PCDOE Practice Test 2 — 10 Questions

Question 1

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Accepted Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Define delivery pipeline → Step 4: Push code → Step 5: Promote. The correct order for setting up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service begins with creating a build configuration file (cloudbuild.yaml) that specifies how to build and test the application. Next, you set a trigger (e.g., on push to a branch) in Cloud Build to automatically start builds. Then, you define a delivery pipeline in Cloud Deploy with targets (e.g., staging, production) and approval gates. After that, you push code to the repository, which triggers the build and, if successful, creates a release in the delivery pipeline. Finally, you promote the release through the stages (e.g., from staging to production) either automatically or after manual approval. This order ensures each prerequisite is in place before the next step, enabling a seamless automated workflow.

Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Push code → Step 4: Define delivery pipeline → Step 5: Promote

Answer

Step 1: Define delivery pipeline → Step 2: Create build config → Step 3: Set trigger → Step 4: Push code → Step 5: Promote

Answer

Step 1: Push code → Step 2: Create build config → Step 3: Set trigger → Step 4: Define delivery pipeline → Step 5: Promote

Question 2

An organization uses Cloud Deploy with Skaffold to manage progressive delivery on GKE. After a rollout, the new revision shows a higher error rate in Stackdriver, but the Cloud Deploy pipeline did not automatically roll back. What is the most likely cause?

Accepted Answer

The Cloud Deploy pipeline does not have a stackdriverMetrics verification job defined to check error rates.. Cloud Deploy does not automatically roll back based on error rates unless a verification job (such as a Stackdriver metrics check) is explicitly defined in the pipeline. Without a verification step that monitors error rates and fails the rollout, Cloud Deploy will continue advancing through phases even if the new revision is unhealthy. Therefore, the absence of a stackdriverMetrics verification job is the most likely cause.

Answer

The rollout strategy includes a manual approval step before advancing to the next phase.

Answer

The release was created with a '--disable-rollback' flag.

Answer

The rollout has not yet reached 100% traffic, so Cloud Deploy waits for full completion before evaluating health.

Question 3

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the roles/run.admin role.. The Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) requires the roles/run.admin role to deploy to Cloud Run. This role grants permission to create, update, and manage Cloud Run services. Without it, the deployment step fails with a 'Permission denied' error, even though the build itself succeeds.

Answer

The Cloud Run service account lacks the roles/cloudbuild.builds.builder role.

Answer

The trigger is missing the required deployment configuration.

Answer

The cloudbuild.yaml file has an incorrect image tag.

Question 4

Which Cloud Monitoring feature can directly correlate this error with the associated trace and VM instance?

Accepted Answer

Error Reporting. Error Reporting in Google Cloud automatically groups errors from Cloud Logging and can directly correlate an error with the associated trace ID and VM instance metadata. This is because Error Reporting ingests structured log entries that contain the `@type` field set to `type.googleapis.com/google.devtools.clouderrorreporting.v1beta1.ReportedErrorEvent` and parses the `serviceContext` and `context` fields to link the error to the specific trace and resource (e.g., VM instance).

Answer

Log-based metrics

Answer

Metrics Explorer

Answer

Alerting policies

Question 5

A company wants to monitor custom application metrics in real-time and trigger alerts when a metric exceeds a threshold. Which Google Cloud service should they use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it is designed to ingest custom application metrics via the Monitoring API or OpenTelemetry, create dashboards for real-time visualization, and configure alerting policies that trigger notifications when a metric exceeds a defined threshold. This directly meets the requirement for real-time monitoring and threshold-based alerts.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

Cloud Error Reporting

Question 6

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Accepted Answer

secretmanager.versions.access. The custom role assigned to the Cloud Build service account lacks the `secretmanager.versions.access` permission, which is required to access the payload of a secret version in Secret Manager. Without this permission, any attempt to read the secret value during a build step will fail with a permission denied error, even if the service account has other roles on the project.

Answer

cloudbuild.builds.update

Answer

run.services.get

Answer

iam.serviceAccounts.actAs

Question 7

A DevOps team is troubleshooting a Cloud Build pipeline that fails intermittently when building a container image. The build step uses a custom build step that runs a vulnerability scan. The error log shows: 'Step #1: Error: failed to scan image: context deadline exceeded'. The build configuration includes 'timeout: 600s'. Which is the most likely cause and solution?

Accepted Answer

The scan step is taking longer than the build timeout; increase the timeout value in the build configuration.. The error 'context deadline exceeded' indicates that the custom vulnerability scan step is taking longer than the build's configured timeout of 600 seconds. Cloud Build enforces a hard timeout for the entire build; if any step exceeds this duration, the build is terminated. Increasing the timeout value in the build configuration provides more time for the scan to complete, directly addressing the root cause.

Answer

The scan tool requires a specific dependency; add an installation step before scanning.

Answer

There is network latency between Cloud Build and the container registry; use VPC Service Controls.

Answer

The build step is running out of memory; increase the machine type to e2-highcpu-8.

Question 8

An organization wants to implement a CI/CD pipeline that automatically deploys to a staging environment on every push to the main branch, and deploys to production only after a manual approval. They use Cloud Build and Cloud Deploy. What is the best way to configure this?

Accepted Answer

Configure a Cloud Deploy delivery pipeline with a staging target (automatic promotion) and a production target (require approval).. Cloud Deploy natively supports delivery pipelines with multiple targets, where you can configure automatic promotion to staging and require manual approval for production. This aligns with the requirement for a CI/CD pipeline that deploys to staging on every push to main and to production only after manual approval, using Cloud Build for the build and Cloud Deploy for the deployment orchestration.

Answer

Create a single Cloud Build pipeline that deploys to both staging and production using conditional steps based on branch name.

Answer

Use Cloud Build to deploy to Cloud Run, and configure traffic splitting to gradually shift traffic from staging to production.

Answer

Use Cloud Build triggers with two separate build configs: one for staging (automatic), one for production (manual trigger).

Question 9

A startup wants to reduce their Google Cloud costs for a batch processing job that runs nightly for 3 hours. The job is fault-tolerant and can tolerate interruptions. What is the most cost-effective compute option?

Accepted Answer

Preemptible VM. Preemptible VMs (Option D) are the most cost-effective because they offer up to 60-91% discount and are suitable for fault-tolerant, interruptible batch jobs. Standard VMs (Option A) are more expensive. Shielded VMs (Option B) provide security features but no cost savings. Sole-tenant nodes (Option C) provide isolation but are more costly.

Answer

Standard VM

Answer

Shielded VM

Answer

Sole-tenant node

Question 10

Your company runs a multi-region application on GKE across us-east1 and europe-west1. The application serves a global user base with a strict SLO of 99.95% availability. Recently, the team noticed that during peak hours, some users in South America experience high latency and intermittent errors. The GKE clusters are monitored via Cloud Monitoring with custom dashboards and alerting policies. The team has set up a single alerting policy that triggers when the global error rate exceeds 0.1%. However, the alert fires only after the issue has persisted for 10 minutes, and by then the customer impact is already significant. You need to improve the detection and response time. Which action should you take first?

Accepted Answer

Create separate alerting policies per region with shorter evaluation periods, and set up a notification channel for the on-call team.. The current single global alerting policy with a 10-minute evaluation period introduces a significant delay in detecting regional issues. By creating separate alerting policies per region with shorter evaluation periods, you can detect and respond to regional anomalies (like high latency in South America) much faster, directly improving the detection time for the multi-region application and reducing customer impact.

Answer

Add a dashboard that shows latency by region and set up a log-based metric for error counting.

Answer

Reduce the alerting policy's duration to 1 minute and increase the threshold to 0.5% to reduce noise.

Answer

Implement a canary deployment strategy to roll back changes quickly.