PCDE Bootstrapping a Google Cloud Organisation for DevOps Practice Test 1 — 15 Questions

Question 1

A DevOps engineer is setting up a new Google Cloud organization for their company. They need to ensure that all projects are created within a structured hierarchy that separates production, staging, development, and sandbox environments. Which folder structure BEST supports this requirement?

Accepted Answer

Create a folder for each environment (prod, staging, dev, sandbox) directly under the organization node. Within each environment folder, create subfolders for teams or products, and place projects in those subfolders.. The recommended landing zone design uses top-level folders for environments (prod, staging, dev, sandbox) under the organization node, with team/product subfolders inside each environment folder. This allows IAM and org policies to be inherited appropriately.

Answer

Create a folder for each product under the organization node, and within each product folder, create subfolders for environments.

Answer

Create a flat folder structure under the organization node with one folder per team, and place all projects in their team folder regardless of environment.

Answer

Create a flat folder structure with one folder per project type (shared VPC, logging, security) and place all projects in those folders.

Question 2

An organization wants to enforce that all Compute Engine instances in their Google Cloud organization are created with Shielded VM enabled. What is the MOST effective way to enforce this requirement?

Accepted Answer

Set an organization policy with the constraint compute.requireShieldedVm at the organization level.. Organization policies can enforce constraints on resource creation. The compute.requireShieldedVm constraint ensures that any new VM must have Shielded VM enabled; otherwise, the creation fails.

Answer

Configure a VPC Service Controls perimeter to only allow Shielded VMs.

Answer

Create a custom IAM role that only allows creating VMs with Shielded VM enabled.

Answer

Use Cloud Audit Logs to detect non-compliant VMs and trigger a Cloud Function to delete them.

Question 3

A financial services company is using Terraform to manage their Google Cloud infrastructure. They have multiple environments (dev, staging, prod) and want to use a single Terraform configuration with separate state files per environment. They also need to store the Terraform state securely in a shared backend. Which approach should they use?

Accepted Answer

Use Terraform workspaces with a GCS backend. Each workspace automatically creates a separate state file (e.g., env:/dev/project.tfstate).. Terraform workspaces allow using the same configuration with separate state files for each environment. Using a GCS backend with a prefix per workspace stores the state files in separate objects.

Answer

Use Terraform Cloud's workspaces feature with a GCS backend configured in the Terraform Cloud workspace settings.

Answer

Create separate Terraform configurations for each environment and store state in a single GCS bucket with different object names.

Answer

Use Terraform workspaces with a local backend and store state files in a Cloud Storage bucket manually.

Question 4

A DevOps team wants to implement policy-as-code to enforce that all Terraform configurations comply with security rules before deployment. Which tool is most appropriate for pre-commit policy checks on Terraform plans?

Accepted Answer

Conftest. Conftest is a tool that can evaluate policy as code (using Rego language) against structured configuration files like Terraform HCL or plan JSON. It is designed for pre-commit checks in CI/CD pipelines.

Answer

Google Cloud Deployment Manager

Answer

Open Policy Agent (OPA)

Answer

Sentinel

Question 5

An organization wants to centralize cost management across multiple projects. They need to analyze spending trends and set budget alerts. Which combination of services should they use?

Accepted Answer

Export billing data to BigQuery and set up budgets with alert thresholds.. For cost analysis, billing export to BigQuery provides detailed data. Budgets and alerts are set up in the Cloud Billing console and can trigger notifications via Pub/Sub or email.

Answer

Use the Cloud Billing API to retrieve cost data and store in Firestore for querying.

Answer

Export billing data to Cloud Storage and use Cloud Logging for analysis.

Answer

Enable Cloud Billing reports and configure Slack notifications via webhooks.

Question 6

What is the primary benefit of using Workload Identity Federation over service account keys when authenticating workloads running outside Google Cloud?

Accepted Answer

It eliminates the need to create and manage long-lived service account keys, reducing the risk of key exposure.. Workload Identity Federation allows external workloads to impersonate a service account temporarily without needing to manage long-lived service account keys, which are a security risk.

Answer

It allows using multiple service accounts simultaneously.

Answer

It enables workloads to run without any service account.

Answer

It provides higher performance for authentication requests.

Question 7

A company is adopting GitOps for managing their Kubernetes infrastructure with Config Sync. They want to ensure that any changes to the cluster's desired state are automatically applied from a Git repository. Which branching strategy is MOST suitable for this workflow?

Accepted Answer

Trunk-based development where all changes are merged into the main branch frequently, and Config Sync watches the main branch.. Trunk-based development with short-lived feature branches and direct commits to main (or a single release branch) is the simplest and most aligned with GitOps principles where main branch represents the desired state.

Answer

One branch per cluster, with manual merge from development to production branches.

Answer

Gitflow with separate develop and release branches, merging to main only for production releases.

Answer

Feature branching with long-lived branches per environment (dev, staging, prod).

Question 8

An organization wants to restrict the creation of Compute Engine instances in their Google Cloud organization to only certain regions. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The resourceLocations constraint is used to restrict where resources can be created. It can be applied at any level of the resource hierarchy.

Answer

compute.requireShieldedVm

Answer

constraints/compute.vmExternalIpAccess

Answer

iam.allowedPolicyMemberDomains

Question 9

A DevOps engineer is designing a shared VPC topology for a multi-project environment. Which service project permission allows a project to use subnets from a host project?

Accepted Answer

compute.networkUser on the host project. To use shared VPC, the service project must have the compute.networkUser role on the host project's subnets.

Answer

resourcemanager.projectIamAdmin on the service project

Answer

compute.networkAdmin on the host project

Answer

compute.instanceAdmin on the service project

Question 10

A company wants to implement granular cost tracking for their cloud resources. They need to attribute costs to specific teams and environments. Which approach should they use?

Accepted Answer

Apply labels to resources, such as 'team:engineering' and 'environment:prod', and use billing export to BigQuery for cost analysis.. Labels are key-value pairs that can be applied to resources. By using labels like 'team' and 'environment', costs can be broken down in billing reports and BigQuery exports.

Answer

Use separate projects for each team and environment, and analyze costs per project.

Answer

Use separate billing accounts for each team.

Answer

Enable cost attribution in Cloud Monitoring.

Question 11

A DevOps team is using Terraform to manage infrastructure. They have a module that creates a Cloud Storage bucket. They want to reference the bucket's URL in another part of the configuration without hardcoding. Which approach should they use?

Accepted Answer

Use Terraform outputs and a remote state data source to read the bucket URL from the state of the configuration that created it.. Terraform remote state data sources allow one configuration to read outputs from another configuration's state file stored in a backend like GCS.

Answer

Use a shared Terraform workspace to access the bucket across configurations.

Answer

Use a Terraform data source for the bucket, such as google_storage_bucket.

Answer

Store the bucket URL in a variable and pass it manually.

Question 12

A DevOps engineer is setting up CI/CD for a microservice application. They want to use Cloud Build to deploy to Google Kubernetes Engine (GKE) only if the build passes tests. Which Cloud Build configuration approach should they use?

Accepted Answer

Create a cloudbuild.yaml with a test step that fails the build if tests fail, and a subsequent deploy step that runs only if all previous steps succeed.. Cloud Build triggers can be configured to run a build config (cloudbuild.yaml) that includes steps for testing and deployment. Conditional deployment can be handled by the build steps themselves.

Answer

Use two separate Cloud Build triggers: one for testing and one for deployment, and manually trigger the deployment after tests pass.

Answer

Configure a single Cloud Build trigger that runs test and deploy steps in parallel.

Answer

Use Cloud Functions to orchestrate testing and deployment via separate Cloud Build API calls.

Question 13

An organization wants to enforce that no Compute Engine instances have public IP addresses. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Set the organization policy constraint constraints/compute.vmExternalIpAccess at the desired folder or project level.. Organization policies can restrict external IPs at the project level (constraints/compute.vmExternalIpAccess). Also, using a Shared VPC and only creating VMs in subnets without external IP access (by not having a default route to the internet) can prevent public IPs, although a more direct method is the org policy.

Answer

Create a custom IAM role that denies the compute.instances.create permission with external IP.

Answer

Use VPC Service Controls to restrict access to Compute Engine API.

Answer

Set the organization policy constraint constraints/compute.vmCanIpForward to deny.

Question 14

A company is adopting Infrastructure as Code with Terraform and wants to enforce policy as code using Open Policy Agent (OPA). Which THREE components are required to implement this in a CI/CD pipeline? (Choose THREE.)

Accepted Answer

A CI/CD pipeline step that runs the policy check and fails the build on violations.. To enforce OPA policies on Terraform plans, you need: 1) OPA policy files written in Rego, 2) a tool like Conftest or a custom OPA integration to evaluate policies against the Terraform plan JSON, and 3) a CI/CD pipeline step that runs the evaluation and fails the build if policies are violated.

Answer

A GCS bucket to store policy files.

Answer

A Terraform provider for OPA.

Question 15

A DevOps engineer is designing a landing zone for a large enterprise. Which THREE components are essential for a well-architected landing zone? (Choose THREE.)

Accepted Answer

A shared VPC project to host common network resources.. A landing zone typically includes a shared VPC for network connectivity, a centralized logging project for audit logs, and a security project for centralized security services like Cloud Armor and Security Command Center.

Answer

A single billing account per team.

Answer

A separate project per developer for sandbox environments.