PCDOE Building and implementing CI/CD pipelines Practice Test 3 — 15 Questions

Question 1

Which THREE are benefits of migrating from Jenkins to Cloud Build?

Accepted Answer

No server maintenance. Option A is correct because Cloud Build is a fully managed CI/CD service that runs on Google Cloud's infrastructure, eliminating the need for users to provision, configure, or maintain build servers. Unlike Jenkins, which requires ongoing administration of the Jenkins master and agent nodes, Cloud Build automatically scales resources and handles underlying server maintenance, including OS patches and hardware failures.

Answer

Support for any VCS

Answer

Built-in security scanning

Question 2

A company uses Cloud Source Repositories and Cloud Build to build and deploy a Node.js application to Google Kubernetes Engine (GKE). The build step fails intermittently with an error 'npm ERR! network timeout'. What is the most efficient way to reduce build failures?

Accepted Answer

Configure npm to use a proxy and increase the timeout in the build step.. Option A is correct because configuring a proxy or specifying a longer timeout in the npm config can mitigate network timeouts. Option B is incorrect because retries in Cloud Build don't fix the underlying timeout. Option C is incorrect because moving to Artifact Registry doesn't affect npm network calls. Option D is incorrect because increasing machine size doesn't resolve network timeouts.

Answer

Use Artifact Registry to cache npm packages and change npm registry url.

Answer

Set the build to retry on failure in the Cloud Build trigger configuration.

Answer

Increase the machine type to e2-highmem-4 in the cloudbuild.yaml.

Question 3

A DevOps team wants to automate the deployment of a containerized application to multiple GKE clusters across different regions. They are using Cloud Build to build the container and Cloud Deploy for deployment. Which Cloud Deploy resource should they configure to define the deployment order and target clusters?

Accepted Answer

A delivery pipeline with multiple targets defined.. Option B is correct because a delivery pipeline defines the promotion sequence and targets. Option A is incorrect as a Cloud Build trigger only starts builds. Option C is incorrect - a release is a specific snapshot, not the pipeline. Option D is incorrect - a rollout targets a single target.

Answer

Cloud Build trigger with a multi-cluster deployment step.

Answer

A rollout object with target clusters specified.

Answer

A Cloud Deploy release configuration.

Question 4

During a Cloud Build pipeline, a build step fails because the Docker image tag already exists in Container Registry. The team wants to avoid overwriting tags. What is the best practice to resolve this?

Accepted Answer

Use the commit SHA as the image tag in the build step.. Using the commit SHA as the image tag guarantees uniqueness because each commit produces a distinct SHA. This prevents tag collisions in Container Registry without overwriting, as the SHA is immutable for that commit. It also provides traceability back to the exact source code version that produced the image.

Answer

Specify the :latest tag and always push to that tag.

Answer

Add a step to pull the image before building to ensure it's present.

Answer

Configure the build to retry on failure with a backoff.

Question 5

A company uses Cloud Build to deploy a microservices application to Google Kubernetes Engine (GKE). They want to integrate Container Analysis to scan images for vulnerabilities before deployment. What is the minimal set of changes needed to achieve this?

Accepted Answer

Enable the Container Analysis API; no changes to the build configuration are needed.. Option D is correct because Cloud Build natively integrates with Container Analysis; enabling the API and building the image triggers scanning automatically. Option A is incorrect - no need for a separate scan step. Option B is incorrect - Binary Authorization is for policy enforcement, not scanning. Option C is incorrect - Artifact Registry does not replace scanning.

Answer

Migrate images from Container Registry to Artifact Registry and enable vulnerability scanning there.

Answer

Add a build step to run a vulnerability scanner CLI tool before pushing the image.

Answer

Enable Binary Authorization to block deployment of vulnerable images.

Question 6

A DevOps engineer is setting up a CI/CD pipeline for a Python application using Cloud Build. The build takes too long because pip install is downloading packages every time. What is the best approach to speed up the build?

Accepted Answer

Configure a volume mount to a Cloud Storage bucket for pip cache and set PIP_CACHE_DIR.. Option C is correct because storing pip cache in a Cloud Storage bucket and restoring it in subsequent builds reduces download time. Option A is incorrect - Docker layer caching helps but pip cache is more effective for Python. Option B is incorrect - no guarantee of faster builds. Option D is incorrect - pre-built images may introduce more complexity and maintenance.

Answer

Use a custom base image that includes all dependencies pre-installed.

Answer

Increase the machine type to a higher CPU and memory instance.

Answer

Use Kaniko cache in Cloud Build with a remote cache location.

Question 7

A team is using Cloud Build to build and deploy to multiple environments (dev, staging, prod) using Cloud Deploy. They want to ensure that only builds from the main branch are promoted to prod. How should they configure this?

Accepted Answer

Configure a Cloud Deploy promotion with an approval gate required for the prod target.. Option D is correct because Cloud Deploy's approval gate feature allows you to require manual approval before a release is promoted to a specific target, such as prod. By configuring an approval gate on the prod target, you ensure that only builds from the main branch (which can be verified via the release metadata or source) are manually approved for promotion, providing a controlled, auditable gate. This approach directly enforces the branch-based promotion policy without relying on build-time filtering or IAM restrictions.

Answer

Use Cloud Build tags to mark builds from the main branch and filter in Cloud Deploy.

Answer

Set IAM policies on the Container Registry or Artifact Registry to restrict access to the prod image.

Answer

Set the Cloud Build trigger to only run on the main branch.

Question 8

A company uses Cloud Build with a private pool in a shared VPC to access on-premises resources. Several builds fail intermittently with 'failed to connect to backend' errors when trying to pull from a private npm registry hosted on-premises. The error occurs only during peak hours. What is the most likely cause?

Accepted Answer

The private pool has insufficient worker count or is too small, causing connectivity timeouts.. The intermittent 'failed to connect to backend' errors during peak hours point to resource exhaustion in the private pool. Private pools have a fixed number of workers; when all workers are busy, new builds must wait, and if the queue or connection timeout is exceeded, the build fails. This is a classic capacity issue, not a DNS, certificate, or firewall problem.

Answer

The DNS resolution for the private npm registry is failing due to caching issues.

Answer

The private pool's service account does not have the correct SSL certificates.

Answer

The Cloud NAT IP addresses have been blocked by the on-premises firewall.

Question 9

A team implements canary deployments using Cloud Deploy and deploys to GKE. They want to automatically roll back if the canary release's error rate exceeds 5% within 10 minutes. Which approach should they use?

Accepted Answer

Set up Cloud Deploy with a rollout strategy that uses Cloud Monitoring metrics to automatically rollback.. Option C is correct because Cloud Deploy supports integration with Cloud Monitoring for automated rollback on metric thresholds. Option A is incorrect - manual rollback doesn't meet the automatic requirement. Option B is incorrect - GKE rolling update is not canary. Option D is incorrect - Spinnaker is not native to GCP and not automatically integrated with Cloud Deploy.

Answer

Deploy using Spinnaker on GKE with a canary pipeline that includes an automated rollback step.

Answer

Configure a Cloud Build step to monitor the canary and rollback if needed.

Answer

Use a GKE rolling update strategy within the deployment manifest.

Question 10

A large enterprise uses Cloud Build across multiple projects for different microservices. They want to create a centralized CI/CD governance where a single trigger can initiate builds across multiple projects, but each project's artifacts must be stored in a shared Artifact Registry. What is the best way to achieve this?

Accepted Answer

Create a Cloud Build trigger in the governance project that uses a service account with permissions to send build requests to other projects.. Option B is correct because using a Cloud Build trigger with a cross-project service account and a multi-project configuration is the most native approach. Option A is incorrect - triggers are per project. Option C is incorrect - service accounts in each project is less centralized. Option D is incorrect - Cloud Functions adds unnecessary complexity.

Answer

Use a shared VPC and a single Cloud Build private pool accessible to all projects, and configure triggers in each project.

Answer

Use a single Cloud Build trigger in the governance project and configure triggers in each project to listen to Pub/Sub notifications from the governance trigger.

Answer

Deploy a Cloud Function that listens to Cloud Source Repo events and creates Cloud Build builds in each project.

Question 11

Which TWO options are valid methods to trigger a Cloud Build build when code is pushed to a Cloud Source Repository?

Accepted Answer

Use a Cloud Pub/Sub message sent to the Cloud Build topic to create a build.. Options A and D are correct. Cloud Build triggers can be based on branch or tag push, and can also be triggered via Pub/Sub message. Option B is incorrect - Cloud Build does not directly listen to Cloud Pub/Sub subscriptions without a trigger. Option C is incorrect - builds are not automatically triggered by Cloud Logging. Option E is incorrect - Cloud Scheduler cannot directly trigger a build without a Pub/Sub or HTTP intermediary.

Answer

Have Cloud Logging monitor the repository and create a build via a logs-based metric.

Answer

Set up a Cloud Pub/Sub subscription that forwards events to Cloud Build.

Answer

Configure Cloud Scheduler to call the Cloud Build API periodically.

Question 12

Which TWO deployment strategies are directly supported by Cloud Deploy for GKE?

Accepted Answer

Canary. Options B and D are correct. Cloud Deploy supports canary and blue-green deployment strategies for GKE. Option A is incorrect - rolling update is managed by GKE directly, not Cloud Deploy as a strategy. Option C is incorrect - shadow deployments are not supported. Option E is incorrect - A/B testing is not a built-in strategy.

Answer

Rolling update

Answer

A/B testing

Answer

Shadow

Question 13

Which THREE are best practices for securing a CI/CD pipeline on Google Cloud?

Accepted Answer

Use Secret Manager to securely pass credentials to build steps.. Options A, C, and D are correct. Using a private pool avoids exposure to public internet, storing credentials in Secret Manager avoids hardcoding, and using Binary Authorization ensures container integrity. Option B is incorrect - using personal credentials is insecure. Option E is incorrect - running builds on a public pool is less secure.

Answer

Run builds on the publicly hosted pool for better scalability.

Answer

Store service account keys in the source repository for build steps to use.

Question 14

A team uses Cloud Build with a trigger on Cloud Source Repository. The build fails intermittently with error 'Failed to pull builder image 'gcr.io/cloud-builders/gcloud'' but sometimes succeeds. What is the most likely cause?

Accepted Answer

Network egress from Cloud Build is throttled due to high concurrency.. The intermittent failure to pull the builder image 'gcr.io/cloud-builders/gcloud' indicates a transient network issue rather than a permanent misconfiguration. Cloud Build uses a shared pool of network resources, and under high concurrency, egress traffic to Container Registry can be throttled, causing pull operations to time out or fail. This explains why the build sometimes succeeds and sometimes fails, as throttling depends on the current load.

Answer

The Cloud Build worker pool is in a different region.

Answer

The builder image is too large.

Answer

The build service account lacks permissions to access Container Registry.

Question 15

A company uses Cloud Deploy for continuous delivery to GKE. They have a delivery pipeline with a rollout strategy: canary (25% for 30m) then full. The canary rollout fails because the new revision's health check errors. The team wants to automatically rollback the canary and notify. What native GCP feature can achieve this?

Accepted Answer

Configure a Cloud Deploy rollout strategy with an automated rollback policy.. Option A is correct because Cloud Deploy supports automated rollback via the rollbackPolicy in the delivery pipeline. Option B is incorrect because Cloud Build triggers are not designed for rollback automation. Option C is incorrect because post-deploy hooks are not for rollbacks. Option D is incorrect because it requires custom scripting and is not as native as Cloud Deploy's feature.

Answer

Configure Cloud Monitoring alerting policy on deployment errors that triggers a Cloud Function to rollback.

Answer

Set up a Cloud Build trigger that detects deployment failure and runs a rollback.

Answer

Use a Cloud Deploy rollout strategy with a post-deploy hook that calls Cloud Run jobs to revert.