PCDOE Building and implementing CI/CD pipelines Practice Test 3 — 15 Questions

Question 1

Which TWO are best practices for implementing CI/CD on Google Cloud?

Accepted Answer

Use Artifact Registry for storing container images.. Artifact Registry is the recommended service for storing, managing, and securing container images and other artifacts in Google Cloud. It integrates natively with Cloud Build, Cloud Run, and Kubernetes, providing vulnerability scanning and IAM-based access control, which are essential for a secure CI/CD pipeline.

Answer

Use Cloud Run for all services.

Answer

Use Cloud Build for all deployments, including infrastructure changes.

Answer

Use GitHub Actions instead of Cloud Build.

Question 2

Which THREE are benefits of migrating from Jenkins to Cloud Build?

Accepted Answer

No server maintenance. Cloud Build is a fully managed CI/CD service that runs on Google Cloud's infrastructure, eliminating the need for users to provision, configure, or maintain build servers. Unlike Jenkins, which requires ongoing administration of the Jenkins master and agent nodes, Cloud Build automatically scales resources and handles underlying server maintenance, including OS patches and hardware failures.

Answer

Support for any VCS

Answer

Built-in security scanning

Question 3

A company uses Cloud Source Repositories and Cloud Build to build and deploy a Node.js application to Google Kubernetes Engine (GKE). The build step fails intermittently with an error 'npm ERR! network timeout'. What is the most efficient way to reduce build failures?

Accepted Answer

Configure npm to use a proxy and increase the timeout in the build step.. Configuring npm to use a proxy and increasing the timeout directly addresses network timeouts during package downloads. Option B is incorrect because using Artifact Registry to cache npm packages changes the registry URL but does not mitigate intermittent network timeouts; the npm client still needs to reach the registry. Option C is incorrect because setting the build to retry on failure in Cloud Build trigger only retries the entire build, which is inefficient and still may fail repeatedly due to the same timeout. Option D is incorrect because increasing the machine type does not resolve network timeouts; it only provides more CPU/memory.

Answer

Use Artifact Registry to cache npm packages and change npm registry url.

Answer

Set the build to retry on failure in the Cloud Build trigger configuration.

Answer

Increase the machine type to e2-highmem-4 in the cloudbuild.yaml.

Question 4

A DevOps team wants to automate the deployment of a containerized application to multiple GKE clusters across different regions. They are using Cloud Build to build the container and Cloud Deploy for deployment. Which Cloud Deploy resource should they configure to define the deployment order and target clusters?

Accepted Answer

A delivery pipeline with multiple targets defined.. A delivery pipeline in Cloud Deploy defines the deployment order and target clusters, allowing you to specify a sequence of targets (e.g., dev, staging, prod) across different GKE clusters. Option A is incorrect because a Cloud Build trigger initiates builds but does not define deployment order or targets. Option B is incorrect because a rollout object targets a single target, not multiple. Option D is incorrect because a release configuration represents a specific version of an application, not the deployment pipeline.

Answer

Cloud Build trigger with a multi-cluster deployment step.

Answer

A rollout object with target clusters specified.

Answer

A Cloud Deploy release configuration.

Question 5

During a Cloud Build pipeline, a build step fails because the Docker image tag already exists in Container Registry. The team wants to avoid overwriting tags. What is the best practice to resolve this?

Accepted Answer

Use the commit SHA as the image tag in the build step.. Using the commit SHA as the image tag guarantees uniqueness because each commit produces a distinct SHA. This prevents tag collisions in Container Registry without overwriting, as the SHA is immutable for that commit. It also provides traceability back to the exact source code version that produced the image.

Answer

Specify the :latest tag and always push to that tag.

Answer

Add a step to pull the image before building to ensure it's present.

Answer

Configure the build to retry on failure with a backoff.

Question 6

A company uses Cloud Build to deploy a microservices application to Google Kubernetes Engine (GKE). They want to integrate Container Analysis to scan images for vulnerabilities before deployment. What is the minimal set of changes needed to achieve this?

Accepted Answer

Enable the Container Analysis API; no changes to the build configuration are needed.. Enabling the Container Analysis API allows Cloud Build to automatically scan container images for vulnerabilities when they are pushed to Container Registry or Artifact Registry. No additional build steps or configuration changes are required. Option B is incorrect because migrating to Artifact Registry is not minimal; Container Analysis works with both registries. Option C is incorrect because Cloud Build already integrates with Container Analysis, so adding a separate scanner is unnecessary. Option D is incorrect because Binary Authorization is a policy enforcement tool that uses scan results but does not perform scanning itself.

Answer

Migrate images from Container Registry to Artifact Registry and enable vulnerability scanning there.

Answer

Add a build step to run a vulnerability scanner CLI tool before pushing the image.

Answer

Enable Binary Authorization to block deployment of vulnerable images.

Question 7

A DevOps engineer is setting up a CI/CD pipeline for a Python application using Cloud Build. The build takes too long because pip install is downloading packages every time. What is the best approach to speed up the build?

Accepted Answer

Configure a volume mount to a Cloud Storage bucket for pip cache and set PIP_CACHE_DIR.. Configuring a volume mount to a Cloud Storage bucket for pip cache and setting PIP_CACHE_DIR allows packages to be cached across builds, significantly reducing download time. Option A is incorrect: custom base images require maintenance and may not cover all dependencies. Option B is incorrect: increasing machine type does not address the network-bound pip download bottleneck. Option C is incorrect: Kaniko cache is for Docker image layer caching, not for pip package caching.

Answer

Use a custom base image that includes all dependencies pre-installed.

Answer

Increase the machine type to a higher CPU and memory instance.

Answer

Use Kaniko cache in Cloud Build with a remote cache location.

Question 8

A team is using Cloud Build to build and deploy to multiple environments (dev, staging, prod) using Cloud Deploy. They want to ensure that only builds from the main branch are promoted to prod. How should they configure this?

Accepted Answer

Configure a Cloud Deploy promotion with an approval gate required for the prod target.. Cloud Deploy's approval gate feature allows you to require manual approval before a release is promoted to a specific target, such as prod. By configuring an approval gate on the prod target, you ensure that only builds from the main branch (which can be verified via the release metadata or source) are manually approved for promotion, providing a controlled, auditable gate. This approach directly enforces the branch-based promotion policy without relying on build-time filtering or IAM restrictions.

Answer

Use Cloud Build tags to mark builds from the main branch and filter in Cloud Deploy.

Answer

Set IAM policies on the Container Registry or Artifact Registry to restrict access to the prod image.

Answer

Set the Cloud Build trigger to only run on the main branch.

Question 9

A company uses Cloud Build with a private pool in a shared VPC to access on-premises resources. Several builds fail intermittently with 'failed to connect to backend' errors when trying to pull from a private npm registry hosted on-premises. The error occurs only during peak hours. What is the most likely cause?

Accepted Answer

The private pool has insufficient worker count or is too small, causing connectivity timeouts.. The intermittent 'failed to connect to backend' errors during peak hours point to resource exhaustion in the private pool. Private pools have a fixed number of workers; when all workers are busy, new builds must wait, and if the queue or connection timeout is exceeded, the build fails. This is a classic capacity issue, not a DNS, certificate, or firewall problem.

Answer

The DNS resolution for the private npm registry is failing due to caching issues.

Answer

The private pool's service account does not have the correct SSL certificates.

Answer

The Cloud NAT IP addresses have been blocked by the on-premises firewall.

Question 10

A team implements canary deployments using Cloud Deploy and deploys to GKE. They want to automatically roll back if the canary release's error rate exceeds 5% within 10 minutes. Which approach should they use?

Accepted Answer

Set up Cloud Deploy with a rollout strategy that uses Cloud Monitoring metrics to automatically rollback.. Cloud Deploy can leverage Cloud Monitoring metrics as part of a rollout strategy to automatically roll back a canary deployment when the error rate exceeds a defined threshold (e.g., 5% within 10 minutes). Options A is incorrect because Spinnaker is not native to GCP and does not integrate seamlessly with Cloud Deploy; also Spinnaker is not the recommended tool for this scenario. Option B is incorrect because Cloud Build is intended for building and testing artifacts, not for real-time monitoring and rollback of deployments. Option C is incorrect because a rolling update strategy does not support canary deployments or metric-based automatic rollback; it simply replaces pods gradually.

Answer

Deploy using Spinnaker on GKE with a canary pipeline that includes an automated rollback step.

Answer

Configure a Cloud Build step to monitor the canary and rollback if needed.

Answer

Use a GKE rolling update strategy within the deployment manifest.

Question 11

Which TWO options are valid methods to trigger a Cloud Build build when code is pushed to a Cloud Source Repository?

Accepted Answer

Use a Cloud Pub/Sub message sent to the Cloud Build topic to create a build.. Options A and D are correct. Cloud Build triggers can be based on branch or tag push, and can also be triggered via Pub/Sub message. Option B is incorrect - Cloud Build does not directly listen to Cloud Pub/Sub subscriptions without a trigger. Option C is incorrect - builds are not automatically triggered by Cloud Logging. Option E is incorrect - Cloud Scheduler cannot directly trigger a build without a Pub/Sub or HTTP intermediary.

Answer

Have Cloud Logging monitor the repository and create a build via a logs-based metric.

Answer

Set up a Cloud Pub/Sub subscription that forwards events to Cloud Build.

Answer

Configure Cloud Scheduler to call the Cloud Build API periodically.

Question 12

Which TWO deployment strategies are directly supported by Cloud Deploy for GKE?

Accepted Answer

Canary. Options C and E are correct. Cloud Deploy for GKE directly supports canary (C) and blue-green (E) deployment strategies. Option A (Rolling update) is incorrect because rolling updates are managed natively by GKE itself, not as a Cloud Deploy strategy. Option B (A/B testing) is incorrect; A/B testing is a traffic management technique but not a built-in deployment strategy in Cloud Deploy. Option D (Shadow) is incorrect; shadow deployments are not supported by Cloud Deploy.

Answer

Rolling update

Answer

A/B testing

Answer

Shadow

Question 13

Which THREE are best practices for securing a CI/CD pipeline on Google Cloud?

Accepted Answer

Use Secret Manager to securely pass credentials to build steps.. Options A, B, and E are correct. Using Secret Manager (A) securely passes credentials without hardcoding or storing them in repos. Binary Authorization (B) ensures only signed, trusted container images are deployed, preventing tampering. Cloud Build private pools (E) provide isolated, controlled build environments, reducing exposure. Option C is incorrect because public pools may be less secure and not recommended for sensitive workloads. Option D is incorrect because storing service account keys in source repos is a security risk.

Answer

Run builds on the publicly hosted pool for better scalability.

Answer

Store service account keys in the source repository for build steps to use.

Question 14

A team uses Cloud Build with a trigger on Cloud Source Repository. The build fails intermittently with error 'Failed to pull builder image 'gcr.io/cloud-builders/gcloud'' but sometimes succeeds. What is the most likely cause?

Accepted Answer

Network egress from Cloud Build is throttled due to high concurrency.. The intermittent failure to pull the builder image 'gcr.io/cloud-builders/gcloud' indicates a transient network issue rather than a permanent misconfiguration. Cloud Build uses a shared pool of network resources, and under high concurrency, egress traffic to Container Registry can be throttled, causing pull operations to time out or fail. This explains why the build sometimes succeeds and sometimes fails, as throttling depends on the current load.

Answer

The Cloud Build worker pool is in a different region.

Answer

The builder image is too large.

Answer

The build service account lacks permissions to access Container Registry.

Question 15

A company uses Cloud Deploy for continuous delivery to GKE. They have a delivery pipeline with a rollout strategy: canary (25% for 30m) then full. The canary rollout fails because the new revision's health check errors. The team wants to automatically rollback the canary and notify. What native GCP feature can achieve this?

Accepted Answer

Configure a Cloud Deploy rollout strategy with an automated rollback policy.. Cloud Deploy supports automated rollback through its rollbackPolicy configuration in the delivery pipeline. When a rollout fails health checks, the rollbackPolicy can automatically initiate a rollback to the previous successful revision. Additionally, Cloud Deploy can integrate with Cloud Monitoring or Pub/Sub to send notifications. Option A is incorrect because while you can set up an alert and Cloud Function, that is not a native feature of Cloud Deploy and requires custom implementation. Option B is incorrect because Cloud Build triggers are meant for building and testing, not for rollback automation. Option D is incorrect because post-deploy hooks are for custom actions after deployment, not for automatic rollback on failure.

Answer

Configure Cloud Monitoring alerting policy on deployment errors that triggers a Cloud Function to rollback.

Answer

Set up a Cloud Build trigger that detects deployment failure and runs a rollback.

Answer

Use a Cloud Deploy rollout strategy with a post-deploy hook that calls Cloud Run jobs to revert.