PCDE Building and Implementing CI/CD Pipelines for a Service Practice Test 7 — 15 Questions

Question 1

A company uses Cloud Deploy to manage deployments to multiple GKE clusters. They want to implement a canary deployment strategy where the new revision receives 10% of traffic initially, and after 5 minutes with no errors, it receives 100%. Which TWO actions are required to achieve this?

Accepted Answer

Integrate with Cloud Monitoring for metric-based canary analysis. Cloud Deploy supports canary deployments using the `canaryDeployment` strategy, which allows defining multiple phases with traffic percentages and wait times. In this scenario, the first phase sends 10% traffic, and after 5 minutes with no errors (detected via Cloud Monitoring integration), it progresses to 100%. Thus, configuring the `canaryDeployment` strategy with phases and wait times (E) is required. Additionally, integrating with Cloud Monitoring (A) is necessary to automatically detect errors and trigger the progression or rollback. Option D (manual approval) is not automated and does not fit the 'no errors' requirement.

Answer

Use a blue/green deployment strategy instead

Answer

Enable rollback on failure in the pipeline definition

Answer

Configure a manual approval gate for the canary phase

Question 2

A team uses Cloud Build to build and push Docker images to Artifact Registry. They need to ensure that only images built from the main branch and signed by a trusted key can be deployed to GKE using Binary Authorization. Which THREE components must be in place?

Accepted Answer

A Binary Authorization attestor configured to verify the attestation key. Option A is correct because a Binary Authorization attestor is the component that defines the trusted key(s) used to verify that an image has been signed. Without an attestor configured with the correct public key, Binary Authorization cannot validate the attestation signature, and the policy cannot enforce that only signed images are deployed.

Answer

A Cloud Deploy delivery pipeline with a canary strategy

Answer

An Artifact Registry repository configured with vulnerability scanning

Question 3

An organization uses GitOps with Config Sync to manage multiple GKE clusters. They want to ensure that any change to the Git repository is automatically applied to the clusters, and that no manual kubectl apply commands are used. Which TWO resources should they configure?

Accepted Answer

RepoSync resource pointing to the Git repository. Option C is correct because a RepoSync resource is used in Config Sync to synchronize a non-root namespace-level repository with the cluster, ensuring that any changes pushed to the Git repository are automatically applied without manual kubectl commands. Option D is correct because a RootSync resource is used to synchronize the root-level configuration (e.g., cluster-scoped resources) from a Git repository, providing the same automated GitOps workflow. Together, they cover both namespace and cluster-scoped resources, fulfilling the requirement of no manual kubectl apply.

Answer

A Cloud Build trigger that runs kubectl apply on push

Answer

A Kustomize overlay for each cluster

Answer

An Argo CD Application resource

Question 4

A DevOps engineer wants to automatically trigger a Cloud Build pipeline whenever a pull request is created against the main branch of a repository. Which type of build trigger should they use?

Accepted Answer

Pull request trigger. Option B is correct because a pull request trigger in Cloud Build is specifically designed to initiate a build when a pull request is created or updated against a target branch, such as main. This trigger type evaluates the PR event and automatically runs the pipeline, enabling validation of proposed changes before merging.

Answer

Push to branch trigger

Answer

Scheduled trigger

Answer

Manual trigger

Question 5

An organization wants to store Docker images in a private Google Cloud repository with vulnerability scanning enabled. Which service should they use?

Accepted Answer

Artifact Registry

Answer

Container Registry

Answer

Cloud Build

Answer

Cloud Storage

Question 6

A team uses Cloud Build to build a container image using Kaniko. They want to cache layers to speed up subsequent builds. What should they configure in their cloudbuild.yaml to enable Kaniko layer caching?

Accepted Answer

Set --cache=true and specify --cache-repo in the Kaniko builder step. Kaniko does not rely on Docker's layer caching mechanism. Instead, it uses its own remote caching system where layers are pushed to a container registry. To enable this, you must pass `--cache=true` to the Kaniko builder to instruct it to cache intermediate layers, and `--cache-repo` to specify the target repository (e.g., a registry path) where those cached layers will be stored. This allows subsequent builds to reuse previously built layers, significantly reducing build time.

Answer

Use Docker layer caching with docker build --cache-from

Answer

Set substitution variable _KANIKO_CACHE=true

Answer

Enable Cloud Build cache via the caching service

Question 7

A company uses Cloud Deploy to manage deployments to GKE. They want to automatically roll back a release if a deployment fails. How should they configure this?

Accepted Answer

Configure a postDeploy hook that checks deployment status and triggers a rollback

Answer

Set up a Cloud Monitoring alert that triggers a rollback via Cloud Functions

Answer

Set the 'rollback-policy' in the delivery pipeline YAML

Answer

Use the --auto-rollback flag in the gcloud deploy release command

Question 8

An engineer needs to deploy an application to Cloud Run with a canary traffic split: 95% to the stable revision and 5% to a new revision. They also want to test the new revision with specific headers without affecting user traffic. Which approach meets these requirements?

Accepted Answer

Deploy the new revision with a tag and use traffic splitting with --to-revisions

Answer

Use Cloud Load Balancing with URL maps to route 5% of traffic

Answer

Deploy the new revision without any tag and use gcloud run services update-traffic

Answer

Use a separate Cloud Run service for the canary and split traffic via HTTP redirects

Question 9

A team uses Helm charts to deploy applications to GKE. They need to manage environment-specific configurations (e.g., dev, staging, prod) using a single chart. Which tool should they use?

Accepted Answer

Helm with values files

Answer

Kustomize

Answer

Skaffold

Answer

Config Connector

Question 10

A company wants to enforce Binary Authorization on images deployed to GKE. Images must be signed by an approved authority. What must be configured in the CI/CD pipeline to ensure images are signed before deployment?

Accepted Answer

Use cosign to sign the image in Cloud Build and store the signature in Artifact Registry

Answer

Add a Cloud Build step that runs gcloud container binauthz attestations create

Answer

Configure Cloud Deploy to sign images during the deployment process

Answer

Enable Container Analysis on Artifact Registry to automatically sign images

Question 11

A developer wants to use Cloud Build to deploy a container to Cloud Run. They have written a cloudbuild.yaml file with a step that runs gcloud run deploy. The build fails with a permission error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Cloud Run Admin role

Answer

The gcloud command is incorrect

Answer

The Cloud Build trigger is misconfigured

Answer

The Cloud Run API is not enabled in the project

Question 12

An organization wants to implement GitOps for their GKE clusters. They need to automatically sync the cluster state with a Git repository. Which Google Cloud service should they use?

Accepted Answer

Config Sync

Answer

Argo CD

Answer

Cloud Build

Answer

Cloud Source Repositories

Question 13

A company uses Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to require manual approval before promoting a release to prod. How should they configure this?

Accepted Answer

Add an approval gate in the prod target configuration

Answer

Configure a postDeploy hook that requires approval

Answer

Use Cloud Build triggers with manual invocation for prod deployments

Answer

Set the prod target's deployment strategy to 'BlueGreen'

Question 14

A team uses Cloud Build private pools to build Docker images that need access to on-premises resources via VPC peering. The build step fails with a 'connection refused' error. What is the most likely missing configuration?

Accepted Answer

The private pool does not have a route to the on-premises network

Answer

The build step is using a wrong Docker image

Answer

The Cloud Build service account lacks permissions to use the private pool

Answer

The on-premises firewall is blocking egress from GCP

Question 15

An engineer is configuring Cloud Build to use a substitution variable for the Docker image tag. They want the tag to be the short commit SHA. Which built-in substitution should they use?

Accepted Answer

$SHORT_SHA

Answer

$TAG_NAME

Answer

$COMMIT_SHA

Answer

$REVISION_ID