PCDOE Building and implementing CI/CD pipelines Practice Test 3 — 15 Questions

Question 1

Your Cloud Build pipeline builds a container image and pushes it to Artifact Registry. You need to ensure that only images that pass a vulnerability scan are deployed, and that the scan result is recorded as a build artifact. Which approach should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Container Analysis to automatically scan images pushed to Artifact Registry, and use a Cloud Build step to query the scan results and fail if critical vulnerabilities are present.. Container Analysis provides automatic vulnerability scanning for images in Artifact Registry. By querying these results within a Cloud Build step, you can enforce a policy that fails the build when critical vulnerabilities are detected. This ensures that only compliant images proceed, and the scan results are available as build artifacts for auditing.

Answer

Enable Binary Authorization in the cluster and rely on it to block deployment of vulnerable images.

Answer

Add a step that runs `gcloud artifacts docker images scan` and fails the build if vulnerabilities are found.

Answer

Use a custom Cloud Build step that runs Trivy to scan the image and writes the result to a Cloud Storage bucket.

Question 2

A retail company runs its CI/CD on Google Cloud. Their Cloud Build pipeline builds a container image and pushes it to Artifact Registry. They need to ensure that only images that pass a vulnerability scan are deployed to production. The pipeline currently does not include any security scanning. Which approach should they take to integrate vulnerability scanning into the pipeline and enforce the policy?

Accepted Answer

Use Container Analysis to scan the image after it is pushed to Artifact Registry, and configure a Binary Authorization policy to only allow images with no critical vulnerabilities.. Container Analysis provides automated vulnerability scanning for images in Artifact Registry. By combining it with Binary Authorization, you can enforce that only images meeting the security policy (e.g., no critical vulnerabilities) are deployed. This creates a secure CI/CD pipeline where scanning and enforcement are automated and integrated.

Answer

Add a step in Cloud Build that runs 'gcloud container images scan' on the image and fails the build if vulnerabilities are found.

Answer

Configure a Cloud Build trigger that runs a custom script to pull the image, run a local vulnerability scanner, and then push the image again if it passes.

Answer

Enable the Artifact Registry vulnerability scanning feature and set up a Cloud Monitoring alert to notify the security team when vulnerabilities are found.

Question 3

A gaming company runs its build infrastructure on Google Cloud. Their security team mandates that Cloud Build workers never use public IP addresses and that all traffic to internal services stays within their VPC. They also need build logs to be viewable in the Cloud Console for 90 days. Which TWO configurations are required when creating a private pool with gcloud builds worker-pools create? (Choose two.)

Accepted Answer

--no-public-ip. To meet the no-public-IP and VPC-internal traffic requirements, the private pool must be created with a peered network and the no-public-ip flag. These two settings together ensure workers have only private addresses and can reach internal services via VPC peering. Log retention is managed separately in Cloud Logging, not during pool creation.

Answer

--log-retention-days=90

Answer

--region=us-central1

Answer

--worker-machine-type=e2-medium

Question 4

Your organization uses Cloud Deploy to manage progressive rollouts to GKE. A delivery pipeline defines a canary deployment strategy that deploys 25% of pods, waits 30 minutes, then deploys the remaining 75%. During a recent rollout, the canary phase completed successfully, but the final phase failed because the new pods could not start due to a missing ConfigMap that is created by a separate pipeline. You need to ensure that the ConfigMap is available before the canary phase begins. What should you do?

Accepted Answer

Configure the delivery pipeline to use a predeploy hook that verifies the ConfigMap exists in the target cluster before proceeding.. A predeploy hook executes before the deployment is applied, allowing you to verify that prerequisites like a ConfigMap exist. This prevents the canary pods from starting without the required configuration. Deploy and postdeploy hooks run after the deployment, which is too late. Simply adding a hook to create the ConfigMap might not ensure it is available if the separate pipeline has not run yet; verification is more robust.

Answer

Add a predeploy hook to the canary phase that applies the ConfigMap.

Answer

Add a postdeploy hook to the canary phase that waits for the ConfigMap to be created.

Answer

Use a deploy hook in the canary phase to create the ConfigMap.

Question 5

A team runs a high-volume CI/CD pipeline on Google Cloud Build. Builds execute in the default Cloud Build worker pool and frequently fail with the error `context deadline exceeded` when pulling base images from Docker Hub. The team wants to eliminate these failures without changing the Dockerfile or moving the images to Artifact Registry. What should they do?

Accepted Answer

Authenticate to Docker Hub by storing credentials in Secret Manager and referencing them in the Cloud Build configuration.. Docker Hub imposes strict rate limits on anonymous image pulls, which causes timeouts in high-volume Cloud Build pipelines. Authenticating with Docker Hub credentials stored in Secret Manager and exposing them to build steps via `availableSecrets` and `secretEnv` raises the pull quota and removes the bottleneck. Other options address compute resources, source fetching, or nonexistent mirror features, none of which resolve the external registry throttling.

Answer

Configure the build to use a private pool with a larger machine type and increased disk size.

Answer

Enable Cloud Build's built-in Docker Hub mirror by setting the `DOCKERHUB_MIRROR` environment variable in each build step.

Answer

Use the Cloud Build GitHub App trigger with a connected repository to authenticate Docker Hub pulls.

Question 6

A media company uses Cloud Build to build and test a Node.js application. The build takes 20 minutes due to installing dependencies from npm. They want to reduce build time by caching dependencies between builds. They also want to ensure that the cache is shared across all builds in the same project. Which configuration should they use in their cloudbuild.yaml?

Accepted Answer

Configure a Cloud Storage bucket as a cache and use the 'gcs' cache option in the build step.. Cloud Build's 'gcs' cache option allows storing and retrieving cache artifacts from a Cloud Storage bucket. By configuring a cache bucket and specifying the paths to cache (e.g., node_modules), dependencies can be reused across builds. This is the recommended way to share cache across builds in the same project.

Answer

Use the 'volumes' field in the build step to mount a host directory, and set npm cache to that directory.

Answer

Mount a persistent disk to the build worker and configure npm to use it as cache directory.

Answer

Use Cloud Build's built-in npm cache by setting the environment variable NPM_CONFIG_CACHE to /workspace/.npm.

Question 7

A DevOps team is building a CI/CD pipeline with Cloud Build that runs integration tests against a Cloud SQL for PostgreSQL instance. The security policy prohibits public IPs, and the build must connect over the private network. The team has configured a private pool and attached it to the VPC network. However, the build step that runs `psql` fails with a connection timeout. Which configuration change should they make?

Accepted Answer

Add a firewall rule in the VPC that allows ingress from the private pool's peered network range to the Cloud SQL instance on port 5432.. Private pools use VPC peering, so the peered network must have a firewall rule allowing traffic from the pool's IP range to the Cloud SQL instance on the database port. The other options address CPU, a different connectivity method, or IAM permissions that do not affect raw network reachability. Only the firewall rule enables the required private connection.

Answer

Enable the Cloud SQL Admin API and grant the Cloud Build service account the `cloudsql.instances.connect` permission.

Answer

Configure the build to use Serverless VPC Access by setting `options.vpcAccess` in the Cloud Build configuration.

Answer

Set the build's `options.machineType` to a higher CPU tier to increase network throughput.

Question 8

A company runs a CI/CD pipeline on Google Cloud. Their security team requires that all container images used in production are built from trusted source code and that any vulnerability is detected before deployment. They want to automatically scan images for known vulnerabilities and block deployment if any critical vulnerability is found. Which Google Cloud service should they integrate into their pipeline?

Accepted Answer

Cloud Build with a custom build step that calls the Container Analysis API and fails the build if critical vulnerabilities are found.. To automatically scan for vulnerabilities and block deployment, the pipeline must include a step that performs the scan and conditionally fails. Cloud Build can run a custom step that queries Container Analysis or uses the built-in scanner, and then exits with a non-zero status if critical vulnerabilities are present, thereby stopping the pipeline before deployment. This provides the required enforcement.

Answer

Artifact Registry

Answer

Container Analysis

Answer

Binary Authorization

Question 9

A retail company uses Cloud Build to build and deploy a Java application to Google Kubernetes Engine (GKE). They want to implement a CI/CD pipeline that automatically deploys to a staging GKE cluster on every commit to the develop branch, and to a production GKE cluster on every commit to the main branch, but only after a manual approval. They also want to minimize the number of Cloud Build triggers. What should they do?

Accepted Answer

Create two Cloud Build triggers: one for develop branch that deploys to staging, and one for main branch that deploys to production. Use Cloud Deploy to manage the deployment to production with a manual approval before the rollout.. Using two Cloud Build triggers separates staging and production deployments. For production, Cloud Deploy provides a manual approval gate before rollout, which is a native feature. This approach is efficient and meets the requirements without custom scripting.

Answer

Create a single Cloud Build trigger that runs on both develop and main branches. In the build config, use a conditional step to deploy to staging for develop and to production for main. Use Cloud Build's approval feature for the production step.

Answer

Create two Cloud Build triggers: one for develop branch that deploys to staging, and one for main branch that deploys to production. Use Cloud Build's approval feature to require manual approval for the production trigger.

Answer

Create a single Cloud Build trigger for the main branch that deploys to both staging and production sequentially, with a manual approval step implemented using a custom Cloud Build step that waits for a Pub/Sub message.

Question 10

A fintech startup uses Cloud Build to build container images and push them to Artifact Registry. Their security policy requires that all images are scanned for vulnerabilities before deployment, and that builds fail if any CRITICAL severity vulnerability is found. They want to implement this as part of their CI pipeline. What should they do?

Accepted Answer

Configure the Artifact Registry repository with vulnerability scanning enabled, then add a Cloud Build step that uses the gcloud artifacts vulnerabilities list command with a filter for severity=CRITICAL and fails the build if any results are returned.. The correct approach is to enable vulnerability scanning on the Artifact Registry repository and then use the gcloud artifacts vulnerabilities list command with a severity filter in a Cloud Build step. This command directly queries the scan results and can be scripted to fail the build if any CRITICAL vulnerabilities are present, meeting the security policy.

Answer

Enable Container Scanning API on the Artifact Registry repository and configure a Cloud Build step that queries the scan results using gcloud artifacts docker images list --show-occurrences and fails if critical vulnerabilities exist.

Answer

Create a Cloud Build trigger that runs a custom script using the Container Analysis API client library to fetch all occurrences, then manually filter for CRITICAL severity and fail the build if found.

Answer

Use the gcr.io/cloud-builders/gcloud builder to run gcloud artifacts docker images scan, then parse the output for CRITICAL vulnerabilities and exit with a non-zero code if any are found.

Question 11

A company uses Cloud Build to build and test a Node.js application. The build takes 20 minutes because it installs dependencies from npm every time. The team wants to reduce build time by caching the node_modules directory between builds. They use a Cloud Build configuration file (cloudbuild.yaml) and a private pool. Which approach should they use to cache dependencies efficiently?

Accepted Answer

Use a persistent volume in the private pool to cache node_modules across builds.. Private pools in Cloud Build can mount a persistent volume that persists across builds. By caching node_modules on this volume, subsequent builds can reuse installed dependencies, drastically reducing build time. Other methods like Cloud Storage or image layer caching are less direct and may not provide the same performance benefits. The persistent volume is specifically designed for this use case in private pools.

Answer

Use Kaniko to build the image, which automatically caches dependencies.

Answer

Store node_modules in a Cloud Storage bucket and copy it in and out of the build.

Answer

Enable the 'cache' option in the Cloud Build trigger to automatically cache all build artifacts.

Question 12

Your team uses Cloud Build triggers to build container images on every commit to a GitHub repository. You need to ensure that only images that pass a vulnerability scan are pushed to Artifact Registry, and that the scan results are attached as attestations for later binary authorization. Which approach should you take?

Accepted Answer

Configure the Cloud Build trigger to run a vulnerability scanning step using the gcr.io/cloud-builders/gcloud image with the `gcloud artifacts docker images scan` command, and then push the image only if the scan passes.. The correct approach is to integrate vulnerability scanning directly into the Cloud Build pipeline and conditionally push based on scan results. The `gcloud artifacts docker images scan` command triggers a scan, and you can then check the results before pushing. Attestations can be created using the Container Analysis API, which allows later enforcement via Binary Authorization. This ensures only compliant images enter the registry.

Answer

Enable the Container Scanning API on the Artifact Registry repository; it will automatically scan images upon push and prevent vulnerable images from being stored.

Answer

Use Cloud Build's built-in security insights to automatically block vulnerable images, and rely on the default attestation generation.

Answer

Set up a Cloud Build trigger that pushes the image to Artifact Registry, then uses a separate Cloud Function to scan the image and delete it if vulnerabilities are found.

Question 13

A company uses Cloud Deploy to manage releases to multiple GKE clusters across dev, staging, and prod. They want to ensure that a rollout to prod only proceeds after a manual approval, and that the approval is granted by a member of a specific Google Group. They also want to audit who approved each rollout. Which two actions should they take? (Choose two.)

Accepted Answer

Use the `gcloud deploy rollouts approve` command to approve the paused rollout, and rely on Cloud Audit Logs to record the approver's identity.. Manual approval in Cloud Deploy is achieved by pausing a rollout and then having a user with the `roles/clouddeploy.approver` role resume it using `gcloud deploy rollouts approve`. Granting that role to the Google Group ensures only group members can approve, and Cloud Audit Logs automatically record the approval action. Other options either describe unsupported fields or mechanisms that do not enforce human approval or group-based permissions.

Answer

Add a `requireApproval` field to the prod target's deployment strategy in the delivery pipeline configuration.

Answer

Create a Cloud Deploy automation that pauses the prod rollout and requires an approval.

Answer

Configure the prod target with `executionConfig.privatePool` to isolate approval actions.

Question 14

A DevOps engineer is configuring a Cloud Build trigger to build and deploy a containerized application to GKE. The trigger must only run when changes are pushed to the `main` branch, and it must use a specific service account with least privilege. The build should also cache dependencies to speed up builds. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Specify a custom service account in the trigger's `serviceAccount` field with only the necessary IAM roles.. To restrict the trigger to the main branch, set the branch filter to `^main$`. To use a specific service account with least privilege, specify it in the trigger's `serviceAccount` field. These two actions directly satisfy the requirements. The other options either do not address caching or misrepresent Cloud Build features.

Answer

Add a `volumes` section to the build config to mount a persistent disk for caching.

Answer

Enable the `options.diskSizeGb` field to increase the disk size for caching.

Answer

Set the `options.logging` field to `GCS_ONLY` to reduce build latency.

Question 15

A media company uses Cloud Deploy to manage deployments to their GKE clusters. They have a delivery pipeline with three targets: dev, staging, and prod. They want to ensure that a deployment to prod only occurs after a manual approval, and that the approval is granted by a member of the security team. Which configuration should they implement?

Accepted Answer

In the Cloud Deploy delivery pipeline, set the prod target to require approval by adding a requireApproval field set to true, and grant the security team members the Cloud Deploy Approver role.. To enforce manual approval for prod deployments, the prod target in the Cloud Deploy delivery pipeline must have requireApproval set to true. Additionally, the security team members need the Cloud Deploy Approver role, which grants the clouddeploy.rollouts.approve permission. This combination ensures that only authorized security personnel can approve rollouts to prod.

Answer

In the Cloud Deploy delivery pipeline, set the prod target to require approval by adding a requireApproval field set to true, and grant the security team members the Cloud Deploy Operator role.

Answer

In the Cloud Deploy delivery pipeline, set the prod target to require approval by adding a requireApproval field set to true, and grant the security team members the Cloud Deploy Viewer role.

Answer

In the Cloud Deploy delivery pipeline, set the prod target to require approval by adding a approvalConfig field with the requiredApprovalCount set to 1, and grant the security team members the Cloud Deploy Approver role.