Examkin

Question

Difficulty: HardDeploying Serverless Applications with Cloud Run and Cloud Functions

A cloud engineer needs to deploy a containerized backend processing microservice to Google Cloud Run in the europe-west1 region using the gcloud CLI. The application image is stored in Artifact Registry. Security policies require that the service must prevent unauthenticated ingress traffic and run with a specific user-managed runtime service account named [email protected] to access downstream Google Cloud databases. Which gcloud command correctly deploys the service in accordance with these security requirements?

  1. gcloud run deploy processor-service --image=europe-west1-docker.pkg.dev/my-project/repo/processor:v1 --region=europe-west1 --no-allow-unauthenticated --service-account=processor-sa@my-project.iam.gserviceaccount.comAnswer
  2. B
    gcloud functions deploy processor-service --image=europe-west1-docker.pkg.dev/my-project/repo/processor:v1 --region=europe-west1 --no-allow-unauthenticated --service-account=processor-sa@my-project.iam.gserviceaccount.com
  3. C
    gcloud run deploy processor-service --image=europe-west1-docker.pkg.dev/my-project/repo/processor:v1 --zone=europe-west1-a --no-allow-unauthenticated --service-account=processor-sa@my-project.iam.gserviceaccount.com
  4. D
    gcloud run deploy processor-service --image=europe-west1-docker.pkg.dev/my-project/repo/processor:v1 --region=europe-west1 --allow-unauthenticated --service-account=processor-sa@my-project.iam.gserviceaccount.com

Answer

The correct command uses `gcloud run deploy` with `--region=europe-west1`, `--no-allow-unauthenticated`, and `--service-account=processor-sa@my-project.iam.gserviceaccount.com`.
The command correctly uses `gcloud run deploy` to provision a containerized Cloud Run service, sets the regional deployment scope to `europe-west1`, prevents public unauthenticated access using `--no-allow-unauthenticated`, and binds the dedicated identity using `--service-account`.

Step-by-Step Solution

1
Identify the target compute platform and tool
Since a pre-built container image from Artifact Registry is being deployed as a serverless containerized service, `gcloud run deploy` must be used rather than `gcloud functions deploy`.
Cloud Run natively executes container images, whereas Cloud Functions builds and executes event-driven code snippets or Gen 2 functions.
2
Configure operational scope and service identity flags
Specify `--region=europe-west1` for regional scope and `--service-account` to bind the custom runtime service account identity.
Cloud Run services are regional resources requiring a region target, and custom service accounts provide least-privilege identity for downstream resource access.
3
Enforce ingress access controls
Pass the `--no-allow-unauthenticated` flag to restrict access to authenticated IAM invokers only.
Passing `--allow-unauthenticated` exposes the HTTP endpoint publicly without IAM verification.

Key Concept

Deploying containerized serverless applications using gcloud run deploy with custom runtime service accounts and authentication flags.
Estimated Time:2m 0s
Rate this question

Topics

Deploying Serverless Applications with Cloud Run and Cloud Functions