Examkin

Question

Difficulty: Very hardDeploying Serverless Applications with Cloud Run and Cloud Functions

A platform engineer is deploying a containerized microservice to Google Cloud Run in the us-central1 region using the container image us-docker.pkg.dev/corp-apps/prod/account-api:v1. The application inside the container is configured to listen strictly on custom TCP port 5000 and does not automatically detect the default PORT environment variable. The requirement dictates that the service must immediately route 100% of live HTTP traffic to this newly deployed revision while enforcing private access by blocking all unauthenticated invocations. Which gcloud command must the engineer execute to achieve this deployment outcome correctly?

  1. gcloud run deploy account-api --image=us-docker.pkg.dev/corp-apps/prod/account-api:v1 --port=5000 --no-allow-unauthenticated --region=us-central1Answer
  2. B
    gcloud run deploy account-api --image=us-docker.pkg.dev/corp-apps/prod/account-api:v1 --set-env-vars=PORT=5000 --allow-unauthenticated --region=us-central1
  3. C
    gcloud run deploy account-api --image=us-docker.pkg.dev/corp-apps/prod/account-api:v1 --port=5000 --no-traffic --no-allow-unauthenticated --region=us-central1
  4. D
    gcloud functions deploy account-api --image=us-docker.pkg.dev/corp-apps/prod/account-api:v1 --port=5000 --entry-point=main --region=us-central1

Answer

The correct option is the command executing 'gcloud run deploy account-api --image=us-docker.pkg.dev/corp-apps/prod/account-api:v1 --port=5000 --no-allow-unauthenticated --region=us-central1'.
The correct command uses the --port=5000 flag to configure Cloud Run to forward incoming requests to port 5000 inside the container, includes --no-allow-unauthenticated to enforce strict IAM access control, and allows default 100% traffic assignment to the newly deployed revision.

Step-by-Step Solution

1
Identify the container port configuration requirement for Cloud Run.
By default, Cloud Run sends requests to port 8080. To tell Cloud Run to send requests to custom container port 5000, the --port=5000 flag must be set during deployment.
Setting custom environment variables via --set-env-vars does not update the ingress container port mapping unless the app binary actively reads that variable.
2
Verify authentication and ingress access settings.
The --no-allow-unauthenticated flag ensures that IAM authentication is required and public unauthenticated HTTP access is denied.
Using --allow-unauthenticated opens the service to the public internet, violating security requirements.
3
Verify revision traffic assignment behavior.
Standard gcloud run deploy automatically assigns 100% of incoming traffic to the newly created revision.
Using --no-traffic explicitly creates the revision with 0% traffic allocation, requiring a separate traffic splitting operation.

Key Concept

Cloud Run Custom Container Port Binding and CLI Deployment Flags
Rate this question

Topics

Deploying Serverless Applications with Cloud Run and Cloud Functions