hardMultiple SelectObjective-mapped
PCDE Practice Question: A team uses Cloud Build to build and deploy a Go…
A team uses Cloud Build to build and deploy a Go application to GKE. They need to inject the Git commit SHA as an environment variable in the deployment. Which THREE steps should they take?
⚠ Common exam trap
Google Cloud often tests the misconception that you must rebuild and retag the Docker image to pass the commit SHA, when in fact you can inject it at deployment time using `kubectl set env` without modifying the image.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the Cloud Build service account permission to update the Deployment
The Cloud Build service account needs the `container.deployments.update` permission (or a role like `roles/container.developer`) to modify the Deployment object in GKE. Without this IAM permission, the `kubectl set env` command in the build step will fail with a forbidden error, even if the image was successfully deployed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant the Cloud Build service account permission to update the Deployment
Why this is correct
Needed to run kubectl set env or patch.
- ✗
Use Cloud Deploy instead of kubectl
Why it's wrong here
Not necessary for this specific task.
- ✓
Run kubectl set env deployment/myapp COMMIT_SHA=$SHORT_SHA after the image is deployed
Why this is correct
This updates the deployment environment variable.
- ✗
Create a new Docker image tag with the commit SHA
Why it's wrong here
Tagging the image is separate from setting an env var.
- ✓
Use the built-in substitution $SHORT_SHA in a cloudbuild.yaml step
Why this is correct
$SHORT_SHA is available and can be used in commands.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCDE question from scratch — 1,446 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCDE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer wants to use Cloud Build to deploy a container to Cloud Run. They have written a cloudbuild.yaml file with a step that runs gcloud run deploy. The build fails with a permission error. What is the most likely cause?
medium- A.The gcloud command is incorrect
- B.The Cloud Build trigger is misconfigured
- C.The Cloud Run API is not enabled in the project
- ✓ D.The Cloud Build service account does not have the Cloud Run Admin role
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDE exam.