Practice Test #3

Docker Compose and dockerd can provide a fast local rebuild/restart loop, but it does not closely emulate Kubernetes manifests or the Kubernetes deployment flow used with GKE and Cloud Deploy. Compose uses a different configuration model (docker-compose.yml) and lacks native concepts like Deployments, Services, ConfigMaps, and RBAC. This fails the requirement to closely emulate production Kubernetes manifests and deployment behavior.

Terraform and kubeadm are oriented toward provisioning infrastructure and bootstrapping Kubernetes clusters, not rapid inner-loop development. kubeadm is heavyweight and operationally complex for a laptop workflow, and Terraform adds infrastructure management overhead rather than enabling hot-reload. Neither provides an automatic file-watching rebuild/redeploy loop comparable to Skaffold, so the ≤10-second iteration requirement is not met.

kaniko and Tekton are primarily designed for building images and running pipelines in Kubernetes (CI/CD), not for a fast local developer inner loop on resource-constrained laptops. kaniko commonly pushes to a registry, and Tekton requires a Kubernetes cluster and pipeline setup overhead. This combination is better suited to remote build systems (e.g., in-cluster CI) than local hot-reload development without a registry.

Cloud SQL (PostgreSQL) is a managed relational database but still requires schema management and careful capacity planning. Weekly schema migrations and downtime risk are exactly the pain points described. At 45,000 writes/second, a single instance will not suffice; scaling typically requires read replicas (not for writes) or application-level sharding, increasing operational overhead. It also doesn’t naturally support highly variable per-user records without frequent migrations.

Cloud Storage is an object store for blobs (files) with very high durability and throughput, but it is not a database optimized for low-latency key-based reads/writes with per-user transactional consistency. You could store per-user JSON objects, but you’d lose efficient querying, atomic updates across multiple related items, and database-like concurrency controls. It’s better for raw telemetry archives, exports, or batch analytics inputs.

Cloud Spanner provides horizontally scalable relational SQL with strong consistency and high availability, and it can handle very high write throughput. However, it is schema-based and best when you need relational modeling, SQL joins, and cross-row/table transactions at scale. The scenario explicitly wants to avoid rigid schemas and frequent migrations, and only needs per-user transactional consistency with simple key-based reads—making Spanner unnecessarily complex and costly.

Incorrect. If the VM is stuck in “Starting” and repeatedly rebooting, the OS likely never reaches a stable multi-user state where sshd is running and accepting logins. Changing the Linux username does not address bootloader/kernel/filesystem failures. SSH troubleshooting is appropriate when the instance is RUNNING and serial console indicates the OS booted successfully.

Incorrect. VPC firewall rules and routes affect network connectivity to/from an instance, but they do not prevent the guest OS from booting. A VM can fully boot even with no network access. The symptom described (serial console shows repeated boot attempts and the instance remains in Starting) points to disk/OS boot issues rather than routing or firewall configuration.

Incorrect. Dropped network traffic (firewall/policy) can explain inability to SSH or reach the application, but it does not explain repeated boot attempts shown in the serial console or a VM stuck in “Starting.” Network policies operate after the OS boots and the NIC is configured; they do not typically cause kernel/init failures or reboot loops.

Cloud Functions is serverless and can autoscale, but it is primarily event/function oriented and historically constrained around runtimes and packaging. Even with newer container support, the question explicitly frames a containerized microservice with native .so libraries and OpenSSL 1.1 build requirements, which is a more natural fit for Cloud Run’s “run any container” model and HTTP service semantics (port 8080, request routing, concurrency controls).

A Container-Optimized OS VM on Compute Engine can run containers, but it still requires provisioning and managing VMs (patching strategy, instance groups, autoscaling configuration, OS lifecycle, monitoring, and capacity planning). It also will not naturally scale to zero without additional orchestration and would typically have slower operational iteration than Cloud Run. This violates the “does not want to manage servers” requirement.

GKE is powerful for container orchestration, but it introduces cluster management overhead (node pools, upgrades, patching, scaling, networking policies), even in Autopilot mode. While GKE can autoscale, scaling to zero for an HTTP service and achieving consistently low cold starts is more complex and typically involves Knative/KEDA patterns. The question explicitly asks to avoid managing clusters, making Cloud Run the better match.

Google Cloud Armor is a security enforcement service (WAF and DDoS protection) for applications behind Cloud Load Balancing. It helps mitigate threats using preconfigured WAF rules (e.g., OWASP CRS), custom rules, and rate limiting. However, it does not crawl your site or generate a vulnerability findings report from active scanning. It’s for prevention and mitigation, not discovery/assessment.

Cloud Debugger (part of Cloud Operations) helps inspect application state in production by capturing snapshots and adding logpoints without stopping the app. It is used for troubleshooting and debugging code issues, not for security scanning. It does not crawl web pages, test for XSS, or report vulnerable client-side libraries.

Error Reporting aggregates and groups application errors/exceptions and provides notifications and dashboards to help developers prioritize fixes. It is valuable for reliability and debugging production issues, but it does not perform web vulnerability scanning, does not crawl pages, and will not assess XSS exposure or vulnerable client-side libraries.