PCDE Bootstrapping a Google Cloud Organisation for DevOps Practice Test 2 — 15 Questions

Question 1

An organization wants to enforce that all Compute Engine VMs are created with Shielded VM features enabled to protect against rootkits and boot-level malware. Which Google Cloud mechanism should be used?

Accepted Answer

Organization policies. Organization policies allow you to define constraints that apply to all resources under an organization. The `compute.requireShieldedVm` constraint enforces that VMs must have Shielded VM enabled. IAM roles and service accounts control access but not resource properties. Labels are for metadata, not enforcement.

Answer

Resource labels

Answer

Service accounts

Answer

IAM roles

Question 2

A DevOps team is designing a landing zone for a multi-team organization. They need to separate environments (prod, staging, dev) and also provide isolated projects for each team's sandbox testing. The team wants to centrally manage networking and security through a shared VPC. Which folder structure best supports this design?

Accepted Answer

Folders: prod, staging, dev, common; inside each, folders for teams with their projects; plus a sandbox folder. A common best practice is to have environment folders (prod, staging, dev) and within each, team folders with team-specific projects. A separate 'common' folder for shared services like networking and security aligns with a landing zone design. The 'Sandbox' folder can contain sandbox projects outside the environment hierarchy.

Answer

Folders: TeamA, TeamB; inside each: prod, staging, dev projects

Answer

Folders: prod, staging, dev; inside each, folders for each team's project; no sandbox folder

Answer

Folders: prod, staging, dev, sandbox; all projects inside with no team subfolders

Question 3

A company uses Terraform to manage infrastructure. They have a monolithic Terraform configuration that manages all projects in a single state file. As the organization grows, the configuration becomes slow and error-prone. The team wants to adopt a modular approach with separate state files for each project while reusing common modules. Which strategy should they follow?

Accepted Answer

Split the monolithic configuration into separate root modules per project, store state in GCS buckets with prefix per project, and use terraform_remote_state data sources to share outputs between modules.. Terraform workspaces are used to manage multiple state files within a single root module but are not designed for separate project state files. Remote state data sources allow reading outputs from other state files, enabling modular architecture. Using separate root modules for each project with remote state dependencies is the recommended approach for large environments.

Answer

Create a single Terraform module for all resources and call it with different variables for each project, using the same state file.

Answer

Keep the monolithic configuration but use Terraform workspaces to create separate state files for each project.

Answer

Use Cloud Deployment Manager with separate YAML templates for each project and a central state stored in Cloud Storage.

Question 4

An organization wants to enforce that Compute Engine instances cannot have public IP addresses. Which organization policy constraint should be applied?

Accepted Answer

compute.vmExternalIpAccess. The `compute.vmExternalIpAccess` constraint restricts which VM instances are allowed to have external IP addresses. When enforced as a list deny, it can block all external IPs.

Answer

compute.requireOsLogin

Answer

compute.disableSerialPortAccess

Answer

iam.disableServiceAccountKeyCreation

Question 5

A team is adopting GitOps for infrastructure. They want to ensure that all Terraform configuration changes are automatically applied after merging to the main branch. Which CI/CD approach best supports this?

Accepted Answer

Use a CI/CD pipeline that runs `terraform apply` after a merge to the main branch.. GitOps uses Git as the single source of truth, and changes are automatically applied to the target environment when merged to the main branch. A CI/CD pipeline triggered on merge that runs `terraform apply` achieves this.

Answer

Run `terraform plan` on every commit and require manual approval before apply.

Answer

Have developers apply changes locally using `terraform apply`.

Answer

Use Cloud Deployment Manager with a trigger on Cloud Source Repository commits.

Question 6

A company uses a shared VPC with multiple service projects. The network team wants to allow a DevOps team to create Cloud Run services in a service project but prevent them from creating Cloud Run services with public access (allowUnauthenticated invocations). What is the best approach?

Accepted Answer

Use the organization policy constraint `run.allowedIngress` to restrict ingress to internal only.. Organization policy `run.allowedIngress` can restrict Cloud Run services to only allow internal or internal-and-cloud-load-balancing traffic, effectively blocking public access. IAM roles control who can create services but not their properties. Service accounts would be used by services themselves, not for enforcement.

Answer

Configure the shared VPC firewall to block incoming traffic from the internet to Cloud Run services.

Answer

Create a custom IAM role that includes only the run.services.create permission, and assign it to the DevOps team.

Answer

Use a service account with the run.services.create permission and enforce that the DevOps team uses it.

Question 7

An organization wants to implement policy-as-code to validate Terraform plans against security policies before applying them. They are using Terraform Cloud (TFE). Which tool is natively integrated with Terraform Cloud for policy checks?

Accepted Answer

Sentinel. Sentinel is HashiCorp's policy-as-code framework, natively integrated with Terraform Cloud and Terraform Enterprise. OPA and Conftest can be used in CI/CD pipelines but are not natively integrated with Terraform Cloud.

Answer

Open Policy Agent (OPA)

Answer

Cloud Audit Logs

Answer

Conftest

Question 8

A team manages infrastructure across multiple Google Cloud projects using Terraform. They want to centralize state file management in a GCS bucket and ensure that each project's state is isolated. Which backend configuration best achieves this?

Accepted Answer

Use a single bucket with a separate prefix for each project; configure the backend for each project with its own prefix.. Terraform backend configuration allows specifying a GCS bucket and prefix. Using a separate prefix per project (e.g., `project-a/terraform.tfstate`) isolates state files. Workspaces are not needed; the prefix approach is simpler.

Answer

Use a separate bucket for each project.

Answer

Use local state files and commit them to Git.

Answer

Store all state files in the same bucket under the same prefix and use workspaces.

Question 9

A company needs to track costs across different teams and projects. They want to see detailed breakdowns by team, environment, and application. Which GCP feature should they use to tag resources for cost analysis?

Accepted Answer

Resource labels. Labels are key-value pairs that can be attached to resources for cost allocation and reporting. Tags are also available but are used for networking and IAM, not primarily for cost tracking. Billing budgets and export are complementary but not for tagging.

Answer

Billing budgets

Answer

Network tags

Answer

Billing export to BigQuery

Question 10

A DevOps engineer is bootstrapping a new organization. They need to set up a centralized logging project to collect audit logs from all projects. What is the required step to enable cross-project log sinks?

Accepted Answer

Create a log sink in each source project with the destination set to the central project's BigQuery dataset.. To send logs from one project to another, you create a sink in the source project with a destination in the central project. The sink can be configured to include all logs or specific ones (e.g., audit logs). The destination must be a BigQuery dataset, Cloud Storage bucket, or Pub/Sub topic in the central project.

Answer

Create a log sink in the central project that pulls logs from other projects.

Answer

Use Cloud Audit Logs API to stream logs to the central project.

Answer

Grant the central project's logging service account the `roles/logging.admin` role in each source project.

Question 11

A company uses Terraform with remote state stored in GCS. They want to prevent concurrent `terraform apply` runs for the same configuration to avoid state corruption. Which feature should they use?

Accepted Answer

State locking is automatically enabled when using a GCS backend; no additional configuration is needed.. Terraform state locking is automatically enabled when using a backend that supports it, like GCS. GCS uses object versioning and a lock file to prevent concurrent modifications. Workspaces and remote execution are unrelated to locking.

Answer

Set the `-lock` flag to `true` in the Terraform CLI command.

Answer

Enable state locking in the GCS bucket by setting `force_destroy = false`.

Answer

Use Terraform workspaces to isolate runs.

Question 12

A team wants to implement policy-as-code to check Terraform plans for compliance before deployment. They prefer an open-source tool that works with any CI/CD pipeline and can evaluate policies expressed in Rego. Which tool should they use?

Accepted Answer

Conftest. Conftest is a CLI tool that uses OPA/Rego to evaluate configuration files and Terraform plans. It is open-source and can be integrated into CI/CD. Sentinel is proprietary to Terraform Cloud. Cloud Build is not a policy engine.

Answer

Cloud Deployment Manager

Answer

Sentinel

Answer

Cloud Build

Question 13

A company is designing a landing zone for a large enterprise with multiple business units. They need to implement cost tracking and billing management. Which TWO actions should they take?

Accepted Answer

Enable billing export to BigQuery for detailed cost analysis.. Labels can be applied to resources for cost breakdown in billing reports. Billing export to BigQuery enables detailed analysis. Budgets and alerts provide notifications but do not enable tracking at the resource level. Using a billing account per project would be inefficient.

Answer

Create a separate billing account for each project.

Answer

Set up budgets and alerts for each project to monitor spending.

Answer

Use Cloud Armor to restrict access to billing data.

Question 14

A DevOps team is adopting trunk-based development for their Terraform configurations. They want to ensure that all changes are tested before being applied to production. Which THREE practices should they implement?

Accepted Answer

Require manual approval before applying changes from main to production.. Trunk-based development involves short-lived branches merged frequently to main. Running `terraform plan` in a CI pipeline on feature branches provides early feedback. Running `terraform apply` from the main branch only after review ensures production changes are controlled. Running `terraform validate` ensures syntax correctness.

Answer

Create long-lived feature branches to develop infrastructure changes.

Answer

Use a single environment (production) only to reduce complexity.

Question 15

A company wants to enforce least-privilege IAM for their DevOps team. They need to grant permissions to manage Compute Engine instances but not to delete them. Which TWO approaches should they use?

Accepted Answer

Use a predefined role with an IAM condition that denies delete operations.. Predefined roles like `roles/compute.instanceAdmin.v1` include delete permissions. Custom roles allow fine-grained selection of specific permissions. Predefined roles with conditions can restrict actions (e.g., prevent delete), but conditions can be complex. The simplest is to create a custom role with only the required permissions (e.g., compute.instances.create, etc., but not delete).

Answer

Grant the `roles/compute.instanceAdmin.v1` role.

Answer

Grant the `roles/owner` role at the project level.

Answer

Grant the `roles/compute.admin` role.