Medium — PCDE Practice Quiz

Question 1

Your team builds container images in Cloud Build and pushes them to Artifact Registry. Security requires that every image be automatically scanned for OS-level vulnerabilities as soon as it is stored, and that developers be able to query the findings without running any additional scanning jobs in the pipeline. You want the least-effort, native approach. What should you do?

Accepted Answer

Enable the Container Scanning API so Artifact Registry automatically scans images on push and stores vulnerability findings that can be queried via the API or console.

Answer

Add a Cloud Build step that runs an open-source scanner like Trivy against each image and uploads the results to Cloud Storage for developers to download.

Answer

Configure Binary Authorization with a vulnerability policy so that scanning occurs automatically during admission to the cluster.

Answer

Schedule a Cloud Scheduler job that periodically pulls all images from Artifact Registry and runs the gcloud artifacts docker images scan command on each.

Question 2

You lead FinOps for a company running dozens of microservices across several GCP projects. Finance reports that last month's total spend jumped 35% with no obvious cause. Leadership wants a repeatable way to break down costs by service, SKU, project, and label, and to run ad hoc queries to pinpoint which resources drove the spike. What should you implement?

Accepted Answer

Enable Cloud Billing export to BigQuery (detailed usage cost export), enforce a consistent labeling strategy across resources, and analyze spend with SQL queries and Looker Studio dashboards.

Answer

Rely on the Billing console's built-in Reports view and manually export monthly PDF invoices for the finance team to review.

Answer

Create a budget with alert thresholds at 50%, 90%, and 100% of the monthly forecast so you are notified when spend increases.

Answer

Turn on Recommender cost recommendations and apply all idle-resource and rightsizing suggestions each month.

Question 3

Your team runs a GKE production cluster and wants to guarantee that only container images that have passed an automated vulnerability scan and were built by your official Cloud Build pipeline can be deployed. Images built on developer laptops or without a scan must be rejected at deploy time. Which approach best meets this requirement?

Accepted Answer

Enable Binary Authorization on the cluster with a policy that requires attestations, and have Cloud Build create a signed attestation only after the image passes the vulnerability scan.

Answer

Configure Artifact Registry to reject any image push that has critical vulnerabilities, relying on the registry scan gate to block bad images from being deployed.

Answer

Add a Cloud Build step that runs a script to delete images with vulnerabilities from Artifact Registry before the deployment stage executes.

Answer

Use a GKE admission webhook that checks the image tag naming convention to confirm the image came from the official pipeline.

Question 4

Your SRE team runs a payment API on GKE with a defined SLO of 99.9% availability measured over a 28-day rolling window. Developers push changes frequently, and leadership wants to maximize release velocity without endangering the SLO. During a new rollout, you want an automated mechanism that decides whether to continue promoting a release based on the release's real impact on the service's reliability signals, halting before the error budget is materially consumed. Which approach best balances change velocity and reliability?

Accepted Answer

Use a progressive canary rollout where a small percentage of traffic is shifted to the new version and promotion is gated on SLI measurements (error rate and latency) compared against thresholds derived from the error budget.

Answer

Deploy the full release to 100% of traffic immediately, then rely on the 28-day rolling SLO report to decide whether the next release should proceed.

Answer

Freeze all releases whenever any error budget has been consumed during the current window, regardless of the change's tested impact.

Answer

Increase the SLO target to 99.99% so any regression is caught faster, then deploy releases directly to production.

Question 5

A retail company runs an e-commerce API on a Compute Engine managed instance group behind an external HTTP(S) load balancer. During periodic bot-driven traffic surges, the backend autoscaler adds many VMs to absorb the load, causing large unexpected compute spikes on the monthly bill even though the surge traffic is malicious and returns no revenue. The team wants to reduce cost during these events without degrading legitimate customer performance. What should they implement?

Accepted Answer

Enable Cloud Armor Adaptive Protection with a security policy that rate-limits and blocks the detected malicious traffic at the load balancer edge before it reaches the backends

Answer

Lower the managed instance group's maximum number of instances so the autoscaler cannot add VMs during surges

Answer

Switch the backend VMs to Spot VMs so that surge capacity is billed at a lower rate

Answer

Increase the autoscaler's target CPU utilization so fewer VMs are added during traffic spikes

Question 6

Your team uses Cloud Build to build container images that are pushed to a Docker repository in Artifact Registry. After a recent incident, an engineer accidentally re-pushed a new image using an existing tag (v1.4.2) that had already been deployed to production, causing confusion about which binary was actually running. You need to guarantee that once a tagged image is published, that exact tag can never be overwritten by a later push, while still allowing new tags. What should you do?

Accepted Answer

Enable immutable image tags on the Artifact Registry repository so that pushing an already-existing tag is rejected.

Answer

Configure a cleanup policy on the repository to delete images older than 30 days to prevent tag reuse.

Answer

Add a Cloud Build step that runs a shell script to check whether the tag exists and fails the build if it does.

Answer

Enable Binary Authorization with a require-attestation policy so unverified image pushes are blocked.

Question 7

Your team's Cloud Build pipeline builds a large Java microservice. Each build downloads all Maven dependencies from scratch, and the container image is rebuilt entirely on every commit, causing builds to take over 20 minutes. You want to reduce build times without changing the application source. Which approach should you implement?

Accepted Answer

Use Kaniko with a cache repository in Artifact Registry and store Maven dependencies in a Cloud Storage bucket referenced via the Cloud Build 'cache' directory between builds.

Answer

Increase the machine type of the default Cloud Build worker pool to the largest available size so more CPU is dedicated to each build.

Answer

Split the build into multiple triggers so that dependency downloads and image builds run as separate Cloud Build jobs on different branches.

Answer

Disable build provenance generation and Binary Authorization checks to remove overhead from the build steps.

Question 8

Your team hosts application source in GitHub and uses a Cloud Build trigger connected via the Cloud Build GitHub App. Developers open pull requests against the main branch. Leadership mandates that no code can be merged into main unless an automated build-and-test run has succeeded, and the merge must be blocked in the GitHub UI until that check passes. What is the correct way to enforce this?

Accepted Answer

Create a pull request Cloud Build trigger and configure a GitHub branch protection rule on main that requires the Cloud Build status check to pass before merging.

Answer

Create a push trigger on the main branch so the tests run automatically after each merge, and roll back with a revert commit if tests fail.

Answer

Add a Binary Authorization policy requiring an attestation, so unverified merges are rejected by GitHub.

Answer

Configure a Cloud Deploy pipeline with a manual approval gate that developers must satisfy before merging the pull request.

Question 9

Your team's Cloud Build pipeline compiles a Go binary and produces a container image. Currently the build succeeds but downstream Cloud Deploy releases cannot find the image, and audits show the built image is never stored in a central location. You need the build to reliably publish the container image to Artifact Registry so it can be referenced by digest in later stages. Which approach correctly ensures the image is pushed and its digest is recorded?

Accepted Answer

Add the image to the top-level 'images' field in the Cloud Build config so Cloud Build pushes it to Artifact Registry and records the resolved digest in the build results.

Answer

Rely on the 'docker build' step alone, since Cloud Build automatically pushes any image tagged with an Artifact Registry hostname at the end of the build.

Answer

Store the built image as a Cloud Storage object using the 'artifacts.objects' field and have Cloud Deploy read it from the bucket.

Answer

Enable Binary Authorization on the build trigger, which will push the image to Artifact Registry as part of attestation generation.

Question 10

Your team's Cloud Build pipeline runs unit tests, three independent integration test suites, and a static code analysis scan. Currently all steps run sequentially, and the build takes 22 minutes, causing developer frustration. The three integration suites do not depend on each other, and the static analysis does not depend on any tests. You need to reduce total build time without removing any of the checks. What should you do?

Accepted Answer

Configure the three integration test steps and the static analysis step to run concurrently by setting the same waitFor value referencing only the unit test step, allowing them to execute in parallel.

Answer

Move the integration tests and static analysis into a separate Cloud Build trigger that fires after the first build completes successfully.

Answer

Increase the machine type of the Cloud Build worker to E2_HIGHCPU_32 so that the sequential steps each complete faster.

Answer

Combine all test suites and the static analysis into a single build step running one script to reduce per-step container startup overhead.

Question 11

Your platform team runs a single Cloud Build project that hosts triggers for dozens of application repositories. Currently all triggers execute using the default Cloud Build service account, which has broad Editor-level permissions across the project. A security audit flags this as excessive: a compromised build for one low-privilege app could push images and deploy to resources belonging to other teams. You must reduce blast radius while keeping each pipeline able to perform only the actions it needs. What should you do?

Accepted Answer

Create a dedicated user-managed service account per trigger with only the IAM roles that build needs, and configure each Cloud Build trigger to run as that service account.

Answer

Keep the default Cloud Build service account but remove the Editor role and grant Owner so builds cannot be blocked by missing permissions.

Answer

Move every application into its own Google Cloud project so the shared default service account is isolated by project boundary.

Answer

Export a JSON key for the default service account and store it in Secret Manager, then have each build authenticate with the key it needs.

Question 12

Your team uses a single Cloud Build pipeline that builds a container image, runs unit tests, pushes to Artifact Registry, and then deploys to a production GKE cluster. Compliance now requires that a human release manager explicitly approve the build before the production deployment steps run, while all earlier build and test steps continue to run automatically on every commit to main. You want the least complex change that satisfies this requirement natively in Cloud Build. What should you do?

Accepted Answer

Split the pipeline so build and test run in one trigger, and use a Cloud Build manual approval on a second trigger that performs only the production deployment steps.

Answer

Configure the trigger to require manual approval, which pauses the entire build until an approver approves or rejects it in the Cloud Build console.

Answer

Add a wait step in the build config that polls a Pub/Sub topic until a release manager publishes an approval message.

Answer

Move the deployment steps to Cloud Deploy and add a promotion approval gate, replacing the Cloud Build deploy steps entirely.

Question 13

Your team's Cloud Build pipeline runs integration tests that must connect to a Cloud SQL instance and internal microservices that only have private IP addresses inside a VPC. The default Cloud Build workers cannot reach these private resources, and security policy prohibits exposing the database or services to public IPs. You need the build's integration test step to successfully reach the private resources with minimal ongoing maintenance. What should you do?

Accepted Answer

Configure a Cloud Build private pool with a peered network connection to your VPC, and run the integration test step in that private pool.

Answer

Assign a public IP to the Cloud SQL instance and use authorized networks to allow the Cloud Build worker IP ranges.

Answer

Deploy a Cloud VPN tunnel from the default Cloud Build worker pool to your VPC and route test traffic through it.

Answer

Add a startup step that installs the Cloud SQL Auth Proxy on the default pool and hardcode the private IP of each microservice.

Question 14

Your security team requires that every container image built by your Cloud Build pipelines includes verifiable build provenance so that downstream consumers can confirm the image was produced by your trusted build system and has not been tampered with. You want to minimize custom scripting and use native platform capabilities. What should you do?

Accepted Answer

Enable Cloud Build's built-in SLSA build provenance generation when pushing images to Artifact Registry, and have consumers verify the generated provenance metadata.

Answer

Add a custom build step that computes a SHA-256 digest of the image and writes it to a Cloud Storage bucket for consumers to compare.

Answer

Configure Binary Authorization to sign images at deploy time and store the signatures in Secret Manager for auditors.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry so that scan results serve as proof of image origin.

Question 15

Your platform team runs a Cloud Build pipeline that builds container images, pushes them to Artifact Registry, and then deploys to a GKE cluster via Cloud Deploy. A recent security audit found that a developer was able to manually deploy an image that had never passed through the official build pipeline. Leadership now requires that only images produced by your trusted Cloud Build pipeline can ever be deployed to the production GKE cluster, and that this rule is enforced at admission time regardless of who or what initiates the deployment. Which approach best satisfies this requirement?

Accepted Answer

Enable Binary Authorization on the production cluster with a policy that requires attestations, and configure Cloud Build to create a signed attestation for each image it builds using a dedicated attestor.

Answer

Restrict IAM so that only the Cloud Build service account has the Kubernetes Engine Developer role on the production cluster, preventing developers from deploying manually.

Answer

Enable vulnerability scanning in Artifact Registry and configure Cloud Deploy to block promotion of any image with critical vulnerabilities.

Answer

Use a VPC Service Controls perimeter around the production project so that only the Cloud Build private pool can push and deploy images.

Question 16

Your team maintains a Cloud Build pipeline that runs a lightweight unit-test build on every push to any branch. Separately, you need a heavier end-to-end integration suite that provisions ephemeral resources and takes about 45 minutes to run. The business requirement is that this integration suite runs automatically once every night at 02:00 against the latest commit on the main branch, without any developer having to push code or click a button. Which approach best meets this requirement?

Accepted Answer

Create a Cloud Scheduler job that publishes to a Pub/Sub topic, and configure a Cloud Build trigger of type Pub/Sub that references the main branch and runs the integration build config.

Answer

Add a branch-filter push trigger on main that runs the integration build config, relying on nightly merges to main to invoke it.

Answer

Configure a webhook trigger and call it from a developer's local cron job at 02:00 each night.

Answer

Set a timed soak duration in the existing unit-test trigger so it re-runs the integration suite every 24 hours automatically.

Question 17

Your team maintains a Cloud Build pipeline that builds and pushes container images to Artifact Registry. Currently a single trigger fires on every push to any branch and always tags images as 'latest'. The release manager wants a separate, repeatable release flow: when a semantic version Git tag (e.g., v1.4.2) is pushed, the pipeline should build an image tagged with that exact version string and push it to a 'release' repository, without changing the existing branch-based development builds. What is the most appropriate way to implement this?

Accepted Answer

Create a second Cloud Build trigger with a tag filter matching the semantic version pattern, and reference the built-in TAG_NAME substitution variable in the build steps to tag the image.

Answer

Modify the existing branch trigger to add a conditional shell step that inspects Git refs at runtime and manually parses the tag name from the repository.

Answer

Configure Binary Authorization to only admit images whose tag matches a semantic version, so that untagged builds are automatically rejected during deployment.

Answer

Add a manual approval gate to the existing trigger and have the release manager type the version number into a user-defined substitution before each build.

Question 18

Your team maintains a monorepo in Cloud Source Repositories containing a payment microservice. You must ensure that unit and integration tests run automatically only when a pull request targets the 'main' branch, and that a container image is built and pushed to Artifact Registry only after a commit is merged into 'main'. Developers frequently open feature branches, and you want to avoid running the full test-and-build pipeline on every feature branch push. Which approach best implements this using Cloud Build triggers?

Accepted Answer

Create a pull request trigger with a branch filter matching '^main$' that runs the test-only build config, and a separate push trigger with a branch filter matching '^main$' that runs the build-and-push config.

Answer

Create a single push trigger with no branch filter and use inline bash conditionals in cloudbuild.yaml to decide whether to test or build based on the branch name.

Answer

Create one push trigger filtered to all branches that always runs tests, and rely on Artifact Registry cleanup policies to delete images that came from feature branches.

Answer

Create a scheduled trigger that runs every hour to test and build the latest commit on 'main', ignoring pull request events entirely.

Question 19

Your team maintains a microservice that is built by a Cloud Build trigger on every merge to the main branch. Currently, an engineer manually runs 'gcloud deploy releases create' after each successful build to push the image through the dev, staging, and prod delivery pipeline. Leadership wants every successful main-branch build to automatically create a new Cloud Deploy release and begin rollout to the dev target, while preserving the existing manual approval gate before staging. What is the most appropriate way to connect the build to the delivery pipeline?

Accepted Answer

Add a final build step in the Cloud Build configuration that runs 'gcloud deploy releases create' referencing the delivery pipeline and the newly built image, using the build's short SHA as the release name.

Answer

Configure a Cloud Deploy trigger to poll Artifact Registry every five minutes and automatically create a release whenever a new image tag appears.

Answer

Enable automatic promotion on the delivery pipeline's dev stage so that Cloud Deploy detects pushed images and starts a rollout without any release creation step.

Answer

Replace the Cloud Build trigger with a Cloud Deploy trigger on the source repository so that Cloud Deploy builds the image and creates the release in a single operation.

Question 20

Your organization runs a Cloud Build pipeline that builds container images and pushes them to Artifact Registry. Security requires that only images verifiably produced by the trusted pipeline can be deployed to your production GKE cluster, and that no developer can manually push an arbitrary image that gets deployed. You have already enabled Binary Authorization on the cluster. What is the most appropriate way to complete the supply-chain control so that only pipeline-built images are admitted?

Accepted Answer

Add a Cloud Build step that creates a Binary Authorization attestation signed by a Cloud KMS key, and configure the policy to require an attestation from that attestor's public key.

Answer

Configure an Artifact Registry cleanup policy to delete any image that lacks a specific label, then let Binary Authorization admit whatever remains.

Answer

Grant only the Cloud Build service account the Artifact Registry Writer role and rely on IAM alone to block manual pushes.

Answer

Enable vulnerability scanning on Artifact Registry and set the Binary Authorization policy to block images with critical CVEs.

Question 21

Your team hosts application source code in a self-managed GitLab instance running inside your corporate network, which is not one of Cloud Build's natively integrated SCM providers. You want each merge to the main branch to automatically start a Cloud Build pipeline. The GitLab server can make outbound HTTPS calls to Google Cloud APIs. Which approach lets you trigger the build while protecting the trigger endpoint from unauthorized invocation?

Accepted Answer

Create a Cloud Build webhook trigger, store a shared secret in Secret Manager, and configure GitLab to POST to the trigger URL including the secret so Cloud Build validates each request.

Answer

Create a standard GitHub-connected Cloud Build trigger and mirror the GitLab repository to GitHub so the native integration handles authentication.

Answer

Expose the Cloud Build API publicly and have GitLab call builds.create directly using a downloaded service account key stored in the CI job.

Answer

Configure a Cloud Scheduler job that polls GitLab every minute and starts a build when it detects a new commit on main.

Question 22

A media company serves large static video thumbnails and JavaScript bundles from a global external HTTP(S) Load Balancer backed by a Cloud Storage bucket. Monitoring shows high origin egress costs and elevated tail latency for users in distant regions. Cloud CDN is enabled, but the cache hit ratio is only 22%. Investigation reveals the origin responses include 'Cache-Control: no-store' on many objects and that unique query string parameters (used for analytics tracking) are appended to nearly every asset URL. What is the MOST effective way to reduce origin egress cost and improve latency?

Accepted Answer

Set appropriate 'Cache-Control: public, max-age' headers on cacheable objects and configure the Cloud CDN cache key policy to exclude the analytics query string parameters.

Answer

Increase the Cloud Storage bucket's storage class to Standard in multiple regions and add more backend buckets to the load balancer.

Answer

Enable Cloud CDN negative caching and raise the default TTL to the maximum value regardless of the origin's Cache-Control headers.

Answer

Switch the load balancer to a regional external load balancer closer to the majority of users to shorten the network path.

Question 23

Your team uses Cloud Deploy with a delivery pipeline spanning dev, staging, and prod targets. Currently an engineer manually promotes each release from staging to prod after it has run in staging for a while. Leadership wants releases to automatically promote from staging to prod, but only after the release has soaked in staging for at least 12 hours with no issues, while still keeping a manual approval requirement on the prod target. What should you configure?

Accepted Answer

Add a Cloud Deploy Automation resource with a promote-release rule that includes a wait of 12 hours on the staging target, and keep requireApproval enabled on the prod target.

Answer

Create a Cloud Scheduler job that runs every 12 hours and calls the Cloud Deploy API to promote the latest staging release, removing the prod approval requirement.

Answer

Set a deploy hook on the staging target that sleeps for 12 hours before promoting, and disable approval on prod so the automation is not blocked.

Answer

Configure a canary deployment strategy on the staging target with a 12-hour phase duration, which will then release to prod automatically.

Question 24

Your team runs a payment API on GKE and uses Google Cloud Deploy for releases to production. Compliance requires that a fully provisioned copy of the new version receive synthetic transaction tests before any live customer traffic is shifted, and that traffic can be reverted to the previous version within seconds if the tests reveal a problem. Which deployment strategy configuration in Cloud Deploy best meets these requirements?

Accepted Answer

Configure a blue-green strategy that fully deploys the new version to a separate pool, runs a verification phase against it, and only then routes 100% of production traffic to the new version.

Answer

Configure a canary strategy with 5%, 25%, and 100% traffic phases and a verification step at each phase.

Answer

Use the default rolling update strategy of the GKE Deployment and add a post-deploy verification hook in the Cloud Deploy pipeline.

Answer

Configure a canary strategy with a single 0% phase so no traffic is served during verification, then jump to 100%.

Question 25

Your team uses Cloud Deploy to release a customer-facing service to a GKE production target. Leadership wants new releases rolled out to a small percentage of traffic first, automatically verified against error-rate metrics, and rolled back without human intervention if verification fails. What should you configure in the Cloud Deploy delivery pipeline?

Accepted Answer

Define a canary deployment strategy with automated canary phases and a verify stage in the Skaffold configuration, enabling automatic rollback on verification failure.

Answer

Use a standard (rolling) deployment strategy and add a manual approval gate before the production target so an operator can reject bad releases.

Answer

Configure a blue-green strategy that fully deploys the new version alongside the old one and swaps all traffic at once after a fixed wait time.

Answer

Create a Cloud Build trigger that deploys the release and add a separate Cloud Monitoring alerting policy that pages the on-call engineer to redeploy the previous image.