PCDOE Building and implementing CI/CD pipelines Practice Test 2 — 15 Questions

Question 1

A team uses Cloud Build with a trigger on Cloud Source Repository. The build fails intermittently with error 'Failed to pull builder image 'gcr.io/cloud-builders/gcloud'' but sometimes succeeds. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network egress from Cloud Build is throttled due to high concurrency.. The intermittent failure to pull the builder image 'gcr.io/cloud-builders/gcloud' indicates a transient network issue rather than a permanent misconfiguration. Cloud Build uses a shared pool of network resources, and under high concurrency, egress traffic to Container Registry can be throttled, causing pull operations to time out or fail. This explains why the build sometimes succeeds and sometimes fails, as throttling depends on the current load.

Answer

The Cloud Build worker pool is in a different region.

Answer

The builder image is too large.

Answer

The build service account lacks permissions to access Container Registry.

Question 2

A company uses Cloud Deploy for continuous delivery to GKE. They have a delivery pipeline with a rollout strategy: canary (25% for 30m) then full. The canary rollout fails because the new revision's health check errors. The team wants to automatically rollback the canary and notify. What native GCP feature can achieve this?

Accepted Answer

Configure a Cloud Deploy rollout strategy with an automated rollback policy.. Cloud Deploy natively supports automated rollback policies within a rollout strategy. When a canary rollout fails due to health check errors, the automated rollback policy can trigger a rollback to the previous stable revision without manual intervention. This is a built-in feature of Cloud Deploy, designed to handle exactly this scenario.

Answer

Configure Cloud Monitoring alerting policy on deployment errors that triggers a Cloud Function to rollback.

Answer

Set up a Cloud Build trigger that detects deployment failure and runs a rollback.

Answer

Use a Cloud Deploy rollout strategy with a post-deploy hook that calls Cloud Run jobs to revert.

Question 3

A company uses Cloud Build with a custom service account that has minimal permissions. The build needs to deploy to Cloud Run. After configuring the service account with roles/run.admin, the build fails with 'Permission denied' on gcloud run deploy. What is the most likely cause?

Accepted Answer

The build service account lacks roles/iam.serviceAccountUser on the Cloud Run runtime service account.. When a Cloud Build service account with only roles/run.admin attempts to deploy to Cloud Run, it must also have the iam.serviceAccountUser role on the Cloud Run runtime service account to impersonate it. Without this, gcloud run deploy fails with 'Permission denied'. Option B is incorrect because an unset Cloud Run service account would result in a different error, typically about an unspecified service account, not a permission denied. Option C is incorrect because roles/cloudbuild.serviceAgent is not required for deploying to Cloud Run; it's a broader role. Option D is unlikely because syntax errors would produce a build configuration parsing error, not a runtime permission denied.

Answer

The Cloud Run service account is not set.

Answer

Cloud Build requires the roles/cloudbuild.serviceAgent role.

Answer

The build configuration file has syntax errors.

Question 4

Which GCP service is used to store build artifacts such as Docker images?

Accepted Answer

Container Registry. Both Container Registry and Artifact Registry are GCP services used to store build artifacts such as Docker images. Container Registry is the older service, while Artifact Registry is the newer, recommended service that supports multiple artifact formats. The question asks which service is used, and both are valid, so the correct answer is 'Both Container Registry and Artifact Registry.'

Answer

Cloud Storage

Answer

Both Container Registry and Artifact Registry

Question 5

A company uses Cloud Build to compile a Java application. The build takes 15 minutes due to dependency downloads. They want to cache the Maven dependencies to speed up subsequent builds. What is the best approach?

Accepted Answer

Use Cloud Build's built-in caching mechanism by specifying volumes.. Cloud Build supports volumes that can be used to cache directories between builds. Specifically, you can specify a volume for the Maven local repository (.m2) to persist across runs, speeding up builds by avoiding repeated downloads. Option A is possible but less integrated and requires manual restoration. Option B is not ideal because layer caching depends on Docker image caching, not Maven dependencies. Option D is not a native Cloud Build feature; the correct approach is via volumes.

Answer

Use a Cloud Storage bucket to store the .m2 directory and restore it at the start of the build.

Answer

Use a Docker layer caching with a custom image that includes dependencies.

Answer

Use Cloud Build's 'cache' configuration to persist directories.

Question 6

A DevOps team uses Cloud Build and Cloud Deploy to deploy to GKE. They want to implement a gated deployment where a manual approval is required before promoting from staging to production. What two resources should they configure? (Select TWO)

Accepted Answer

A Cloud Deploy approval rule in the delivery pipeline. A Cloud Deploy approval rule in the delivery pipeline defines a manual gate that pauses the pipeline at a specific stage (e.g., before promoting to production) and requires explicit approval to proceed. Option D is correct because setting the `requireApproval` attribute to `true` on a Cloud Deploy target enforces that any rollout targeting that environment must receive manual approval before the deployment proceeds.

Answer

A Cloud Pub/Sub topic to notify approvers

Answer

A Cloud Deploy rollout with a pre-deploy hook

Answer

A Cloud Build trigger with a manual approval step

Question 7

What security checks can be integrated into a Cloud Build CI/CD pipeline? (Select TWO)

Accepted Answer

Container scanning with Artifact Analysis. Options B and E are correct. Container scanning with Artifact Analysis (B) is a native security check in Cloud Build. Static application security testing (SAST) can be added via custom steps (E). Option A (manual code review) is a process, not a tool that can be integrated programmatically. Option C (network penetration testing) is an external activity not typically integrated into CI/CD. Option D (DAST) is for running applications, not during build.

Answer

Manual code review

Answer

Network penetration testing

Answer

Dynamic application security testing (DAST)

Question 8

Refer to the exhibit. A rollout to dev succeeds, but when promoting to prod, it fails with 'Target 'prod' not found'. What is the issue?

Accepted Answer

The prod target has not been created in the same region.. In Google Cloud Deploy, a target is a regional resource — it is defined and stored within a specific region (e.g., us-central1). When a delivery pipeline references a target by name, the pipeline looks for that target in the same region as the pipeline itself. If the prod target was created in a different region than the pipeline (or than the dev target), the pipeline cannot find it, producing the 'Target 'prod' not found' error. The dev rollout succeeded because the dev target exists in the pipeline's region, but prod does not.

Answer

The prod target does not have a required approval rule.

Answer

The prod target exists but is in a different project.

Answer

The delivery pipeline must be redeployed to include the prod target.

Question 9

A financial services firm is implementing a CI/CD pipeline with Cloud Build and Artifact Registry. Their security policy requires all data to remain within a VPC Service Controls perimeter. They have configured Cloud Build to use a private worker pool with no external IP addresses and have set up VPC-SC to allow traffic between Cloud Build and Artifact Registry within the perimeter. However, builds that push Docker images to Artifact Registry fail with the error: 'denied: Unauthenticated request. Push access to the repository is denied.' The build configuration includes the step: 'steps: - name: gcr.io/cloud-builders/docker args: [push, us-central1-docker.pkg.dev/myproject/my-repo/myimage]' The Cloud Build service account has been granted roles/artifactregistry.writer on the repository. What is the most likely cause?

Accepted Answer

The VPC-SC perimeter does not allow egress to the Artifact Registry API endpoint.. With VPC Service Controls, even when IAM permissions are correct and a private worker pool is used, the Cloud Build worker must be able to reach the Artifact Registry API endpoint through the VPC-SC perimeter. The error 'Unauthenticated request' is a classic symptom of VPC-SC blocking the API call at the perimeter boundary — the request never reaches IAM evaluation, so it appears as an authentication failure rather than a permission denial. The perimeter must explicitly allow egress from the Cloud Build project to the Artifact Registry API (artifactregistry.googleapis.com) via an egress rule or by including both projects in the same perimeter with appropriate access levels.

Answer

The Cloud Build service account does not have permissions to authenticate to Artifact Registry when using a private pool.

Answer

The Docker push is failing because the image tag is missing a version.

Answer

The Artifact Registry repository is in a different region than the Cloud Build worker pool.

Question 10

A development team is using Cloud Build to build and push Docker images to Artifact Registry. The builds are taking longer than expected, and the team wants to reduce build time and cost. They use a Dockerfile that installs many dependencies. Which approach should they recommend?

Accepted Answer

Use Kaniko cache in Cloud Build with a persistent volume claim to cache base layers.. Kaniko is a tool that builds container images from a Dockerfile without requiring a Docker daemon, and it supports layer caching. In Cloud Build, enabling Kaniko cache with a persistent volume claim (or GCS-backed cache) stores intermediate layers so subsequent builds reuse unchanged layers instead of reinstalling dependencies. This directly reduces build time and cost for Dockerfiles with many dependency installations.

Answer

Increase the machine type to use more vCPUs and memory for the build.

Answer

Switch to Docker build with --privileged flag and use a local Docker daemon.

Answer

Reduce the number of steps in the Cloud Build config to a single step that installs and builds everything.

Question 11

A multinational corporation has multiple development teams working on microservices deployed to GKE clusters. They want to implement a CI/CD pipeline that ensures every container image is scanned for vulnerabilities, passes unit tests, and gets a security approval before deployment to production. They are using Cloud Build for CI and Cloud Deploy for CD. The current pipeline triggers on code push to any branch. The security team requires that all production deployments be reviewed and approved by the security team. Which set of actions best meets these requirements?

Accepted Answer

Configure Cloud Build triggers only for the main branch. Use Cloud Build to build and push images, then rely on Artifact Registry's automatic Container Analysis scanning. In Cloud Deploy, add a manual approval gate for the production phase.. Configuring Cloud Build triggers only for the main branch reduces unnecessary builds; using Cloud Build to build and push images, then relying on Artifact Registry's automatic Container Analysis scanning, ensures vulnerability scanning occurs after image push. Cloud Deploy's manual approval gate for the production phase satisfies the security team's requirement for review and approval before deployment. Option A is incorrect because Cloud Build's built-in approval feature applies to the build process, not to deployments, and it doesn't integrate with Container Analysis; plus, running all steps in a single step is inefficient. Option B is incorrect because granting editor role to a security team member is not a proper approval mechanism; it would give too many permissions and doesn't enforce a review process. Option D is incorrect because using a Cloud Function triggered by Pub/Sub for approval bypasses proper deployment pipelines and lacks the structured approval workflow provided by Cloud Deploy.

Answer

Run all tests and scans in a single Cloud Build step and use Cloud Build's built-in approval feature to require a reviewer before pushing to Artifact Registry.

Answer

Run vulnerability scans in the Cloud Build step before building the image, and add a security team member to the project as an editor to approve deployments.

Answer

Use Cloud Build to run tests and scans, then have Cloud Build send a notification to a Cloud Pub/Sub topic that triggers a Cloud Function to approve the deployment.

Question 12

A fintech company deploys a critical payment service on GKE using Cloud Deploy with a canary deployment strategy. They want to automatically roll back if the canary release causes an increase in error rates over 1%. They have set up Cloud Monitoring to expose a custom metric 'error_rate' from the service. They want Cloud Deploy to evaluate this metric during the canary phase and roll back if the threshold is exceeded. What is the minimal configuration needed?

Accepted Answer

In the Skaffold configuration, define a 'verify' section with a 'stackdriverMetrics' verification job that queries the 'error_rate' metric and sets a threshold. In Cloud Deploy, ensure the rollout strategy is 'canary' and no manual approval is required.. Cloud Deploy supports 'canaryDeployment' with phases and requires a verification job that queries Stackdriver metrics. Defining a 'stackdriverMetrics' verification job in the Skaffold configuration achieves this. Option B is incorrect because the rollout strategy 'strategy' is not a top-level field; it's part of the pipeline. Option C is incorrect because Cloud Deploy does not inherently know the metrics; a verification job must be defined. Option D is incorrect because additional phases are not needed and don't enable metric evaluation.

Answer

Install the Cloud Operations agent on the GKE nodes and configure Cloud Deploy to read the 'error_rate' metric from Cloud Monitoring by default.

Answer

Set the Cloud Deploy pipeline's 'strategy' field to 'canary' and set 'autoRollback: true' on the release.

Answer

Create a Cloud Deploy rollout with multiple phases and add a 'stackdriverMetrics' job to the 'postDeploy' phase.

Question 13

Refer to the exhibit. A DevOps engineer is debugging a Cloud Build pipeline that fails after the second step. The error indicates that the docker push fails with a permission denied error. The service account used by Cloud Build has the roles/storage.objectAdmin role on the project. What is the most likely cause of the failure?

Accepted Answer

The Cloud Build service account needs the roles/artifactregistry.writer role.. The service account has storage.objectAdmin which grants access to Cloud Storage, not Artifact Registry. Pushing to Artifact Registry requires the roles/artifactregistry.writer (or admin) role. Option A is too vague. Option D is already performed in the first step. Option B is less likely as the path appears correct. Option C correctly identifies the missing role.

Answer

The docker push command uses an incorrect repository path.

Answer

The service account does not have permission to push to Artifact Registry.

Answer

The gcloud auth configure-docker step must be run for Artifact Registry.

Question 14

A company runs a CI/CD pipeline using Cloud Build and Cloud Deploy for a web application. The pipeline builds a container image, pushes it to Artifact Registry, and then deploys it to a GKE cluster using Cloud Deploy. Recently, the deployment step started failing with the error: 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry.' The container image is built in the same project as the target cluster. The Cloud Build service account has been granted the roles/cloudbuild.builds.builder and roles/artifactregistry.admin on the project. The DevOps engineer verified that the image exists in Artifact Registry and the path is correct. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Ensure that the Cloud Deploy delivery pipeline references the correct image path, including the project ID and repository.. The error 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry' indicates that the Cloud Deploy delivery pipeline is referencing an image path that does not match the actual location of the image. Even though the image exists in Artifact Registry and the path appears correct, Cloud Deploy validates the image reference (including project ID, repository name, and image tag) against the target project's registry. The engineer must ensure the delivery pipeline YAML or configuration explicitly specifies the correct full image path, including the project ID and repository, so that Cloud Deploy can resolve and verify the image during release creation.

Answer

Reconfigure Cloud Build to store images in a different Artifact Registry repository.

Answer

Grant the Cloud Deploy service account the roles/artifactregistry.reader role on the project.

Answer

Change the Cloud Build service account to include the roles/clouddeploy.jobRunner role.

Question 15

A DevOps team manages a Go microservice on Cloud Run and uses Cloud Build for CI/CD. After a successful build and push of the container image, they want the new revision deployed and all traffic switched to it only after the revision passes a health check performed by Cloud Run itself, not by the pipeline. Which Cloud Build step configuration should they use?

Accepted Answer

Add a Cloud Build step that runs `gcloud run deploy myservice --image=... --no-traffic`, then poll the revision status with `gcloud run revisions describe` until it is ready, and finally run `gcloud run services update-traffic myservice --to-latest`.. Cloud Run's health check is performed internally after a revision is deployed, and traffic is not shifted until the revision is ready. To ensure traffic switches only after a successful health check, the pipeline must deploy with --no-traffic, wait for the revision to become ready, then update traffic. This separates deployment from traffic routing and leverages Cloud Run's own readiness check.

Answer

Use `gcloud run deploy myservice --image=...` and rely on Cloud Run's built-in health check to automatically roll back if the revision fails.

Answer

Run `gcloud run deploy myservice --image=... --no-traffic` and then `gcloud run services update-traffic myservice --to-latest` in a subsequent build step.

Answer

Use `gcloud run deploy myservice --image=... --set-env-vars=HEALTH_CHECK=true` and configure a Cloud Build trigger to monitor the service's health endpoint before promoting.