PCDOE Building and implementing CI/CD pipelines Practice Test 7 — 15 Questions

Question 1

A company is migrating from Jenkins to Cloud Build for their CI/CD pipeline. They have a large Java monorepo with multiple modules that take over 2 hours to build and test sequentially. They want to reduce build time by running module builds in parallel. The current Jenkins pipeline uses a single Jenkinsfile that builds all modules. They have a Cloud Build config that runs 'mvn clean package' for the entire project, which is slow. They have a 2-hour Cloud Build timeout. The architecture requires that some modules depend on others. Which approach should they take to minimize build time while correctly handling dependencies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a single build config that defines parallel steps for independent modules, using 'waitFor' to sequence dependent modules, and uses Maven's incremental compilation with caching.. The correct approach is a single Cloud Build config that defines parallel steps for independent modules, uses waitFor to sequence dependent modules, and leverages Maven incremental compilation with caching. This minimizes build time by parallelizing independent work while respecting the dependency graph, and caching avoids rebuilding unchanged modules. It stays within the 2-hour timeout by reducing total wall-clock time.

Answer

Break the monolith into separate Cloud Build triggers per module and run them independently on every push.

Answer

Use a build step that runs 'mvn -pl moduleA,moduleB -am' to build only changed modules and their dependencies.

Answer

Increase the Cloud Build timeout to 4 hours and keep a single build step.

Question 2

A DevOps team wants to implement a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They need to ensure that each service is built, tested, and deployed independently with minimal manual intervention. Which TWO practices should they implement?

Accepted Answer

Use Cloud Deploy to manage progressive delivery (e.g., canary, blue/green) to GKE clusters.. Option A is correct because Cloud Deploy is Google Cloud's managed continuous delivery service that natively supports progressive delivery strategies such as canary and blue/green deployments to GKE clusters, enabling each microservice to be released independently with automated rollout and rollback controls. Option D is correct because Cloud Build triggers can be configured (e.g., via branch or tag patterns, or included/excluded files) to fire on pull requests and run per-service build and test steps, giving each microservice its own independent CI workflow with minimal manual intervention. Option B is not required for this scenario: Cloud Source Repositories is a Git hosting option, but the question focuses on build/test/deploy independence, and Cloud Build triggers work with GitHub, Bitbucket, or GitLab as well, so it is not one of the two best practices. Option C is wrong because a monolithic repository with simultaneous deployment of all services directly contradicts the requirement for independent build, test, and deployment of each microservice. Option E is wrong because a single shared Cloud Build configuration with conditional steps couples all services into one pipeline, reducing independence and increasing the blast radius of changes rather than giving each service its own build and test flow.

Answer

Use Cloud Source Repositories integrated with Cloud Build for version control and triggering builds.

Answer

Use a monolithic repository and deploy all services simultaneously to ensure consistency.

Answer

Use a single Cloud Build configuration file for all services with conditional steps to handle different services.

Question 3

Your team manages a Cloud Build pipeline that builds a container image and pushes it to Artifact Registry. The build steps run in a private pool that has no external IP addresses, and the build consistently fails at the push step with a message indicating it cannot reach the registry endpoint. You have verified that the private pool is correctly configured and attached to the VPC network. What should you do to allow the build to push images to Artifact Registry?

Accepted Answer

Enable Private Google Access on the subnet used by the private pool.. Private pools without external IPs require Private Google Access to reach Google APIs such as Artifact Registry. Enabling it on the subnet allows the build to push images without exposing the build environment to the internet. IAM roles and NAT gateways do not solve the underlying network connectivity problem, and switching to a public pool would violate the security intent of using a private pool.

Answer

Change the build to use a public pool instead of the private pool.

Answer

Add the Artifact Registry service agent to the Cloud Build service account with the Artifact Registry Writer role.

Answer

Configure the private pool to use a NAT gateway for outbound internet access.

Question 4

You are setting up a Cloud Build trigger that should run only when changes are pushed to the `main` branch of a GitHub repository. Which configuration should you use?

Accepted Answer

Create a trigger with the `--branch-pattern` set to `^main$`.. To restrict a Cloud Build trigger to a specific branch, use the `--branch-pattern` flag with a regular expression that matches the branch name. For the `main` branch, `^main$` ensures that only pushes to `main` trigger the build. This is the standard and efficient method.

Answer

Create a trigger with the `--branch-pattern` set to `.*` and add a build step that checks the branch name.

Answer

Create a trigger with the `--tag-pattern` set to `^main$`.

Answer

Create a trigger that listens to all pushes and use a `if` condition in the build config to check the branch.

Question 5

A gaming company runs a Node.js service on Cloud Run. Their CI/CD pipeline in Cloud Build builds a container image and pushes it to Artifact Registry, but they want to ensure that only images built from the main branch are deployed to production. They also want to automatically roll back if the new revision causes an increase in error rate. What should they do?

Accepted Answer

Set up a Cloud Build trigger with a branch filter for main, and use Cloud Deploy to manage the deployment to Cloud Run with a canary strategy that includes automated rollback based on Cloud Monitoring metrics.. Cloud Deploy provides native canary deployment and automated rollback for Cloud Run, integrating with Cloud Monitoring to detect error rate increases. A Cloud Build trigger with a branch filter ensures only main branch commits trigger the pipeline. Together, they meet the requirements for branch restriction and automated rollback without custom scripting.

Answer

Use Cloud Build to build and push the image, then manually deploy to Cloud Run using the gcloud CLI. Set up a Pub/Sub notification on the Cloud Build topic to trigger a rollback if errors occur.

Answer

Configure Cloud Build to deploy to Cloud Run with the --no-traffic flag, then use Cloud Monitoring alerting to trigger a Cloud Function that rolls back via gcloud run services update-traffic.

Answer

Create a Cloud Build trigger that only fires on the main branch, and configure the Cloud Run service to use gradual traffic migration with health checks. Enable Cloud Monitoring uptime checks to automatically revert traffic.

Question 6

A platform team maintains a containerized service built by Cloud Build. They need to guarantee that every image deployed to GKE is exactly the image that passed their build, with no possibility of a rebuild producing a different artifact. Their builds run in a Cloud Build trigger with a Docker build step. Which configuration should they implement?

Accepted Answer

Push the image and capture its digest (image@sha256:...) as a build substitution, then reference that digest in the deployment manifest.. Referencing the image by its sha256 digest binds the deployment to the exact manifest content produced by the build, because digests are content-addressed and cannot be altered without changing the hash. Capturing the digest as a substitution and using it in the manifest closes the gap between what was built and what runs, which is stronger than tags, allowlists, or version pinning alone.

Answer

Configure the Cloud Build trigger to run with a pinned builder image version and set the Dockerfile FROM base to a fixed version tag.

Answer

Enable Binary Authorization in enforcement mode on the GKE cluster and allow only images from the Artifact Registry repository.

Answer

Tag the image with the Cloud Build $BUILD_ID and configure the deployment to pull that unique tag from Artifact Registry.

Question 7

A DevOps engineer manages a Cloud Build pipeline that runs unit tests, builds an image, and deploys to GKE. Builds occasionally succeed even though a subset of integration tests failed, and the engineer discovers the test step exits zero because the test runner writes failures to stderr but exits 0. The engineer wants Cloud Build to fail the build whenever any test fails, without modifying the test runner. Which approach should they take?

Accepted Answer

Add a step that parses the test runner's stderr output with grep for 'FAIL' and exits non-zero if any match is found.. Cloud Build evaluates each step by its container exit code, so a runner that reports failures on stderr but exits zero will always look successful. Adding a step that scans the runner's output and returns a non-zero exit code on detected failures forces the build to fail correctly, without altering the runner and while preserving the pipeline structure.

Answer

Set the test step's allowFailure field to false in the build config so Cloud Build treats any stderr output as a failure.

Answer

Move the test step to a Cloud Build trigger with a build filter that matches failure strings in the build log.

Answer

Wrap the test command in a shell that uses set -e so the script exits immediately when the runner reports a failure.

Question 8

A financial company uses Cloud Build to deploy a microservices application to GKE. They have a monorepo with multiple services. They want to trigger a build only for the service that changed, and they want to use Cloud Build's ability to run builds in parallel to reduce overall build time. They also need to ensure that each service's image is tagged with the Git commit SHA. Which approach should they use?

Accepted Answer

Create a separate Cloud Build trigger for each service with a file path filter (e.g., 'serviceA/**'). In the build config, use the $COMMIT_SHA substitution to tag the image.. Using separate triggers with file path filters allows each service to be built only when its files change, and $COMMIT_SHA provides the full commit SHA for tagging. This leverages Cloud Build's native features for efficient monorepo CI/CD.

Answer

Create a Cloud Build trigger for each service with a tag filter (e.g., 'serviceA-*'). Use the $TAG_NAME substitution to tag the image.

Answer

Use Cloud Build's built-in monorepo support with the 'dir' field to specify the service directory. Create one trigger per service with a branch filter. Use the $SHORT_SHA substitution for tagging.

Answer

Create a single Cloud Build trigger that runs on any change. In the build config, use a script to detect which service changed and build only that service. Use a custom substitution for the commit SHA.

Question 9

A team is designing a Cloud Build pipeline that must deploy the same built artifact to dev, staging, and prod GKE clusters, where prod requires a human to approve before rollout. They want to minimize duplicated build work and keep environment promotion traceable. Which two practices should they implement? (Choose two.)

Accepted Answer

Build the container image once in a trigger, push it to Artifact Registry, and promote the same image digest through each environment.. Promoting a single immutable image digest across environments removes rebuild-induced drift and makes the promotion trail verifiable, while an explicit approval gate before the prod target enforces the human checkpoint without slowing dev and staging. Together they satisfy both the artifact-consistency and approval requirements with minimal duplicated build work.

Answer

Store environment-specific configuration in the container image and rebuild it for each environment to bake in the correct values.

Answer

Run all three environment deployments in a single Cloud Build step to guarantee they execute sequentially.

Answer

Use separate Cloud Build triggers per environment that each rebuild the image from source before deploying.

Question 10

A DevOps team uses Cloud Build to build and test a Java application. They want to speed up builds by caching Maven dependencies between builds. They also want to ensure that the cache is not shared across different branches to avoid conflicts. Which approach should they use?

Accepted Answer

Use a Cloud Storage bucket with a path that includes the branch name, and use the gsutil command to copy the Maven local repository to and from the bucket before and after the build.. To cache Maven dependencies across builds while isolating per branch, you can store the cache in a Cloud Storage bucket with a branch-specific prefix. Before the build, download the cache to the local Maven repository; after the build, upload any changes. This reduces build time by reusing dependencies and prevents cross-branch interference.

Answer

Use a Cloud Storage bucket as a cache and configure the Maven settings to use it as a local repository.

Answer

Use Cloud Build's built-in caching by specifying a volume and mount it to the Maven local repository directory.

Answer

Use a Cloud Storage bucket with a path that includes the branch name, and configure Maven to use it as a remote repository.

Question 11

You are configuring a Cloud Build trigger that builds a Docker image and pushes it to Artifact Registry. The trigger is set to run on pushes to the 'main' branch. You want to ensure that the image is tagged with the Git commit SHA and also with 'latest' only when the build is successful. Which configuration should you use in the build steps?

Accepted Answer

Use a build step to build and push the SHA-tagged image, then add a subsequent step that runs only if all previous steps succeeded, which tags the SHA image as 'latest' and pushes it.. To ensure latest is only pushed on a successful build, you must separate the tagging and pushing of latest into a step that runs only if all previous steps succeeded. Building and pushing the SHA-tagged image first, then conditionally retagging and pushing latest, achieves this. Other options either push latest unconditionally or rely on non-existent automatic tagging features.

Answer

Use the 'docker build' command with '-t us-central1-docker.pkg.dev/my-project/my-repo/my-image:$SHORT_SHA' and then 'docker push' that tag, followed by a separate step to tag and push 'latest'.

Answer

Use Cloud Build's built-in substitution to automatically tag the image with 'latest' on successful builds.

Answer

Use a single step that runs 'docker build -t us-central1-docker.pkg.dev/my-project/my-repo/my-image:$SHORT_SHA -t us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest .' and then 'docker push' both tags.

Question 12

A team wants Cloud Build to automatically run a pipeline whenever a developer pushes a commit to a specific branch of a repository hosted in Cloud Source Repositories. They want the build to start without any manual action. Which Cloud Build feature should they configure?

Accepted Answer

A Cloud Build trigger bound to the repository with a branch filter for the target branch.. Cloud Build triggers are the built-in integration that listens for source repository events and starts builds based on branch or tag filters. Binding a trigger to the Cloud Source Repositories repo with the appropriate branch filter yields automatic, immediate builds on push without custom glue code or polling.

Answer

A Pub/Sub topic subscribed to Cloud Source Repositories notifications that calls the Cloud Build API on each message.

Answer

A Cloud Build worker pool configured with a webhook secret so external systems can invoke builds.

Answer

A scheduled Cloud Build trigger that polls the repository every few minutes for new commits.

Question 13

A DevOps team is implementing a CI/CD pipeline using Cloud Build and wants to ensure that builds are reproducible and secure. They plan to use Cloud Build's private pools and want to minimize the attack surface. Which two practices should they follow? (Choose two.)

Accepted Answer

Pin the versions of build steps and dependencies to specific digests or versions.. Using a private pool without external IPs and enabling Private Google Access enhances security by restricting network access. Pinning versions of build steps and dependencies ensures reproducibility and mitigates supply chain risks. Storing keys in config files, granting Owner, and using substitutions for secrets are insecure practices that increase the attack surface.

Answer

Grant the Cloud Build service account the Owner role to ensure it has all necessary permissions.

Answer

Use Cloud Build's built-in substitution variables to inject secrets into the build.

Answer

Store the Cloud Build service account key in the build configuration file for easy access.

Question 14

A company uses Cloud Deploy to roll out a service to a GKE cluster. After a canary rollout completes and the new revision is verified, they need to automatically roll back to the previous revision if the service's error rate exceeds a threshold within the first ten minutes, without human intervention. Which approach should they implement?

Accepted Answer

Configure an analysis job in the Cloud Deploy rollout that queries Cloud Monitoring for the error rate and fails the rollout when the threshold is breached.. Analysis jobs are the native Cloud Deploy construct for evaluating metrics during a rollout and failing it when thresholds are breached, which triggers an automatic rollback to the previous good release. This delivers the unattended, metric-driven protection the scenario demands without custom automation or unconditional reverts.

Answer

Set the rollout strategy to canary with a short verification window and rely on the deployment to revert automatically when pods crash.

Answer

Add a post-deploy hook that sleeps ten minutes and then runs kubectl rollout undo on the GKE deployment.

Answer

Create a Cloud Monitoring alerting policy that sends a notification to a Pub/Sub topic consumed by a Cloud Function that runs gcloud deploy rollouts rollback.

Question 15

A retail company is setting up a CI/CD pipeline using Cloud Build. They want to automatically build and test their application whenever a developer pushes a commit to a branch in their GitHub repository. They also want to deploy to a staging environment only when the build and tests pass. Which Cloud Build feature should they use to trigger the build automatically?

Accepted Answer

Cloud Build triggers with a GitHub repository connection. Cloud Build triggers are the native feature for automating builds based on source repository events. By connecting a GitHub repository and creating a trigger for push events to a specific branch, the build starts automatically. This enables continuous integration and can be followed by deployment steps if the build succeeds.

Answer

Pub/Sub topic that receives GitHub webhook events

Answer

Cloud Build's built-in polling mechanism for source repositories

Answer

Cloud Scheduler job that periodically checks for new commits