PCDOE Building and implementing CI/CD pipelines Practice Test 4 — 15 Questions

Question 1

A developer wants to trigger a Cloud Build execution whenever a pull request is created against the main branch in Cloud Source Repositories. Which Cloud Build trigger configuration should be used?

Accepted Answer

Event: pull request on branch ^main$. Option B is correct because Cloud Build triggers can be configured to respond to pull request events on a specific branch. Option A is for push events on main branch. Option C is for tags. Option D is for manual trigger.

Answer

Event: push on branch ^main$

Answer

Event: push on tag

Answer

Event: manual invocation

Question 2

A team uses a monorepo with multiple microservices in separate directories. They want to build only the changed service(s) when a push occurs to the repo. How can they achieve this efficiently?

Accepted Answer

Create multiple Cloud Build triggers, each with a different includeFiles filter matching the service directory.. Option B is correct because Cloud Build triggers can use includeFiles filters to only trigger when files in a specific directory change. Option A builds all services, which is inefficient. Option C is possible but not native. Option D adds complexity.

Answer

Use a single Cloud Build trigger with a Dockerfile build step that builds all services.

Answer

Use Cloud Functions to invoke Cloud Build per changed directory.

Answer

Use a Cloud Build trigger with a build config that dynamically detects changes using git diff.

Question 3

A company uses Cloud Build with a custom service account that has minimal permissions. The build needs to deploy to Cloud Run. After configuring the service account with roles/run.admin, the build fails with 'Permission denied' on gcloud run deploy. What is the most likely cause?

Accepted Answer

The build service account lacks roles/iam.serviceAccountUser on the Cloud Run runtime service account.. Option B is correct because deploying to Cloud Run requires the iam.serviceAccountUser role on the runtime service account to impersonate it. Option A is not relevant. Option C is a different error. Option D is not required.

Answer

The Cloud Run service account is not set.

Answer

Cloud Build requires the roles/cloudbuild.serviceAgent role.

Answer

The build configuration file has syntax errors.

Question 4

During a Cloud Build execution, the step fails with 'Error: could not find a valid 'Dockerfile' in context '.''. The build configuration file is located in a subdirectory called 'build/' and the Dockerfile is in the root of the repository. How should the team fix this?

Accepted Answer

Specify the 'dir' field in the build step to point to the root.. Option C is correct because the Cloud Build step's `dir` field explicitly sets the working directory for the step. By specifying `dir: '.'` (or the repository root), Cloud Build will look for the Dockerfile in the root context, even though the build configuration file (`cloudbuild.yaml`) resides in the `build/` subdirectory. This ensures the Docker build context points to the correct location where the Dockerfile exists.

Answer

Create a symbolic link.

Answer

Move the Cloud Build configuration file to the root.

Answer

Use the 'substitutions' to change context.

Question 5

A team uses Spinnaker on GKE for deployment. They notice that deployments are taking too long because of manual judgment gates. They want to automatically approve deployments if the canary analysis passes predefined thresholds. What Spinnaker feature should they use?

Accepted Answer

Automated canary analysis. Option D is correct because Spinnaker's Automated Canary Analysis (ACA) feature allows teams to define canary analysis thresholds and automatically promote or roll back deployments based on the analysis results, eliminating the need for manual judgment gates. This directly addresses the requirement to automatically approve deployments when predefined thresholds are met, without human intervention.

Answer

Automated rollback

Answer

Policy engine with OPA

Answer

Pipeline expressions

Question 6

Which GCP service is used to store build artifacts such as Docker images?

Accepted Answer

Both B and C. Option D is correct because both Artifact Registry and Container Registry can store Docker images, though Artifact Registry is the recommended service. Option A is for object storage, not container images.

Answer

Cloud Storage

Answer

Container Registry

Answer

Artifact Registry

Question 7

A company uses Cloud Build to compile a Java application. The build takes 15 minutes due to dependency downloads. They want to cache the Maven dependencies to speed up subsequent builds. What is the best approach?

Accepted Answer

Use Cloud Build's built-in caching mechanism by specifying volumes.. Option B is correct because Cloud Build supports volumes that can be used to cache directories between builds. Option A is possible but less integrated. Option C is not for Maven specificly. Option D is not a native Cloud Build feature.

Answer

Use a Cloud Storage bucket to store the .m2 directory and restore it at the start of the build.

Answer

Use a Docker layer caching with a custom image that includes dependencies.

Answer

Use Cloud Build's 'cache' configuration to persist directories.

Question 8

A DevOps team uses Cloud Build and Cloud Deploy to deploy to GKE. They want to implement a gated deployment where a manual approval is required before promoting from staging to production. What two resources should they configure? (Select TWO)

Accepted Answer

A Cloud Deploy approval rule in the delivery pipeline. Option C is correct because a Cloud Deploy approval rule in the delivery pipeline defines a manual gate that pauses the pipeline at a specific stage (e.g., before promoting to production) and requires explicit approval to proceed. Option D is correct because setting the `requireApproval` attribute to `true` on a Cloud Deploy target enforces that any rollout targeting that environment must receive manual approval before the deployment proceeds.

Answer

A Cloud Pub/Sub topic to notify approvers

Answer

A Cloud Deploy rollout with a pre-deploy hook

Answer

A Cloud Build trigger with a manual approval step

Question 9

A team is setting up CI/CD for a microservices architecture. They want to ensure each service is independently buildable and deployable. What practices should they adopt? (Select THREE)

Accepted Answer

Use Artifact Registry with separate repositories per service. Options A, B, and E are correct. Separate repositories (A) or separate triggers with includeFiles (B) ensure independent builds. Separate Artifact Registry repositories (E) ensure artifact isolation. Option C builds multiple services in one config, reducing independence. Option D is about deployment targets, not builds.

Answer

Use Cloud Deploy's multi-target pipeline

Answer

Use Cloud Build's build config with substitutions to build multiple services

Question 10

What security checks can be integrated into a Cloud Build CI/CD pipeline? (Select TWO)

Accepted Answer

Container scanning with Artifact Analysis. Options A and B are correct. Container scanning with Artifact Analysis (A) is native. SAST can be added via custom steps (B). Option C (network penetration) is external. Option D (manual code review) is a process, not a tool. Option E (DAST) is for running apps.

Answer

Manual code review

Answer

Network penetration testing

Answer

Dynamic application security testing (DAST)

Question 11

Refer to the exhibit. The build fails with error: 'invalid tag format' for the image. What is the issue?

Accepted Answer

The substitution $SHORT_SHA is not defined and the tag becomes empty.. Option A is correct because $SHORT_SHA is a substitution that may be empty if not defined, resulting in an invalid tag. Option B is incorrect because a tag is provided. Option C is incorrect because the images array triggers a push automatically. Option D is irrelevant.

Answer

The project ID substitution is not present.

Answer

The build step must explicitly push the image.

Answer

The image name must include a tag.

Question 12

Refer to the exhibit. A rollout to dev succeeds, but when promoting to prod, it fails with 'Target 'prod' not found'. What is the issue?

Accepted Answer

The prod target has not been created in the same region.. Option A is correct because the prod target must be created before it can be referenced in a pipeline. Option B is incorrect because redeploying the pipeline won't create the target. Option C is incorrect because the error indicates the target does not exist, not that it's in a different project. Option D is incorrect because approval is not related.

Answer

The prod target does not have a required approval rule.

Answer

The prod target exists but is in a different project.

Answer

The delivery pipeline must be redeployed to include the prod target.

Question 13

A financial services firm is implementing a CI/CD pipeline with Cloud Build and Artifact Registry. Their security policy requires all data to remain within a VPC Service Controls perimeter. They have configured Cloud Build to use a private worker pool with no external IP addresses and have set up VPC-SC to allow traffic between Cloud Build and Artifact Registry within the perimeter. However, builds that push Docker images to Artifact Registry fail with the error: 'denied: Unauthenticated request. Push access to the repository is denied.' The build configuration includes the step: 'steps: - name: gcr.io/cloud-builders/docker args: [push, us-central1-docker.pkg.dev/myproject/my-repo/myimage]' The Cloud Build service account has been granted roles/artifactregistry.writer on the repository. What is the most likely cause?

Accepted Answer

The VPC-SC perimeter does not allow egress to the Artifact Registry API endpoint.. Option C is correct because VPC Service Controls can block access to Artifact Registry API endpoints if they are not in the allowed list, resulting in a denied error even with correct IAM permissions. Option A is incorrect because Artifact Registry is regional but private pools can access any region. Option B is incorrect because IAM permissions are correct. Option D is incorrect because the image tag is present.

Answer

The Cloud Build service account does not have permissions to authenticate to Artifact Registry when using a private pool.

Answer

The Docker push is failing because the image tag is missing a version.

Answer

The Artifact Registry repository is in a different region than the Cloud Build worker pool.

Question 14

A development team is using Cloud Build to build and push Docker images to Artifact Registry. The builds are taking longer than expected, and the team wants to reduce build time and cost. They use a Dockerfile that installs many dependencies. Which approach should they recommend?

Accepted Answer

Use Kaniko cache in Cloud Build with a persistent volume claim to cache base layers.. Option C is correct because using Kaniko with a persistent cache for base layers leverages cache from previous builds, speeding up builds without requiring privileged mode. Option A increases cost by adding more vCPUs without addressing inefficient caching. Option B uses Docker with privileged mode, which is slower and less secure. Option D reduces parallelism, likely increasing build time.

Answer

Increase the machine type to use more vCPUs and memory for the build.

Answer

Switch to Docker build with --privileged flag and use a local Docker daemon.

Answer

Reduce the number of steps in the Cloud Build config to a single step that installs and builds everything.

Question 15

An organization uses Cloud Deploy with Skaffold to manage progressive delivery on GKE. After a rollout, the new revision shows a higher error rate in Stackdriver, but the Cloud Deploy pipeline did not automatically roll back. What is the most likely cause?

Accepted Answer

The rollout strategy includes a manual approval step before advancing to the next phase.. Option A is correct because Cloud Deploy can wait for manual approval or an external verification job; if the rollout strategy is set to require approval, automatic rollback is not triggered. Option B is incorrect because the rollout doesn't need to complete to trigger a rollback if metrics are monitored. Option C is incorrect because the error rate metric is not part of the pipeline unless a custom verification job is configured. Option D is incorrect because the release configuration doesn't affect automatic rollback behavior.

Answer

The release was created with a '--disable-rollback' flag.

Answer

The Cloud Deploy pipeline does not have a stackdriverMetrics verification job defined to check error rates.

Answer

The rollout has not yet reached 100% traffic, so Cloud Deploy waits for full completion before evaluating health.