PCDE Building and Implementing CI/CD Pipelines for a Service Practice Test 8 — 15 Questions

Question 1

A company wants to deploy a microservice to Google Cloud. They require canary deployments with automatic rollback if error rate increases. Which TWO services should they use together?

Accepted Answer

Cloud Deploy

Answer

Cloud Build

Answer

Cloud Endpoints

Answer

Cloud Functions

Question 2

A team uses Skaffold for local development and CI/CD. They want to run integration tests against the deployed application before releasing to production. Which THREE Skaffold features can they use?

Accepted Answer

Custom test via the 'test' config section

Answer

Port forwarding to access the application locally

Answer

Skaffold debug for interactive debugging

Question 3

An organization wants to implement feature flags to gradually roll out new features in production. Which TWO approaches can they use on Google Cloud?

Accepted Answer

Use Cloud Run traffic splitting to route users to different application versions. Option C is correct because Cloud Run's traffic splitting feature allows you to gradually route a percentage of traffic to a new revision of a service, enabling canary deployments or gradual rollouts of new features without requiring code changes or external services. This is a native Google Cloud approach that leverages the underlying Knative serving layer to manage traffic routing at the request level.

Answer

Store feature flags in Cloud Storage and have the application poll for changes

Answer

Use Cloud Build substitutions to inject feature flags at build time

Answer

Use Cloud Functions to toggle feature flags via HTTP calls

Question 4

An engineer wants to trigger a Cloud Build pipeline whenever a new pull request(PR) is opened against the 'main' branch of a repository. Which type of build trigger should they configure?

Accepted Answer

Pull Request trigger. Cloud Build supports pull request triggers that automatically run a build when a PR is created or updated. This is specifically called a 'Pull Request' trigger.

Answer

Manual trigger

Answer

Scheduled trigger (cron)

Answer

Push trigger on branch

Question 5

A team is using Cloud Build to build Docker images and push them to Artifact Registry. They want to speed up builds by caching the Docker layers. Which approach is recommended for caching in Cloud Build?

Accepted Answer

Configure Cloud Build to use Kaniko cache with a destination in Artifact Registry. Cloud Build supports Kaniko caching for Docker images. Kaniko can cache layers in a registry, significantly reducing build times by reusing cached layers when the Dockerfile hasn't changed.

Answer

Use Google Cloud Storage as a layer cache for Docker builds

Answer

Use 'gcloud builds submit --cache-from' with a local cache

Answer

Set up a Docker registry proxy in Compute Engine to cache images

Question 6

An organization uses Cloud Deploy to promote releases across dev, staging, and prod. They want to automatically run integration tests after a deployment to a Cloud Run target, before proceeding to the next stage. How should they implement this?

Accepted Answer

Configure a postDeploy hook on the staging target that runs a Cloud Run Job for integration tests. Cloud Deploy supports deployment hooks: custom scripts that run before (preDeploy) or after (postDeploy) a deployment. postDeploy hooks run after the target is deployed and can be implemented as Cloud Run Jobs.

Answer

Create a separate Cloud Build trigger that runs tests after detecting the deployment

Answer

Use a preDeploy hook on the staging target to run tests

Answer

Add an approval gate after staging that requires manual test results

Question 7

A DevOps engineer is building a CI/CD pipeline and needs to securely pass a database password to a Cloud Build step. The password is stored in Secret Manager. What is the correct way to access it in cloudbuild.yaml?

Accepted Answer

Define the secret in 'availableSecrets' and reference it via 'secretEnv' in the step. Cloud Build can access secrets from Secret Manager using the 'availableSecrets' and 'secretEnv' configuration. The secret is then injected as an environment variable in the build step.

Answer

Use 'gcloud secrets versions access' directly in a step's entrypoint

Answer

Store the password in a Cloud Storage bucket and download it during build

Answer

Pass the password as a build substitution variable

Question 8

A company wants to deploy a containerized application to Cloud Run and gradually shift traffic from the current revision to a new revision. They want to send 10% of traffic to the new revision initially. Which command should they use?

Accepted Answer

gcloud run deploy --image ... --no-traffic; then gcloud run services update-traffic ... --to-revisions=NEW=10,OLD=90. Option C is correct because it first deploys the new revision without any traffic using `--no-traffic`, then uses `gcloud run services update-traffic` to explicitly set 10% traffic to the new revision and 90% to the old revision. This two-step approach is required when you want to gradually shift traffic to a new revision without immediately serving any traffic to it, as Cloud Run does not support setting a specific traffic percentage directly in the `gcloud run deploy` command.

Answer

gcloud run revisions update-traffic ... --to-revisions=NEW=10

Answer

gcloud run deploy --image ... --to-revisions=NEW=10

Answer

gcloud run deploy --image ... --traffic=10

Question 9

A team is using Helm charts to deploy to GKE. They want to manage environment-specific values (dev, staging, prod) while keeping a single chart. Which approach is recommended?

Accepted Answer

Use --values flags with environment-specific value files. Helm supports multiple values files; you can use --values to specify environment-specific files, overriding default values. This keeps one chart and separate configs.

Answer

Store all environment values in a single values.yaml and use --set to override

Answer

Use Kustomize overlays to manage Helm values

Answer

Create separate Helm charts for each environment

Question 10

An organization uses GitOps with Config Sync to manage multiple GKE clusters. They want to automatically deploy a new version of a microservice by pushing to a Git repository. Which component validates and applies the changes to the clusters?

Accepted Answer

Config Sync reconciler. Config Sync's core component is the 'reconciler', which runs in each cluster, watches the Git repo, and applies changes to ensure cluster state matches the repo. The 'admission webhook' provides validation but does not apply.

Answer

Cloud Build trigger

Answer

Admission webhook

Answer

Anthos Service Mesh

Question 11

A company is using Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to require manual approval before deploying to prod. What should they add?

Accepted Answer

Configure a 'requireApproval' property on the prod target. Cloud Deploy supports approval gates: you can define a manual approval step in the delivery pipeline that must be approved before proceeding to the next target.

Answer

Set up a Cloud Function to send approval email

Answer

Use Binary Authorization

Answer

Add a rollout policy

Question 12

An engineer wants to use Skaffold for local development and for CI/CD on Google Cloud. Which feature allows Skaffold to run on Cloud Build and deploy to GKE?

Accepted Answer

Skaffold run command. The `skaffold run` command is the correct answer because it performs a one-shot build and deploy, which is the exact behavior needed for CI/CD pipelines. When integrated with Cloud Build, `skaffold run` executes the entire workflow (build, test, deploy) in a non-interactive, headless mode, making it suitable for automated deployments to GKE without requiring a continuous dev loop.

Answer

Skaffold dev loop

Answer

Skaffold init command

Answer

Skaffold delete command

Question 13

A team is setting up a Cloud Build private pool to build Docker images that need access to resources in a VPC. After creating the private pool, builds fail with network errors. What is the most likely missing step?

Accepted Answer

Configure Service Directory (private connection) between the pool and the VPC. Private pools require a Service Directory private connection (or VPC peering) to access VPC resources. Without that, the pool cannot reach the VPC.

Answer

Grant the Cloud Build service account the 'compute.networkUser' role

Answer

Enable Cloud NAT on the VPC

Answer

Assign a public IP to the build instances

Question 14

A company uses Cloud Build to deploy to Cloud Run. They want to use a custom service account for the deployment step, not the default Cloud Build service account. How should they configure this?

Accepted Answer

Specify 'serviceAccount' in the step definition in cloudbuild.yaml. In cloudbuild.yaml, you can specify a service account for each step using the 'serviceAccount' field. This overrides the default build service account for that step.

Answer

Set the service account in the build trigger's service account field

Answer

Use 'gcloud config set account' in the step's entrypoint

Answer

Use 'impersonate-service-account' flag in gcloud commands

Question 15

An organization is implementing Binary Authorization for GKE. They need to ensure that only container images signed by their CI system are deployed. Which service must be enabled and configured to enforce this?

Accepted Answer

Binary Authorization attestor and policy. Binary Authorization is a managed service that requires an attestor to verify signatures. The attestor is configured with a public key, and the CI system signs images with the private key.

Answer

Cloud Key Management Service (KMS)

Answer

Artifact Registry with Container Analysis

Answer

Cloud Build service account with 'iam.serviceAccountUser' role