Deploying applications practice questions

HorizontalPodAutoscaler

Why wrong: Scales pods, does not expose services.

Service type NodePort

Why wrong: Exposes on each node's port, not suitable for external SSL termination.

Service type LoadBalancer

Why wrong: Provides external IP but does not terminate SSL.

The health check is misconfigured, causing the instance to be considered unhealthy.

Why wrong: Health check failures cause instance replacement but not 'context deadline exceeded'.

The app requires an environment variable that is not set.

Why wrong: Missing env vars cause runtime errors, not a delay in startup.

The Dockerfile has a syntax error that prevents the container from building.

Why wrong: Build errors occur before deployment, not a startup timeout.

The revision has a low CPU limit causing it to be throttled.

Why wrong: CPU limits affect performance, not traffic routing.

The revision is not healthy because of a misconfigured health check.

Why wrong: The revision shows 'Ready: Yes', so it is healthy.

The revision has a concurrency setting of 0, which is invalid.

Why wrong: Concurrency of 0 is not allowed; but even if misconfigured, it wouldn't set traffic to 0.

Redeploy the old version manually if the new version fails

Why wrong: Manual rollback increases downtime and is error-prone.

Rolling update with a readiness probe

Why wrong: Rolling updates replace instances gradually; if the new version fails, rollback may be slower.

Canary deployment with a small percentage of traffic

Why wrong: Canary is safer but does not fully switch traffic until proven; blue/green is more appropriate for full cutover with health checks.

Configure the function to retry on failure and set a maximum retry count.

Why wrong: Retrying does not help if the function consistently takes longer than the ack deadline.

Increase the Cloud Function timeout to 60 minutes.

Why wrong: The function timeout is not the issue; the Pub/Sub ack deadline must be extended.

Use Cloud Tasks instead of Pub/Sub for asynchronous invocation.

Why wrong: Cloud Tasks has a 30-minute timeout; still may not be sufficient and changes the architecture.

Kubernetes Secrets are encrypted at rest by default.

Why wrong: Secrets are base64 encoded, not encrypted; encryption requires configuration.

A zonal GKE cluster automatically uses regional persistent disks for high availability.

Why wrong: Regional persistent disks provide multi-zone access; zonal clusters use zonal disks by default.

To expose a Deployment externally, you must create an Ingress resource.

Why wrong: You can also use a Service of type LoadBalancer or NodePort.

Set a maximum request timeout of 10 minutes to avoid cold starts.

Why wrong: Maximum timeout is 60 minutes; cold starts are unrelated to timeout setting.

Hardcode port 8080 in the container.

Why wrong: The container must listen on the port provided by the PORT environment variable.

The image tag format is incorrect.

Why wrong: Tag format error occurs later in the build process.

The cloudbuild.yaml file is not present in the current directory.

Why wrong: File not found yields a different error.

The Dockerfile is missing from the repository.

Why wrong: Missing Dockerfile gives a different error.

The runtime 'python39' is not supported in App Engine standard environment.

Why wrong: Python 3.9 is a supported runtime.

The $PORT environment variable is not set in App Engine standard environment.

Why wrong: App Engine sets the PORT environment variable.

The entrypoint command is incorrect because gunicorn is not allowed.

Why wrong: gunicorn is allowed as an entrypoint.

Blue/green deployment

Why wrong: Blue/green can achieve zero downtime but is more complex; rolling update is simpler and sufficient.

Recreate update

Why wrong: Recreate terminates all pods before creating new ones, causing downtime.

Canary deployment

Why wrong: Canary is used for gradual traffic shifting, not the default zero-downtime strategy.

Create a service account key and store it in Secret Manager, then mount it as a volume.

Why wrong: Unnecessarily complex; using keys should be avoided if possible.

Use the default Compute Engine service account and grant it the Cloud SQL Client role.

Why wrong: The default Compute Engine service account is not recommended; a dedicated service account should be used.

Enable the Cloud SQL Admin API and use Application Default Credentials from the Cloud Run service.

Why wrong: Application Default Credentials work but require the service account to have the correct IAM role; explicitly granting the role is clearer.

Service of type NodePort

Why wrong: Exposes on node IPs, not suitable for external access with path routing.

NetworkPolicy

Why wrong: NetworkPolicy defines firewall rules, not routing.

Service of type LoadBalancer

Why wrong: Creates a separate external IP for each Service.

Use a custom runtime that already includes the package.

Why wrong: Custom runtime is an option but requires more effort; using a Dockerfile is the standard way.

Specify the package in the app.yaml file under the 'libraries' section.

Why wrong: app.yaml libraries are for language-specific libraries, not system packages.

Add the package name to the requirements.txt file.

Why wrong: requirements.txt is for Python packages, not system packages.

Store sensitive configuration data in environment variables.

Why wrong: Use Secrets or Secret Manager instead.

Skip liveness and readiness probes for stateless applications.

Why wrong: Health probes are important for all applications.

Use the default Compute Engine service account for pods.

Why wrong: Least privilege principle: create dedicated service accounts.

The Cloud Storage bucket for storing build artifacts does not exist.

Why wrong: The error is about permissions, not missing bucket.

The developer's user account has been revoked access to the project.

Why wrong: The error indicates the user has some permissions but not this specific one.

The developer does not have the 'cloudbuild.builds.create' permission because the Cloud Build Editor role does not include it.

Why wrong: Cloud Build Editor includes cloudbuild.builds.create.

The static IP address was not configured to failover to the remaining zone.

Why wrong: Static IP is not tied to a zone in this context.

The Cloud SQL read replica did not promote to primary quickly enough.

Why wrong: The read replica is for reads, not writes; the primary may not be affected.

The managed instance group's autoscaler took too long to create new instances in the remaining zone.

Why wrong: MIGs typically create instances quickly.

The Cloud Build service account does not have permission to update the Cloud Run service.

Why wrong: The deployment worked before, so permissions are likely correct.

The new environment variable exceeds the maximum size limit for environment variables in Cloud Run.

Why wrong: Cloud Run has limits but a single variable is unlikely to exceed them.

The health check configuration in the Cloud Run service was overwritten by the new deployment.

Why wrong: Health check config is not typically overwritten unless specified.

Use Cloud Deploy to create a delivery pipeline that watches the Artifact Registry and promotes the image to GKE.

Why wrong: Incorrect: Cloud Deploy does not automatically trigger on image push; it requires manual or scheduled releases.

Schedule a Cloud Scheduler job that periodically checks for new images in Artifact Registry and updates the GKE deployment.

Why wrong: Incorrect: This is a polling approach, not event-driven, and inefficient compared to a trigger.

Configure a Cloud Run service that is automatically deployed when a new image is pushed to Artifact Registry.

Why wrong: Incorrect: Cloud Run is for serverless containers, not for managing GKE deployments.

Use Horizontal Pod Autoscaler to automatically adjust the number of pods based on CPU utilization.

Why wrong: Incorrect: HPA scales based on load, but does not directly impact rolling update availability.

Enable liveness probes to automatically restart pods that become unresponsive.

Why wrong: Incorrect: Liveness probes are for pod recovery, not for controlling rolling update behavior.

Enable node auto-repair to automatically replace unhealthy nodes.

Why wrong: Incorrect: Node auto-repair handles node-level issues, not application-level rolling updates.

The container's health check is failing because the startup command is incorrect.

Why wrong: Incorrect: The error is about binding to a port, not health checks.

The PORT environment variable is not set correctly in the Cloud Run service configuration.

Why wrong: Incorrect: The error message shows PORT is set to 8080, but the app may not be using it.

The container image does not exist in the specified registry.

Why wrong: Incorrect: The container started (log shows exit), so the image exists.