PCDE Bootstrapping a Google Cloud Organisation for DevOps — 20 Questions

Question 1

A DevOps engineer is setting up a new Google Cloud organization for their company. They need to ensure that all projects are created within a structured hierarchy that separates production, staging, development, and sandbox environments. Which folder structure BEST supports this requirement?

Accepted Answer

Create a folder for each environment (prod, staging, dev, sandbox) directly under the organization node. Within each environment folder, create subfolders for teams or products, and place projects in those subfolders.. The recommended landing zone design uses top-level folders for environments (prod, staging, dev, sandbox) under the organization node, with team/product subfolders inside each environment folder. This allows IAM and org policies to be inherited appropriately.

Answer

Create a folder for each product under the organization node, and within each product folder, create subfolders for environments.

Answer

Create a flat folder structure under the organization node with one folder per team, and place all projects in their team folder regardless of environment.

Answer

Create a flat folder structure with one folder per project type (shared VPC, logging, security) and place all projects in those folders.

Question 2

An organization wants to enforce that all Compute Engine instances in their Google Cloud organization are created with Shielded VM enabled. What is the MOST effective way to enforce this requirement?

Accepted Answer

Set an organization policy with the constraint compute.requireShieldedVm at the organization level.. Organization policies can enforce constraints on resource creation. The compute.requireShieldedVm constraint ensures that any new VM must have Shielded VM enabled; otherwise, the creation fails.

Answer

Configure a VPC Service Controls perimeter to only allow Shielded VMs.

Answer

Create a custom IAM role that only allows creating VMs with Shielded VM enabled.

Answer

Use Cloud Audit Logs to detect non-compliant VMs and trigger a Cloud Function to delete them.

Question 3

A financial services company is using Terraform to manage their Google Cloud infrastructure. They have multiple environments (dev, staging, prod) and want to use a single Terraform configuration with separate state files per environment. They also need to store the Terraform state securely in a shared backend. Which approach should they use?

Accepted Answer

Use Terraform workspaces with a GCS backend. Each workspace automatically creates a separate state file (e.g., env:/dev/project.tfstate).. Terraform workspaces allow using the same configuration with separate state files for each environment. Using a GCS backend with a prefix per workspace stores the state files in separate objects.

Answer

Use Terraform Cloud's workspaces feature with a GCS backend configured in the Terraform Cloud workspace settings.

Answer

Create separate Terraform configurations for each environment and store state in a single GCS bucket with different object names.

Answer

Use Terraform workspaces with a local backend and store state files in a Cloud Storage bucket manually.

Question 4

A DevOps team wants to implement policy-as-code to enforce that all Terraform configurations comply with security rules before deployment. Which tool is most appropriate for pre-commit policy checks on Terraform plans?

Accepted Answer

Conftest. Conftest is a tool that can evaluate policy as code (using Rego language) against structured configuration files like Terraform HCL or plan JSON. It is designed for pre-commit checks in CI/CD pipelines.

Answer

Google Cloud Deployment Manager

Answer

Open Policy Agent (OPA)

Answer

Sentinel

Question 5

An organization wants to centralize cost management across multiple projects. They need to analyze spending trends and set budget alerts. Which combination of services should they use?

Accepted Answer

Export billing data to BigQuery and set up budgets with alert thresholds.. For cost analysis, billing export to BigQuery provides detailed data. Budgets and alerts are set up in the Cloud Billing console and can trigger notifications via Pub/Sub or email.

Answer

Use the Cloud Billing API to retrieve cost data and store in Firestore for querying.

Answer

Export billing data to Cloud Storage and use Cloud Logging for analysis.

Answer

Enable Cloud Billing reports and configure Slack notifications via webhooks.

Question 6

What is the primary benefit of using Workload Identity Federation over service account keys when authenticating workloads running outside Google Cloud?

Accepted Answer

It eliminates the need to create and manage long-lived service account keys, reducing the risk of key exposure.. Workload Identity Federation allows external workloads to impersonate a service account temporarily without needing to manage long-lived service account keys, which are a security risk.

Answer

It allows using multiple service accounts simultaneously.

Answer

It enables workloads to run without any service account.

Answer

It provides higher performance for authentication requests.

Question 7

A company is adopting GitOps for managing their Kubernetes infrastructure with Config Sync. They want to ensure that any changes to the cluster's desired state are automatically applied from a Git repository. Which branching strategy is MOST suitable for this workflow?

Accepted Answer

Trunk-based development where all changes are merged into the main branch frequently, and Config Sync watches the main branch.. Trunk-based development with short-lived feature branches and direct commits to main (or a single release branch) is the simplest and most aligned with GitOps principles where main branch represents the desired state.

Answer

One branch per cluster, with manual merge from development to production branches.

Answer

Gitflow with separate develop and release branches, merging to main only for production releases.

Answer

Feature branching with long-lived branches per environment (dev, staging, prod).

Question 8

An organization wants to restrict the creation of Compute Engine instances in their Google Cloud organization to only certain regions. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The resourceLocations constraint is used to restrict where resources can be created. It can be applied at any level of the resource hierarchy.

Answer

compute.requireShieldedVm

Answer

constraints/compute.vmExternalIpAccess

Answer

iam.allowedPolicyMemberDomains

Question 9

A DevOps engineer is designing a shared VPC topology for a multi-project environment. Which service project permission allows a project to use subnets from a host project?

Accepted Answer

compute.networkUser on the host project. To use shared VPC, the service project must have the compute.networkUser role on the host project's subnets.

Answer

resourcemanager.projectIamAdmin on the service project

Answer

compute.networkAdmin on the host project

Answer

compute.instanceAdmin on the service project

Question 10

A company wants to implement granular cost tracking for their cloud resources. They need to attribute costs to specific teams and environments. Which approach should they use?

Accepted Answer

Apply labels to resources, such as 'team:engineering' and 'environment:prod', and use billing export to BigQuery for cost analysis.. Labels are key-value pairs that can be applied to resources. By using labels like 'team' and 'environment', costs can be broken down in billing reports and BigQuery exports.

Answer

Use separate projects for each team and environment, and analyze costs per project.

Answer

Use separate billing accounts for each team.

Answer

Enable cost attribution in Cloud Monitoring.

Question 11

A DevOps team is using Terraform to manage infrastructure. They have a module that creates a Cloud Storage bucket. They want to reference the bucket's URL in another part of the configuration without hardcoding. Which approach should they use?

Accepted Answer

Use Terraform outputs and a remote state data source to read the bucket URL from the state of the configuration that created it.. Terraform remote state data sources allow one configuration to read outputs from another configuration's state file stored in a backend like GCS.

Answer

Use a shared Terraform workspace to access the bucket across configurations.

Answer

Use a Terraform data source for the bucket, such as google_storage_bucket.

Answer

Store the bucket URL in a variable and pass it manually.

Question 12

A DevOps engineer is setting up CI/CD for a microservice application. They want to use Cloud Build to deploy to Google Kubernetes Engine (GKE) only if the build passes tests. Which Cloud Build configuration approach should they use?

Accepted Answer

Create a cloudbuild.yaml with a test step that fails the build if tests fail, and a subsequent deploy step that runs only if all previous steps succeed.. Cloud Build triggers can be configured to run a build config (cloudbuild.yaml) that includes steps for testing and deployment. Conditional deployment can be handled by the build steps themselves.

Answer

Use two separate Cloud Build triggers: one for testing and one for deployment, and manually trigger the deployment after tests pass.

Answer

Configure a single Cloud Build trigger that runs test and deploy steps in parallel.

Answer

Use Cloud Functions to orchestrate testing and deployment via separate Cloud Build API calls.

Question 13

An organization wants to enforce that no Compute Engine instances have public IP addresses. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Set the organization policy constraint constraints/compute.vmExternalIpAccess at the desired folder or project level.. Organization policies can restrict external IPs at the project level (constraints/compute.vmExternalIpAccess). Also, using a Shared VPC and only creating VMs in subnets without external IP access (by not having a default route to the internet) can prevent public IPs, although a more direct method is the org policy.

Answer

Create a custom IAM role that denies the compute.instances.create permission with external IP.

Answer

Use VPC Service Controls to restrict access to Compute Engine API.

Answer

Set the organization policy constraint constraints/compute.vmCanIpForward to deny.

Question 14

A company is adopting Infrastructure as Code with Terraform and wants to enforce policy as code using Open Policy Agent (OPA). Which THREE components are required to implement this in a CI/CD pipeline? (Choose THREE.)

Accepted Answer

A CI/CD pipeline step that runs the policy check and fails the build on violations.. To enforce OPA policies on Terraform plans, you need: 1) OPA policy files written in Rego, 2) a tool like Conftest or a custom OPA integration to evaluate policies against the Terraform plan JSON, and 3) a CI/CD pipeline step that runs the evaluation and fails the build if policies are violated.

Answer

A GCS bucket to store policy files.

Answer

A Terraform provider for OPA.

Question 15

A DevOps engineer is designing a landing zone for a large enterprise. Which THREE components are essential for a well-architected landing zone? (Choose THREE.)

Accepted Answer

A shared VPC project to host common network resources.. A landing zone typically includes a shared VPC for network connectivity, a centralized logging project for audit logs, and a security project for centralized security services like Cloud Armor and Security Command Center.

Answer

A single billing account per team.

Answer

A separate project per developer for sandbox environments.

Question 16

An organization wants to enforce that all Compute Engine VMs are created with Shielded VM features enabled to protect against rootkits and boot-level malware. Which Google Cloud mechanism should be used?

Accepted Answer

Organization policies. Organization policies allow you to define constraints that apply to all resources under an organization. The `compute.requireShieldedVm` constraint enforces that VMs must have Shielded VM enabled. IAM roles and service accounts control access but not resource properties. Labels are for metadata, not enforcement.

Answer

Resource labels

Answer

Service accounts

Answer

IAM roles

Question 17

A DevOps team is designing a landing zone for a multi-team organization. They need to separate environments (prod, staging, dev) and also provide isolated projects for each team's sandbox testing. The team wants to centrally manage networking and security through a shared VPC. Which folder structure best supports this design?

Accepted Answer

Folders: prod, staging, dev, common; inside each, folders for teams with their projects; plus a sandbox folder. A common best practice is to have environment folders (prod, staging, dev) and within each, team folders with team-specific projects. A separate 'common' folder for shared services like networking and security aligns with a landing zone design. The 'Sandbox' folder can contain sandbox projects outside the environment hierarchy.

Answer

Folders: TeamA, TeamB; inside each: prod, staging, dev projects

Answer

Folders: prod, staging, dev; inside each, folders for each team's project; no sandbox folder

Answer

Folders: prod, staging, dev, sandbox; all projects inside with no team subfolders

Question 18

A company uses Terraform to manage infrastructure. They have a monolithic Terraform configuration that manages all projects in a single state file. As the organization grows, the configuration becomes slow and error-prone. The team wants to adopt a modular approach with separate state files for each project while reusing common modules. Which strategy should they follow?

Accepted Answer

Split the monolithic configuration into separate root modules per project, store state in GCS buckets with prefix per project, and use terraform_remote_state data sources to share outputs between modules.. Terraform workspaces are used to manage multiple state files within a single root module but are not designed for separate project state files. Remote state data sources allow reading outputs from other state files, enabling modular architecture. Using separate root modules for each project with remote state dependencies is the recommended approach for large environments.

Answer

Create a single Terraform module for all resources and call it with different variables for each project, using the same state file.

Answer

Keep the monolithic configuration but use Terraform workspaces to create separate state files for each project.

Answer

Use Cloud Deployment Manager with separate YAML templates for each project and a central state stored in Cloud Storage.

Question 19

An organization wants to enforce that Compute Engine instances cannot have public IP addresses. Which organization policy constraint should be applied?

Accepted Answer

compute.vmExternalIpAccess. The `compute.vmExternalIpAccess` constraint restricts which VM instances are allowed to have external IP addresses. When enforced as a list deny, it can block all external IPs.

Answer

compute.requireOsLogin

Answer

compute.disableSerialPortAccess

Answer

iam.disableServiceAccountKeyCreation

Question 20

A team is adopting GitOps for infrastructure. They want to ensure that all Terraform configuration changes are automatically applied after merging to the main branch. Which CI/CD approach best supports this?

Accepted Answer

Use a CI/CD pipeline that runs `terraform apply` after a merge to the main branch.. GitOps uses Git as the single source of truth, and changes are automatically applied to the target environment when merged to the main branch. A CI/CD pipeline triggered on merge that runs `terraform apply` achieves this.

Answer

Run `terraform plan` on every commit and require manual approval before apply.

Answer

Have developers apply changes locally using `terraform apply`.

Answer

Use Cloud Deployment Manager with a trigger on Cloud Source Repository commits.