PCDOE Building and implementing CI/CD pipelines Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. A team uses this cloudbuild.yaml to deploy a service to Cloud Run. They notice that the deployment fails intermittently with a 'permission denied' error. Which is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the `roles/run.admin` or `roles/run.developer` role. The Cloud Build service account (default or custom) must have the `roles/run.admin` or `roles/run.developer` IAM role to execute `gcloud run deploy`. Without these roles, the deployment fails with a 'permission denied' error because the service account lacks the `run.services.create` and `run.services.update` permissions required to deploy or update a Cloud Run service. The intermittent nature suggests the service account may have been granted the role after some failures, or the error only surfaces when the service account's cached credentials expire.

Answer

The image tag $SHORT_SHA is invalid because it contains a variable

Answer

The region in the gcloud run deploy command does not match the region where Cloud Run is enabled

Answer

The Cloud Build service account does not have permission to push images to Artifact Registry

Question 2

Your team manages a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). The pipeline uses Cloud Build to build container images and push them to Artifact Registry, then uses a Cloud Build step with kubectl to apply Kubernetes manifests stored in a separate 'manifests' repository. Recently, the team has experienced issues: sometimes a new image is deployed to production even though the corresponding pull request (PR) has not been merged into the main branch of the manifests repository. Also, rollbacks are slow because the previous image tag is overwritten. The team wants to ensure that only code that passes all tests and is merged to main is deployed, and that each deployment uses a unique immutable image tag. What should the team do?

Accepted Answer

Consolidate application code and Kubernetes manifests into a single repository. Configure Cloud Build triggers to build and run tests on all branches, but only deploy to GKE when changes are merged to the main branch. Use the full commit SHA as the image tag.. Option B is correct because consolidating the application code and Kubernetes manifests into a single repository ensures that the image tag (full commit SHA) is uniquely tied to the exact code and manifest changes that passed all tests. By configuring Cloud Build triggers to deploy only on merges to the main branch, the team guarantees that only fully tested, merged code reaches production. Using the full commit SHA as the image tag provides immutability and enables fast, precise rollbacks by referencing the exact image from Artifact Registry.

Answer

Keep the current architecture but modify Cloud Build triggers to only run on the main branch of both repositories. Use the short SHA ($SHORT_SHA) as the image tag.

Answer

Move all source code and manifests into a single repository. Use Cloud Build triggers to build and test on every push, and deploy only on pushes to the main branch. Use the commit SHA ($COMMIT_SHA) as the image tag.

Answer

Keep application and manifests in separate repositories. Use Cloud Build triggers to build on changes to the app repo, and use a separate trigger on the manifests repo to deploy. Use the 'latest' tag for the image.

Question 3

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Question 4

Match each Google Cloud deployment strategy to its description.

Question 5

A team is using Cloud Build to build a Docker image and push to Artifact Registry. After each build, they want to automatically trigger a deployment to Cloud Run. What is the best way to achieve this?

Accepted Answer

Configure a Cloud Run trigger on Artifact Registry push.. Option C is correct because Cloud Run natively supports continuous deployment from Artifact Registry: when a new image is pushed to the registry, Cloud Run can automatically deploy the latest image without requiring an external pipeline or scheduler. This is the simplest and most direct approach, as it eliminates the need for additional CI/CD orchestration while ensuring deployments happen immediately after each successful build.

Answer

Use Cloud Build builder to deploy to Cloud Run in the same pipeline.

Answer

Use Cloud Deploy to manage the rollout.

Answer

Use Cloud Scheduler to periodically check for new images and deploy.

Question 6

A company has a monorepo with multiple microservices. They want to only build and deploy the service that changed. What CI/CD practice should they implement?

Accepted Answer

Use git diff to conditionally run steps for changed services.. Using git diff to detect changes in specific paths allows conditional build steps in Cloud Build, triggering only the affected service.

Answer

Use a multi-branch pipeline where each branch represents a service.

Answer

Use Cloud Build triggers with inline substitution for each service.

Answer

Use separate repositories for each service.

Question 7

A team is implementing a CI/CD pipeline for a Kubernetes application. They want to use canary deployments with traffic splitting. Which tool or service is best suited for this?

Accepted Answer

Cloud Deploy with Skaffold. Cloud Deploy with Skaffold is best suited for canary deployments with traffic splitting because Cloud Deploy provides built-in support for progressive delivery strategies, including canary and blue-green deployments, and integrates with Skaffold to manage Kubernetes manifests and traffic routing via service mesh or ingress controllers. Skaffold handles the build and deploy stages, while Cloud Deploy orchestrates the rollout with automated traffic splitting and promotion/rollback logic, making it the only option that directly addresses the requirement.

Answer

Cloud Run

Answer

Cloud Build

Answer

Anthos Config Management

Question 8

During a Cloud Build execution, a step fails due to timeout. What is the first thing to check?

Accepted Answer

Check the build logs for errors. When a Cloud Build step fails due to a timeout, the build logs are the first and most authoritative source of diagnostic information. They contain the exact error messages, exit codes, and step output that reveal why the step exceeded its timeout — for example, a hanging command, a missing dependency, or a resource contention issue. Checking logs before making any configuration changes ensures you address the root cause rather than treating symptoms.

Answer

Check network connectivity

Answer

Increase machine type for the build

Answer

Increase the timeout in cloudbuild.yaml

Question 9

A company uses Cloud Source Repositories and wants automatic builds on pull requests to the main branch. Which Cloud Build trigger type should they configure?

Accepted Answer

Pull request (any). A pull request trigger in Cloud Build allows you to run builds automatically when a pull request is opened, synchronized, or updated.

Answer

Pull request (comment)

Answer

Push to a branch

Answer

Tag push

Question 10

A CI/CD pipeline must deploy to multiple environments (dev, staging, prod) with manual approval required before prod deployment. Which Google Cloud service is best for orchestrating this?

Accepted Answer

Cloud Deploy with promotion. Cloud Deploy provides a delivery pipeline with sequential stages and manual approval gates, making it ideal for multi-environment deployments.

Answer

Spinnaker

Answer

Jenkins on GKE

Answer

Cloud Build with manual steps

Question 11

A build step needs to access a secret stored in Secret Manager. How should the secret be passed to the build step?

Accepted Answer

Use availableSecrets in cloudbuild.yaml. Cloud Build's availableSecrets field allows you to securely access secrets from Secret Manager and inject them as environment variables or volumes.

Answer

Use an environment variable with the secret directly in cloudbuild.yaml

Answer

Use gcloud command inside the build step to fetch the secret

Answer

Use a script to fetch the secret from an encrypted file

Question 12

A team wants to ensure zero-downtime deployments for a Cloud Run service. They plan to gradually shift traffic from the current revision to the new one. What should they configure?

Accepted Answer

Use Cloud Run's traffic splitting feature to slowly increase traffic to the new revision. Cloud Run supports traffic splitting, allowing you to gradually send a percentage of traffic to the new revision to monitor health before fully switching.

Answer

Use Cloud Build to directly replace the revision

Answer

Set traffic to 100% on the new revision gradually using multiple updates

Answer

Configure a rolling update strategy in Cloud Deploy

Question 13

A company is using Cloud Build to build a Go application. The build fails with an error 'no Go files in /workspace'. What is the most likely cause?

Accepted Answer

The build step is running in the wrong directory.. Cloud Build copies the repository contents to /workspace. If the Go source files are in a subdirectory, the build step might be pointing to the wrong directory.

Answer

The repository has no Go files.

Answer

The Go module is not properly initialized.

Answer

Cloud Build is unable to clone the repository.

Question 14

Which TWO are benefits of using Cloud Build private pools?

Accepted Answer

Dedicated VMs for builds. Option B is correct because Cloud Build private pools provide dedicated VMs that are not shared with other Google Cloud projects. This isolation ensures consistent performance and eliminates the 'noisy neighbor' effect that can occur in public pools, where build resources are shared across multiple tenants.

Answer

Lower cost

Answer

No internet access

Answer

Faster builds compared to public pools

Question 15

Which TWO are best practices for implementing CI/CD on Google Cloud?

Accepted Answer

Use Artifact Registry for storing container images.. Option B is correct because Artifact Registry is the recommended service for storing, managing, and securing container images and other artifacts in Google Cloud. It integrates natively with Cloud Build, Cloud Run, and Kubernetes, providing vulnerability scanning and IAM-based access control, which are essential for a secure CI/CD pipeline.

Answer

Use Cloud Run for all services.

Answer

Use Cloud Build for all deployments, including infrastructure changes.

Answer

Use GitHub Actions instead of Cloud Build.