Examkin

Question

Difficulty: MediumDeploying Serverless Applications with Cloud Run and Cloud Functions

A software engineering team built a Node.js microservice packaged as a custom container image stored in Artifact Registry. The internal web server application inside the container is explicitly configured to listen on port 5000. The team must deploy this service to Cloud Run in region us-central1 using a custom identity service account named [email protected] and ensure that unauthenticated requests are blocked. Which gcloud command should be executed to accomplish this deployment?

  1. gcloud run deploy node-api --image=us-central1-docker.pkg.dev/company-project/apps/node-api:v1 --port=5000 --service-account=api-runner@company-project.iam.gserviceaccount.com --no-allow-unauthenticated --region=us-central1Answer
  2. B
    gcloud run deploy node-api --image=us-central1-docker.pkg.dev/company-project/apps/node-api:v1 --service-account=api-runner@company-project.iam.gserviceaccount.com --no-allow-unauthenticated --region=us-central1
  3. C
    gcloud functions deploy node-api --image=us-central1-docker.pkg.dev/company-project/apps/node-api:v1 --service-account=api-runner@company-project.iam.gserviceaccount.com --region=us-central1
  4. D
    gcloud run deploy node-api --image=us-central1-docker.pkg.dev/company-project/apps/node-api:v1 --port=5000 --service-account=project-owner@company-project.iam.gserviceaccount.com --allow-unauthenticated --region=us-central1

Answer

The command 'gcloud run deploy node-api --image=us-central1-docker.pkg.dev/company-project/apps/node-api:v1 --port=5000 --service-account=api-runner@company-project.iam.gserviceaccount.com --no-allow-unauthenticated --region=us-central1' correctly configures the non-default port 5000, attaches the designated service account, and enforces authentication requirements.
The correct command explicitly sets the container port to 5000 via '--port=5000', matching the internal port of the web server. It also correctly attaches the designated custom service account and includes '--no-allow-unauthenticated' to enforce authentication controls.

Step-by-Step Solution

1
Identify the target deployment platform and container runtime port requirements.
The application is a custom web server container listening on port 5000 targeted for Cloud Run.
Cloud Run forwards ingress traffic to port 8080 by default; custom ports must be explicitly defined using the --port flag.
2
Determine the necessary security and identity flags for gcloud run deploy.
Set --service-account=api-runner@company-project.iam.gserviceaccount.com and append --no-allow-unauthenticated.
Ensures principle of least privilege for execution identity while preventing anonymous public invocation.
3
Assemble and verify the complete deployment command.
Combine image location, port override, service account assignment, region, and security flags into a single gcloud execution statement.
Guarantees that the revision starts up properly and adheres to security constraints.

Key Concept

Configuring custom container port bindings and execution identities when deploying Cloud Run services via gcloud CLI.
Rate this question

Topics

Deploying Serverless Applications with Cloud Run and Cloud Functions