PCDOE Building and implementing CI/CD pipelines Practice Test 2 — 15 Questions

Question 1

Which TWO are benefits of using Cloud Build triggers to implement CI/CD pipelines?

Accepted Answer

Start a build automatically when changes are pushed to a repository. Cloud Build triggers can be configured to automatically start a build in response to events such as a push to a repository branch or the creation of a pull request. This event-driven automation is the foundation of a CI/CD pipeline, eliminating the need for manual build initiation and ensuring that every code change is validated immediately.

Answer

Deploy to a specific Google Cloud region based on the trigger

Answer

Support only a single branch per trigger

Answer

Automatically provision infrastructure as part of the build

Question 2

Refer to the exhibit. A team uses this cloudbuild.yaml to deploy a service to Cloud Run. They notice that the deployment fails intermittently with a 'permission denied' error. Which is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the `roles/run.admin` or `roles/run.developer` role. The Cloud Build service account (default or custom) must have the `roles/run.admin` or `roles/run.developer` IAM role to execute `gcloud run deploy`. Without these roles, the deployment fails with a 'permission denied' error because the service account lacks the `run.services.create` and `run.services.update` permissions required to deploy or update a Cloud Run service. The intermittent nature suggests the service account may have been granted the role after some failures, or the error only surfaces when the service account's cached credentials expire.

Answer

The image tag $SHORT_SHA is invalid because it contains a variable

Answer

The region in the gcloud run deploy command does not match the region where Cloud Run is enabled

Answer

The Cloud Build service account does not have permission to push images to Artifact Registry

Question 3

Your team manages a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). The pipeline uses Cloud Build to build container images and push them to Artifact Registry, then uses a Cloud Build step with kubectl to apply Kubernetes manifests stored in a separate 'manifests' repository. Recently, the team has experienced issues: sometimes a new image is deployed to production even though the corresponding pull request (PR) has not been merged into the main branch of the manifests repository. Also, rollbacks are slow because the previous image tag is overwritten. The team wants to ensure that only code that passes all tests and is merged to main is deployed, and that each deployment uses a unique immutable image tag. What should the team do?

Accepted Answer

Consolidate application code and Kubernetes manifests into a single repository. Configure Cloud Build triggers to build and run tests on all branches, but only deploy to GKE when changes are merged to the main branch. Use the full commit SHA as the image tag.. Consolidating the application code and Kubernetes manifests into a single repository ensures that the image tag (full commit SHA) is uniquely tied to the exact code and manifest changes that passed all tests. By configuring Cloud Build triggers to deploy only on merges to the main branch, the team guarantees that only fully tested, merged code reaches production. Using the full commit SHA as the image tag provides immutability and enables fast, precise rollbacks by referencing the exact image from Artifact Registry.

Answer

Keep the current architecture but modify Cloud Build triggers to only run on the main branch of both repositories. Use the short SHA ($SHORT_SHA) as the image tag.

Answer

Move all source code and manifests into a single repository. Use Cloud Build triggers to build and test on every push, and deploy only on pushes to the main branch. Use the commit SHA ($COMMIT_SHA) as the image tag.

Answer

Keep application and manifests in separate repositories. Use Cloud Build triggers to build on changes to the app repo, and use a separate trigger on the manifests repo to deploy. Use the 'latest' tag for the image.

Question 4

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Accepted Answer

Identify time, then Clone, then Verify, then Promote, then Update connections. The correct sequence for recovering a Google Cloud SQL instance from a point-in-time backup is: first, identify the exact point-in-time to recover; second, clone the instance to that time; third, verify the cloned instance's data; fourth, promote the clone to become the primary instance; and fifth, update application connections to use the new primary. This order ensures a consistent and verifiable recovery process.

Answer

Clone, then Identify time, then Verify, then Promote, then Update connections

Answer

Identify time, then Clone, then Promote, then Verify, then Update connections

Answer

Clone, then Identify time, then Promote, then Verify, then Update connections

Question 5

Match each Google Cloud deployment strategy to its description.

Accepted Answer

Blue/green deployment: Running two identical environments, only one serves traffic at a time.. Blue/green uses two environments, canary uses a small user subset, rolling updates gradually. Swapping definitions is a common distractor.

Answer

Blue/green deployment: Gradually replacing instances of the current version with the new one.

Answer

Canary deployment: Running two versions side-by-side and routing users based on test groups.

Answer

Rolling deployment: Switching traffic between two separate environments.

Question 6

A team is using Cloud Build to build a Docker image and push to Artifact Registry. After each build, they want to automatically trigger a deployment to Cloud Run. What is the best way to achieve this?

Accepted Answer

Configure a Cloud Run trigger on Artifact Registry push.. Cloud Run natively supports continuous deployment from Artifact Registry: when a new image is pushed to the registry, Cloud Run can automatically deploy the latest image without requiring an external pipeline or scheduler. This is the simplest and most direct approach, as it eliminates the need for additional CI/CD orchestration while ensuring deployments happen immediately after each successful build.

Answer

Use Cloud Build builder to deploy to Cloud Run in the same pipeline.

Answer

Use Cloud Deploy to manage the rollout.

Answer

Use Cloud Scheduler to periodically check for new images and deploy.

Question 7

A company has a monorepo with multiple microservices. They want to only build and deploy the service that changed. What CI/CD practice should they implement?

Accepted Answer

Use git diff to conditionally run steps for changed services.. Using git diff to detect changes in specific paths allows conditional build steps in Cloud Build, triggering only the affected service.

Answer

Use a multi-branch pipeline where each branch represents a service.

Answer

Use Cloud Build triggers with inline substitution for each service.

Answer

Use separate repositories for each service.

Question 8

A team is implementing a CI/CD pipeline for a Kubernetes application. They want to use canary deployments with traffic splitting. Which tool or service is best suited for this?

Accepted Answer

Cloud Deploy with Skaffold. Cloud Deploy with Skaffold is best suited for canary deployments with traffic splitting because Cloud Deploy provides built-in support for progressive delivery strategies, including canary and blue-green deployments, and integrates with Skaffold to manage Kubernetes manifests and traffic routing via service mesh or ingress controllers. Skaffold handles the build and deploy stages, while Cloud Deploy orchestrates the rollout with automated traffic splitting and promotion/rollback logic, making it the only option that directly addresses the requirement.

Answer

Cloud Run

Answer

Cloud Build

Answer

Anthos Config Management

Question 9

During a Cloud Build execution, a step fails due to timeout. What is the first thing to check?

Accepted Answer

Check the build logs for errors. When a Cloud Build step fails due to a timeout, the build logs are the first and most authoritative source of diagnostic information. They contain the exact error messages, exit codes, and step output that reveal why the step exceeded its timeout — for example, a hanging command, a missing dependency, or a resource contention issue. Checking logs before making any configuration changes ensures you address the root cause rather than treating symptoms.

Answer

Check network connectivity

Answer

Increase machine type for the build

Answer

Increase the timeout in cloudbuild.yaml

Question 10

A company uses Cloud Source Repositories and wants automatic builds on pull requests to the main branch. Which Cloud Build trigger type should they configure?

Accepted Answer

Pull request (any). A pull request trigger in Cloud Build allows you to run builds automatically when a pull request is opened, synchronized, or updated.

Answer

Pull request (comment)

Answer

Push to a branch

Answer

Tag push

Question 11

A CI/CD pipeline must deploy to multiple environments (dev, staging, prod) with manual approval required before prod deployment. Which Google Cloud service is best for orchestrating this?

Accepted Answer

Cloud Deploy with promotion. Cloud Deploy provides a delivery pipeline with sequential stages and manual approval gates, making it ideal for multi-environment deployments.

Answer

Spinnaker

Answer

Jenkins on GKE

Answer

Cloud Build with manual steps

Question 12

A build step needs to access a secret stored in Secret Manager. How should the secret be passed to the build step?

Accepted Answer

Use availableSecrets in cloudbuild.yaml. Cloud Build's availableSecrets field allows you to securely access secrets from Secret Manager and inject them as environment variables or volumes.

Answer

Use an environment variable with the secret directly in cloudbuild.yaml

Answer

Use gcloud command inside the build step to fetch the secret

Answer

Use a script to fetch the secret from an encrypted file

Question 13

A team wants to ensure zero-downtime deployments for a Cloud Run service. They plan to gradually shift traffic from the current revision to the new one. What should they configure?

Accepted Answer

Use Cloud Run's traffic splitting feature to slowly increase traffic to the new revision. Cloud Run supports traffic splitting, allowing you to gradually send a percentage of traffic to the new revision to monitor health before fully switching.

Answer

Use Cloud Build to directly replace the revision

Answer

Set traffic to 100% on the new revision gradually using multiple updates

Answer

Configure a rolling update strategy in Cloud Deploy

Question 14

A company is using Cloud Build to build a Go application. The build fails with an error 'no Go files in /workspace'. What is the most likely cause?

Accepted Answer

The build step is running in the wrong directory.. Cloud Build copies the repository contents to /workspace. If the Go source files are in a subdirectory, the build step might be pointing to the wrong directory.

Answer

The repository has no Go files.

Answer

The Go module is not properly initialized.

Answer

Cloud Build is unable to clone the repository.

Question 15

Which TWO are benefits of using Cloud Build private pools?

Accepted Answer

Dedicated VMs for builds. Cloud Build private pools provide dedicated VMs that are not shared with other Google Cloud projects. This isolation ensures consistent performance and eliminates the 'noisy neighbor' effect that can occur in public pools, where build resources are shared across multiple tenants.

Answer

Lower cost

Answer

No internet access

Answer

Faster builds compared to public pools