PCDE Building and Implementing CI/CD Pipelines for a Service Practice Test 4 — 15 Questions

Question 1

An engineer wants to automatically build a Docker image in Cloud Build whenever code is pushed to the main branch of a repository. Which configuration is correct?

Accepted Answer

Create a Cloud Build trigger with event 'push', source 'repository', branch filter '^main$'. The `push` trigger with a branch filter for `main` ensures builds are triggered on pushes to the main branch.

Answer

Create a Cloud Build trigger with event 'pull_request', source 'repository', branch filter 'main'

Answer

Create a Cloud Build trigger with event 'push', source 'repository', branch filter '.*'

Answer

Create a Cloud Build trigger with event 'manual', source 'repository', branch filter 'main'

Question 2

A team uses Cloud Build with a private pool to access resources in a VPC. After configuring the private pool, builds fail with a timeout error when pulling images from Artifact Registry. What is the most likely cause?

Accepted Answer

The private pool is not peered with the VPC that contains Artifact Registry. When using a Cloud Build private pool, the pool runs in a Google-managed environment that must be peered with your VPC to access internal resources. If the private pool is not peered with the VPC that contains Artifact Registry (which is a regional service accessible via Private Service Connect or VPC peering), the build worker cannot reach the Artifact Registry API endpoint over the private network, causing a timeout when pulling images. Option D directly addresses this missing network connectivity.

Answer

The Artifact Registry repository is in a different region than the private pool

Answer

The image name contains a typo

Answer

The Cloud Build service account lacks permissions to pull images from Artifact Registry

Question 3

A company is implementing Binary Authorization with Cloud Deploy. They want to ensure that only images signed by the CI system (using Cloud Build) are deployed to production. What must be configured?

Accepted Answer

In Cloud Build, use the `gcloud beta artifacts docker images sign` command after building the image, and set the Binary Authorization policy to require attestations from that signer. Option D is correct because it describes the exact workflow: Cloud Build signs the container image using the `gcloud beta artifacts docker images sign` command, which creates a cryptographic attestation stored in Cloud Key Management Service (KMS). The Binary Authorization policy is then configured to require an attestation from that specific signer (the CI system's KMS key), ensuring only images signed by the CI pipeline can be deployed to production.

Answer

Configure Artifact Registry to automatically sign images on push

Answer

Use Cloud Deploy's canary deployment with audit logging to verify image provenance

Answer

Enable Binary Authorization on the GKE cluster and configure the admission controller to use Cloud Key Management Service

Question 4

A DevOps engineer needs to deploy the same application to multiple GKE clusters across environments (dev, staging, prod) with environment-specific configurations. They want to use a single source of truth for Kubernetes manifests. Which approach is most suitable?

Accepted Answer

Use Kustomize with overlays for each environment. Kustomize is the most suitable approach because it allows you to maintain a single base set of Kubernetes manifests and apply environment-specific overlays (dev, staging, prod) without templating. This aligns with the requirement for a single source of truth while enabling environment-specific configurations through patches and transformers, all managed natively by kubectl.

Answer

Use Helm charts with separate values files per environment

Answer

Use kubectl apply with different manifest files for each environment

Answer

Use Config Connector to manage GKE clusters

Question 5

A team uses Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to automatically deploy to staging after a successful deployment to dev, but require manual approval before promoting to prod. How should they configure this?

Accepted Answer

Set the prod target to require approval in Cloud Deploy. Option A is correct because Cloud Deploy supports a 'require approval' setting on delivery pipeline targets. By enabling this on the prod target, the pipeline will automatically promote from dev to staging (since no approval is required there) but will pause before promoting to prod, waiting for a manual approval action in the Cloud Deploy console or via the API.

Answer

Create a Cloud Build trigger that runs after dev promotion

Answer

Configure Cloud Deploy with a canary strategy for prod

Answer

Use a scheduled Cloud Build to check dev status and then deploy to staging

Question 6

An engineer wants to run two Cloud Build steps in parallel to speed up the build. How should they configure the cloudbuild.yaml?

Accepted Answer

Set `waitFor: ['-']` on both steps and ensure they are defined sequentially in the YAML. In Cloud Build, steps defined sequentially in the YAML run in order by default. To run two steps in parallel, you set `waitFor: ['-']` on both steps, which tells Cloud Build not to wait for any previous step. This allows them to start simultaneously. Option D correctly describes this configuration.

Answer

Use two separate cloudbuild.yaml files and run them concurrently

Answer

Set `waitFor: ['previous']` on both steps

Answer

Define steps under a `parallel` key in cloudbuild.yaml

Question 7

A company uses Cloud Run and wants to deploy a new revision that initially receives 5% of traffic, and only if it's healthy, gradually increase to 100%. Which gcloud command should they use?

Accepted Answer

gcloud run deploy --image ... --to-revisions=REVISION_1=95,REVISION_2=5. Option C is correct because the `gcloud run deploy` command with the `--to-revisions` flag allows you to specify the exact traffic split between existing revisions and the new revision. By setting `REVISION_1=95,REVISION_2=5`, the new revision (REVISION_2) initially receives 5% of traffic, and Cloud Run's built-in gradual rollout mechanism will automatically increase its traffic share to 100% only if it remains healthy, based on the configured health checks.

Answer

gcloud run deploy --image ... --canary-percent=5

Answer

gcloud run deploy --image ... --traffic=5

Answer

gcloud run deploy --image ... --min-instances=1 --max-instances=10

Question 8

A team uses GitOps with Config Sync to manage multiple GKE clusters. They want to ensure that if a configuration change is applied to the git repository, it is automatically synced to all clusters within minutes. What must be configured?

Accepted Answer

Configure Config Sync with a webhook from Cloud Source Repositories or GitHub to trigger re-sync. Option C is correct because Config Sync relies on a polling mechanism by default, which can introduce delays. Configuring a webhook from Cloud Source Repositories or GitHub triggers an immediate re-sync when changes are pushed to the repository, ensuring that configurations are applied to all GKE clusters within minutes without waiting for the next polling interval.

Answer

Use Anthos Service Mesh to distribute configurations

Answer

Set the `syncWait` parameter in the Config Sync operator to 1 second

Answer

Set up a Cloud Build trigger that runs `gcloud container clusters update` on each cluster

Question 9

An engineer wants to cache Docker layers in Cloud Build to speed up subsequent builds. The build uses Kaniko to build images. What should they include in the cloudbuild.yaml?

Accepted Answer

Set `--cache=true` and `--cache-repo` in the Kaniko builder arguments. Kaniko uses `--cache=true` and `--cache-repo` to enable layer caching in a registry.

Answer

Add a step that runs `docker save` and `docker load`

Answer

Use the `docker` builder instead of Kaniko and set `--cache-from`

Answer

Enable Cloud Build's built-in caching by setting `cache: true` in cloudbuild.yaml

Question 10

A company uses Cloud Build to deploy to Google Kubernetes Engine (GKE). They want to use a Helm chart stored in a Cloud Storage bucket. What should they do in the cloudbuild.yaml?

Accepted Answer

Use the `gcloud storage cp` command to copy the chart, then run `helm upgrade`. Option D is correct because Cloud Build cannot directly access a Helm chart stored in a Cloud Storage bucket. You must first copy the chart to the build environment using `gcloud storage cp`, then run `helm upgrade` to deploy it to GKE. This ensures the chart is locally available for Helm to process.

Answer

Use `kubectl apply -f` with the Helm chart URL

Answer

Use `helm repo add` with a GCS bucket URL

Answer

Store the chart in Artifact Registry and use `helm install` from there

Question 11

A deployment pipeline uses Cloud Deploy with canary strategy targeting Cloud Run. The engineer wants to run a data migration job before the new revision receives traffic. How should they implement this?

Accepted Answer

Add a preDeploy hook in the delivery pipeline that runs a Cloud Run job. Cloud Deploy supports preDeploy hooks that run Cloud Run jobs before the deployment proceeds.

Answer

Add a postDeploy hook that runs the migration

Answer

Include a Cloud Build step before the deploy step

Answer

Use a startup command in the Cloud Run service

Question 12

A team wants to use Cloud Build to build a Maven application and store the artifact in Artifact Registry. Which repository format should they use?

Accepted Answer

Maven repository. The team is building a Maven application, which produces a JAR or WAR artifact. Artifact Registry supports a Maven repository format specifically designed to store and serve Maven artifacts, including pom.xml and JAR files, using the Maven repository layout. This allows Cloud Build to push the artifact directly to a Maven repository in Artifact Registry for dependency management and deployment.

Answer

Python repository

Answer

npm repository

Answer

Docker repository

Question 13

An organization uses Cloud Build and wants to inject a secret API key into a build step without exposing it in the cloudbuild.yaml. Which approach should they use?

Accepted Answer

Use `secretEnv` to reference a Secret Manager secret. Option A is correct because Cloud Build's `secretEnv` field allows you to reference a secret stored in Secret Manager and inject it as an environment variable into a build step. This approach ensures the secret value is never exposed in the `cloudbuild.yaml` file or build logs, as Cloud Build retrieves it securely at runtime using the Secret Manager API.

Answer

Store the key in a Cloud Build substitution variable

Answer

Pass the key via `args` with a substitution

Answer

Store the key in a Cloud Storage bucket and download it in the build

Question 14

A company uses Argo CD on GKE for GitOps deployments. They want to ensure that when a developer pushes a change to a Kubernetes manifest, Argo CD automatically syncs the cluster. What must be configured?

Accepted Answer

Configure a webhook in the git repository that notifies Argo CD of changes. Option B is correct because Argo CD can be configured to automatically sync a cluster when a developer pushes a change to a Kubernetes manifest by setting up a webhook in the Git repository. The webhook notifies Argo CD of the push event, triggering a sync operation without manual intervention or polling. This is the standard GitOps pattern for event-driven synchronization.

Answer

Use a Cloud Build trigger to run `argocd app sync`

Answer

Set the sync policy to Automatic with Prune

Answer

Enable Config Sync instead of Argo CD for automatic sync

Question 15

An engineer uses Cloud Build with a private pool to build an application that needs to connect to a Cloud SQL database. The build step fails with a connection timeout. What is the most likely cause?

Accepted Answer

The private pool is not peered with the VPC that contains the Cloud SQL instance. A private Cloud Build pool runs in a customer-managed VPC, so it must be peered with the VPC hosting the Cloud SQL instance to establish network connectivity. Without VPC peering, the build step cannot reach the Cloud SQL private IP, resulting in a connection timeout. This is the most likely cause because the error is a timeout, not an authentication or configuration issue.

Answer

The Cloud Build service account lacks permissions to connect to Cloud SQL

Answer

The database name is incorrect

Answer

The Cloud SQL instance requires SSL