted Answer

Configure a canary deployment with a metric threshold in clouddeploy.yaml. Option D is correct because Cloud Deploy supports canary deployments with automated promotion based on metric thresholds defined in the `clouddeploy.yaml` configuration. By specifying a metric threshold (e.g., error rate < 1% for 10 minutes) under the `canaryDeployment` strategy, Cloud Deploy can automatically promote the canary to full production without manual intervention or external scripts.

Answer

Use a Cloud Build step to check error rates

Answer

Use a manual approval gate

Answer

Set the deployment strategy to blue/green

Question 11

An engineer needs to create a build trigger in Cloud Build that runs tests on every pull request to the 'develop' branch. They also want to prevent the build from running if the PR is from a forked repository. What should they do?

Accepted Answer

Use a Cloud Build filter to ignore fork PRs. Cloud Build triggers can be configured to ignore pull requests from forked repositories by setting the 'ignore pull request from forks' option in the trigger configuration.

Answer

Create a trigger with pull request event and branch pattern 'develop'

Answer

Use a separate repository for external contributions

Answer

Add a condition in cloudbuild.yaml to skip if fork

Question 12

A company uses Cloud Build to build and deploy microservices to GKE. Each microservice has environment-specific configurations (dev, staging, prod). They want to manage these configurations using Kustomize. How should they structure the pipeline?

Accepted Answer

Use a single cloudbuild.yaml with kustomize build command and pass the environment as a substitution. Kustomize allows overlays for different environments. The cloudbuild.yaml can use the kustomize builder to apply the appropriate overlay based on a substitution variable like $_ENV.

Answer

Store all configurations in separate branches

Answer

Use Helm charts with different values files

Answer

Create separate cloudbuild.yaml files for each environment

Question 13

A team wants to implement a GitOps workflow for deploying applications to GKE. They want to use a tool that continuously reconciles the cluster state with a Git repository. Which TWO tools can they use? (Select TWO)

Accepted Answer

Argo CD. Argo CD is a declarative GitOps tool that continuously monitors a Git repository and automatically reconciles the cluster state to match the desired state defined in the repository. It directly supports the GitOps workflow requirement by polling or using webhooks to detect changes and applying them to GKE clusters.

Answer

Cloud Deploy

Answer

Cloud Build

Answer

Skaffold

Question 14

An organization wants to enforce security policies on container images before deployment. They need to scan images for vulnerabilities and ensure only images that pass the scan can be deployed. Which TWO services should they use? (Select TWO)

Accepted Answer

Container Analysis. Container Analysis scans images for vulnerabilities. Binary Authorization enforces policies that require images to have attestations (e.g., from Container Analysis) before deployment.

Answer

Artifact Registry

Answer

Cloud Build

Answer

Cloud Deploy

Question 15

A DevOps engineer is designing a CI/CD pipeline for a Cloud Run service. They need to implement a canary deployment that sends 10% of traffic to a new revision initially, then gradually increases to 100% if metrics are healthy. They also need to roll back instantly if the canary fails. Which THREE configurations should they use? (Select THREE)

Accepted Answer

Configure Cloud Deploy with a canary strategy and metric thresholds. Option A is correct because Cloud Deploy supports canary deployments with automated metric thresholds (e.g., latency, error rate) that control traffic progression. This allows the pipeline to gradually shift from 10% to 100% traffic based on real-time health checks, enabling automated rollback if thresholds are breached.

Answer

Use gcloud run deploy with --no-traffic to deploy the new revision without receiving traffic

Answer

Use a manual approval gate in Cloud Deploy