PCDE Building and Implementing CI/CD Pipelines for a Service Practice Test 3 — 15 Questions

Question 1

A DevOps engineer wants to trigger a Cloud Build pipeline automatically whenever a developer pushes a new Git tag in the format 'v*.*.*'. Which trigger configuration should be used?

Accepted Answer

Set the trigger event to 'Push a tag' with tag regex 'v.*'.. Cloud Build supports tag triggers that fire when a Git tag matching a regex is pushed. This is the correct way to trigger on tag creation.

Answer

Use a manual trigger invoked via gcloud builds submit --tag.

Answer

Set the trigger event to 'Pull request' and check the 'Ignore tags' box.

Answer

Set the trigger event to 'Push to a branch' with branch regex 'v*.*.*'.

Question 2

You are configuring a Cloud Build pipeline that builds a Docker image, pushes it to Artifact Registry, and deploys to Cloud Run. The build requires network access to a private VPC to download dependencies. Which approach should you use to provide VPC access?

Accepted Answer

Create a Cloud Build private pool connected to the VPC, and run the build using that pool.. Option C is correct because Cloud Build private pools provide direct VPC connectivity by running worker VMs inside a customer-managed subnet within the specified VPC. This allows the build to access private resources (e.g., dependency mirrors, internal repositories) without traversing the public internet, meeting the requirement for network access to a private VPC.

Answer

Add the VPC firewall rule to allow traffic from Cloud Build's default IP range.

Answer

Use the default Cloud Build pool and configure VPC peering in the build steps.

Answer

Use Cloud NAT to allow egress from the default pool to the VPC.

Question 3

A team uses Cloud Deploy with a delivery pipeline that deploys to GKE clusters across dev, staging, and prod targets. They want to automatically roll back a release if the canary deployment in staging fails to meet a defined service-level objective (SLO) for error rate. Which Cloud Deploy feature enables this?

Accepted Answer

Configure canary deployment with the '--canary-percentage' flag and enable SLO verification in the delivery pipeline.. Option B is correct because Cloud Deploy's canary deployment strategy supports SLO verification via the `--canary-percentage` flag combined with a `canaryDeployment` configuration that includes a `verify` phase. This allows the pipeline to automatically roll back the release if the canary fails to meet the defined error rate SLO, without manual intervention or external services.

Answer

Use preDeploy and postDeploy hooks to run Cloud Run jobs that check error rate and roll back.

Answer

Use Binary Authorization with a custom attestor that checks error rate.

Answer

Set an approval gate on the staging target that requires manual review.

Question 4

A developer wants to use a pre-existing Docker image from Artifact Registry in a Cloud Build step. How should they authenticate the build step to pull the image?

Accepted Answer

Use a Docker step with the image specified directly; Cloud Build automatically uses its service account.. Option D is correct because Cloud Build's default service account is automatically granted the Artifact Registry Reader role (roles/artifactregistry.reader) when the Cloud Build API is enabled in a project. This means any build step that references an image from Artifact Registry can pull it without explicit authentication, as Cloud Build uses its own service account credentials to authenticate the pull request to the registry.

Answer

Run 'gcloud auth configure-docker' in a build step.

Answer

Set the environment variable 'ARTIFACT_REGISTRY_KEY' in the build step.

Answer

Store a service account key in Secret Manager and activate it in the build step.

Question 5

A company uses Cloud Build to build a container image with Kaniko. They want to speed up builds by caching the base image layers. Which configuration should they add to their cloudbuild.yaml?

Accepted Answer

Add '--cache=true' and '--cache-repo=us-central1-docker.pkg.dev/$PROJECT_ID/cache' to the Kaniko builder arguments.. Kaniko does not rely on the Docker daemon, so it cannot use Docker's native layer caching. Instead, Kaniko supports remote caching by pushing cached layers to a container registry. Adding `--cache=true` enables layer caching, and `--cache-repo` specifies the registry repository where cached base image layers are stored, allowing subsequent builds to reuse them and significantly reduce build time.

Answer

Add a 'docker pull' step before the Kaniko step to pre-pull the base image.

Answer

Use Docker's --layer-cache flag in the build step.

Answer

Configure Cloud Build to use a private pool with SSD persistent disks.

Question 6

You are deploying a containerized application to Cloud Run using gcloud run deploy. You need to ensure that revisions are tagged with a custom identifier for testing purposes, without allocating any traffic to them. Which flag should you use?

Accepted Answer

--tag=test. The `--tag` flag in `gcloud run deploy` assigns a custom tag (e.g., `test`) to a specific revision, allowing it to be accessed via a dedicated URL without receiving any live traffic. This is the correct way to create a tagged revision for testing or staging purposes while keeping the primary revision serving user requests.

Answer

--no-traffic

Answer

--traffic=test=0

Answer

--revision-suffix=test

Question 7

An organization uses Binary Authorization with Container Analysis to enforce that only images that have passed vulnerability scanning and have been signed by an approved authority can be deployed to GKE. A DevOps engineer notices that an unsigned image is still being deployed. What is the most likely cause?

Accepted Answer

The Binary Authorization admission controller is not enabled on the GKE cluster.. Option D is correct because Binary Authorization enforcement requires the admission controller to be enabled on the GKE cluster. Without the admission controller, the cluster will not intercept pod creation requests to verify image attestations, so unsigned images can be deployed regardless of the Binary Authorization policy configuration.

Answer

The Build service account does not have the signer role.

Answer

The image is stored in a different project than the one where Binary Authorization is configured.

Answer

The Container Analysis API is not enabled in the project.

Question 8

A team uses Kustomize to manage environment-specific configurations for their GKE deployments. They have a base overlay and overlays for dev, staging, and prod. Which command should they use to generate the final Kubernetes manifests for the staging environment?

Accepted Answer

kustomize build staging/. The `kustomize build staging/` command processes the Kustomize overlay located in the `staging/` directory, which includes a `kustomization.yaml` file that references the base overlay and applies environment-specific patches, configMapGenerator entries, and namespace settings. This generates the final Kubernetes manifests for the staging environment without applying them to a cluster. The `kustomize` CLI tool is the standard way to render Kustomize overlays, and it is the correct command for generating manifests as part of a CI/CD pipeline.

Answer

kubectl kustomize staging/

Answer

skaffold build --kustomize staging/

Answer

kubectl apply -k staging/

Question 9

An engineer wants to deploy a set of GCP resources (e.g., Cloud SQL, Pub/Sub topics) alongside their Kubernetes workloads using a GitOps approach with Config Connector. What is the primary benefit of using Config Connector over deploying these resources manually?

Accepted Answer

It allows managing GCP resources using Kubernetes-style YAML, enabling version control and CI/CD for infrastructure.. Config Connector allows you to manage GCP resources (e.g., Cloud SQL, Pub/Sub topics) using Kubernetes-style YAML manifests. This enables GitOps workflows where infrastructure definitions are stored in a Git repository, version-controlled, and automatically applied via CI/CD pipelines, ensuring consistency and auditability.

Answer

It automatically scales GCP resources based on load.

Answer

It provides a graphical UI for managing GCP resources.

Answer

It reduces the cost of GCP resources by using committed use discounts.

Question 10

You are designing a CI/CD pipeline for a microservice application that uses feature flags to decouple deployment from release. The team wants to automatically enable a feature flag after the deployment is verified in production for a subset of users. Which tool or approach should you integrate into the pipeline to manage feature flags?

Accepted Answer

Use Cloud Deploy hooks to call the LaunchDarkly API after the deployment succeeds.. Option D is correct because it uses Cloud Deploy hooks to trigger a post-deployment action that calls the LaunchDarkly API, enabling the feature flag for a subset of users after the deployment has been verified in production. This decouples deployment from release, allowing the feature flag to be toggled dynamically without redeploying or modifying the application code.

Answer

Embed the feature flag logic in the application code and use environment variables to enable it.

Answer

Use Cloud Build substitution variables to set the feature flag status at build time.

Answer

Use Config Sync to update a ConfigMap with the flag status.

Question 11

A company uses Cloud Build with GitHub triggers. The build pipeline runs tests, builds a Docker image, and pushes it to Artifact Registry. Recently, builds started failing with '403 Forbidden' when pushing to Artifact Registry. The Cloud Build service account has the Artifact Registry Writer role. What else could be causing the failure?

Accepted Answer

The Artifact Registry API is not enabled in the project.. Option D is correct because if the Artifact Registry API is not enabled for the project, any attempt to push a Docker image to Artifact Registry will fail with a 403 Forbidden error, regardless of the service account's IAM roles. The Cloud Build service account may have the Artifact Registry Writer role, but without the underlying API enabled, the service cannot interact with the Artifact Registry service at all. Enabling the `artifactregistry.googleapis.com` API is a prerequisite for any API calls to succeed.

Answer

The Docker credential helper is not configured in the build step.

Answer

The repository is in a different region than the Cloud Build worker.

Answer

The Cloud Build service account does not have the 'iam.serviceAccountUser' role on the Compute Engine default service account.

Question 12

A DevOps engineer wants to implement a GitOps workflow for a GKE cluster using a tool that automatically syncs the cluster state with a Git repository. Which Google Cloud service is designed for this purpose?

Accepted Answer

Config Sync. Config Sync is the Google Cloud service specifically designed to implement a GitOps workflow for GKE clusters. It automatically synchronizes the cluster's desired state (as defined in a Git repository) with the actual cluster state, ensuring continuous reconciliation without manual intervention.

Answer

Cloud Run

Answer

Config Connector

Answer

Cloud Deploy

Question 13

A company wants to implement a CI/CD pipeline for a multi-service application where each service is built from a separate repository. They need to run unit tests, build container images, and deploy to both Cloud Run and GKE. Which two Google Cloud services should be combined to achieve this?

Accepted Answer

Cloud Build. Cloud Build is correct because it is a fully managed CI/CD platform that can pull source code from multiple repositories (including Cloud Source Repositories, GitHub, or Bitbucket), run unit tests, build container images, and push them to Artifact Registry. Cloud Deploy is correct because it provides managed continuous delivery to both Cloud Run and GKE, supporting progressive delivery strategies like canary and blue-green deployments, and integrates directly with Cloud Build as a delivery pipeline target.

Answer

Config Sync

Answer

Artifact Registry

Answer

Cloud Source Repositories

Question 14

A team uses Cloud Deploy to manage deployments to GKE across dev, staging, and prod. They want to implement a canary deployment strategy that automatically progresses based on latency metrics and includes a manual approval step before the full rollout. Which three Cloud Deploy features should they use together?

Accepted Answer

Canary deployment strategy. Option B is correct because Cloud Deploy's canary deployment strategy allows you to progressively shift traffic to a new version, which aligns with the requirement for a gradual rollout. Option C is correct because SLO-based verification uses latency metrics (e.g., from Cloud Monitoring) to automatically determine whether the canary should progress, meeting the need for automated progression based on latency. Option E is correct because a manual approval gate can be inserted before the final full rollout, satisfying the requirement for a manual approval step.

Answer

Blue/green strategy

Answer

Automated rollback

Question 15

An organization is moving to a GitOps model for managing both application deployments and GCP infrastructure. They want to use a single tool to sync Kubernetes manifests and manage GCP resources like Cloud SQL and Pub/Sub. Which two Google Cloud services should they combine?

Accepted Answer

Config Sync. Config Sync (D) is correct because it continuously reconciles the state of Kubernetes resources in a cluster with manifests stored in a Git repository, enabling a GitOps workflow for application deployments. Config Connector (E) is correct because it allows managing GCP resources (e.g., Cloud SQL, Pub/Sub) declaratively using Kubernetes custom resource definitions (CRDs), which can also be synced via Config Sync. Together, they provide a single Git-based toolchain for both Kubernetes and GCP infrastructure.

Answer

Deployment Manager

Answer

Cloud Build

Answer

Cloud Deploy