PCDOE Building and implementing CI/CD pipelines Practice Question
An organization uses Cloud Build with a private pool to build container images that require access to on-premises Artifactory. After moving to a new VPC, builds fail with 'Connection refused' when fetching dependencies. What is the best step to troubleshoot?
⚠ Common exam trap
Many exam-takers confuse connectivity issues with IAM permissions or misapply Cloud NAT, thinking it provides outbound access to on-premises, when in reality private pools require VPC peering and proper routing to reach non-Google Cloud endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that VPC Network Peering is established between the Cloud Build private pool's service producer VPC and the customer VPC, and that routes to on-premises are present.
The error 'Connection refused' indicates that the Cloud Build private pool's worker VMs cannot reach the on-premises Artifactory server. Private pools are deployed in a Google-managed service producer VPC that must be connected to the customer VPC via VPC Network Peering. Without this peering and the correct routes to the on-premises network (e.g., via Cloud VPN or Dedicated Interconnect), traffic from the private pool is dropped, causing the connection refusal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify that VPC Network Peering is established between the Cloud Build private pool's service producer VPC and the customer VPC, and that routes to on-premises are present.
Why this is correct
Private pools require peering; missing peering stops traffic.
- ✗
Verify that the Cloud Build service account has the dns.networks.bindPrivateZone permission.
Why it's wrong here
DNS permissions are needed for private zones, but the error is connection refused, not DNS resolution.
- ✗
Check that the Cloud Build service account has the storage.objectViewer role on the Artifactory bucket.
Why it's wrong here
Artifactory is not a GCS bucket; the error is network, not permissions.
- ✗
Ensure that Cloud NAT is configured in the private pool's VPC.
Why it's wrong here
Cloud NAT is for internet egress; on-premises is accessed via VPN/Interconnect.
Go deeper
Related to this question
About these practice questions
One of 486 original PCDOE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.