Examkin

Question

Difficulty: HardDeploying Serverless Applications with Cloud Run and Cloud Functions

A solution architect is deploying a containerized REST API image stored in Artifact Registry to Google Cloud Run in the us-central1 region using the gcloud CLI. The application binary inside the container is configured to listen strictly on container port 5000 and does not dynamically adopt environment variables. The service must be deployed securely, allowing only authenticated requests. Which gcloud CLI command correctly deploys the service with the required network port configuration and ingress access control?

  1. gcloud run deploy inventory-api --image=us-central1-docker.pkg.dev/my-project/api-repo/inventory:v1 --port=5000 --no-allow-unauthenticated --region=us-central1Answer
  2. B
    gcloud run deploy inventory-api --image=us-central1-docker.pkg.dev/my-project/api-repo/inventory:v1 --no-allow-unauthenticated --region=us-central1
  3. C
    gcloud functions deploy inventory-api --image=us-central1-docker.pkg.dev/my-project/api-repo/inventory:v1 --port=5000 --region=us-central1
  4. D
    gcloud run deploy inventory-api --image=us-central1-docker.pkg.dev/my-project/api-repo/inventory:v1 --port=5000 --allow-unauthenticated --role=roles/owner --region=us-central1

Answer

The command that specifies the custom container listening port using --port=5000, enforces private access via --no-allow-unauthenticated, and targets the us-central1 region with gcloud run deploy is the correct deployment approach.
The command using gcloud run deploy with --port=5000 and --no-allow-unauthenticated correctly informs Cloud Run to forward incoming requests to container port 5000 while ensuring that unauthenticated public traffic is blocked.

Step-by-Step Solution

1
Identify the appropriate serverless compute service for custom container image deployment.
Cloud Run is the required platform because it accepts arbitrary container images from Artifact Registry, whereas Cloud Functions targets source code/event-driven function signatures.
Cloud Run allows developers to package microservices into standard OCI containers.
2
Determine the required CLI flags for custom port binding.
By default, Cloud Run sends requests to port 8080 inside the container. Because the binary listens on port 5000, the --port=5000 flag must be explicitly declared during deployment.
If the container port does not match where the binary is listening, container health checks fail and ingress traffic cannot reach the application.
3
Configure the access control parameters according to security requirements.
The --no-allow-unauthenticated flag ensures IAM authentication is enforced for incoming HTTP requests.
The requirement specifies that only authenticated requests should be permitted.

Key Concept

Cloud Run Container Port Configuration and Ingress IAM Security via gcloud CLI
Estimated Time:2m 0s
Rate this question

Topics

Deploying Serverless Applications with Cloud Run and Cloud Functions