PCDE Bootstrapping a Google Cloud Organisation for DevOps Practice Test 3 — 15 Questions

Question 1

A DevOps engineer is bootstrapping a new Google Cloud organization. They need to enforce that all Compute Engine VM instances must use Shielded VM features. Which method should they use?

Accepted Answer

Apply an organization policy with constraint constraints/compute.requireShieldedVm at the organization level.. Organization policies allow you to centrally constrain resource usage across the entire resource hierarchy. The 'constraints/compute.requireShieldedVm' policy enforces Shielded VM on all new VMs. IAM roles control access but not resource configurations.

Answer

Create a custom IAM role that grants compute.instances.create permission only for Shielded VM projects.

Answer

Use Deployment Manager templates that include Shielded VM initialization config.

Answer

Enable Shielded VM as a default in the Compute Engine service quota settings.

Question 2

A company has a Google Cloud organization with separate folders for development, staging, and production. They want to deploy Terraform using a CI/CD pipeline that runs in a shared tools project. Where should the Terraform state files be stored and how should the pipeline authenticate?

Accepted Answer

Store state in a central Cloud Storage bucket in the tools project; use a service account in the tools project with Workload Identity Federation to access the bucket and assume roles in environment projects.. Terraform state should be stored in a GCS bucket with versioning enabled. The pipeline should use a service account from the tools project with Workload Identity Federation to access the bucket. This avoids long-lived keys and follows security best practices.

Answer

Store state in Cloud Firestore; use a service account key stored in Secret Manager.

Answer

Store state in a Cloud Storage bucket in each environment project; use user credentials passed as secrets.

Answer

Store state locally in the CI/CD runner; use Application Default Credentials from the runner's environment.

Question 3

An organization wants to implement a landing zone with shared VPC, centralized logging, and security projects. Which folder structure best follows Google Cloud's recommended landing zone design?

Accepted Answer

Create a 'common' folder for shared projects (shared VPC, logging, security) and environment folders (dev, staging, prod) for workload projects.. Google's landing zone design recommends a folder per environment (prod, staging, dev) with common projects (shared VPC, logging, security) placed in a 'common' folder that sits at the same level as environment folders, allowing organization policies to be applied consistently.

Answer

Create a folder per product with subfolders for environments. Place shared projects under the product folder.

Answer

Create one folder per team with subfolders for each environment. Place shared projects under the corresponding environment folder.

Answer

Create a flat structure with all projects at the organization level.

Question 4

A team uses Terraform with remote state stored in a GCS bucket. They are implementing policy as code using Conftest to validate Terraform plans before apply. The Conftest checks run in a CI/CD pipeline. Which approach ensures that Conftest policies are enforced consistently across all Terraform workspaces?

Accepted Answer

Create a separate Git repository for Conftest policies. In the CI/CD pipeline, clone this repo and run conftest test against the Terraform plan.. Conftest uses Rego policies. To enforce consistently, the policies should be version-controlled in a separate repository and the CI/CD pipeline should fetch the latest policy bundle before running tests. Using a centralized policy repo ensures all workspaces are checked against the same rules.

Answer

Use Terraform Cloud's Sentinel policies instead of Conftest, as they are more integrated.

Answer

Embed Conftest policies directly into the Terraform modules using JSON files.

Answer

Store Conftest policies in each Terraform workspace's directory and reference them in the pipeline configuration.

Question 5

A DevOps engineer needs to ensure that no Compute Engine VM in the organization can have an external IP address, except for a specific set of approved projects. Which organization policy configuration should they use?

Accepted Answer

Set 'constraints/compute.vmExternalIpAccess' to 'Deny' at the organization level, then create a tag-based condition to allow external IPs for approved projects.. Organization policies support inheritance and conditions. Setting policy to 'Enforce' at the organization level with a condition to exclude approved projects (e.g., resource.matchTag:env/approved-external-ip) ensures only those projects can have external IPs.

Answer

Use 'constraints/compute.vmExternalIpAccess' with a condition that denies external IPs unless the project has a specific label.

Answer

Set the policy 'constraints/compute.vmExternalIpAccess' to 'Allowed' at the organization level and 'Denied' on each project except the approved ones.

Answer

Create a custom constraint to block external IPs and apply it to all projects except the approved ones.

Question 6

A company wants to enforce that all Cloud Run services must not be publicly accessible. They need a preventive control rather than a detective one. Which approach should they use?

Accepted Answer

Apply an organization policy with constraint 'constraints/run.allowedIngress' set to 'Internal and Cloud Load Balancing'.. Organization policies provide preventive controls. The 'constraints/run.allowedIngress' policy can be set to 'Internal' or 'Internal and Cloud Load Balancing' to prevent public access. IAM roles can be used to grant/revoke access but are not preventive for resource configuration.

Answer

Use Cloud Audit Logs to monitor for public Cloud Run services and alert the security team.

Answer

Create a custom IAM role that denies the run.services.create permission.

Answer

Configure VPC Service Controls to restrict Cloud Run access to within the VPC.

Question 7

An organization uses Terraform to manage infrastructure across multiple teams. They want to implement a branching strategy that supports rapid iteration and continuous integration for infrastructure changes while ensuring that the main branch always reflects the desired state. Which Git branching model is most aligned with GitOps principles for IaC?

Accepted Answer

Trunk-based development with short-lived feature branches and automated CI/CD pipelines that apply changes upon merge to main.. Trunk-based development with short-lived feature branches is recommended for GitOps. Developers branch off main, make changes, commit frequently, and merge back to main after automated testing. This keeps main deployable and reduces merge conflicts.

Answer

Feature branching with long-lived branches for each environment (dev, staging, prod).

Answer

Each team maintains its own fork and periodically submits pull requests to a central repository.

Answer

GitFlow with separate branches for develop, release, and hotfixes.

Question 8

A DevOps engineer needs to set up billing export to analyze costs by team and environment. They have organized projects with labels: team (e.g., 'platform', 'data') and environment (e.g., 'prod', 'dev'). Which billing export configuration should they use?

Accepted Answer

Set up BigQuery billing export in the billing account. The export includes labels, enabling cost analysis by team and environment.. Option C is correct because BigQuery billing export automatically includes resource labels in the exported tables, allowing direct SQL-based cost analysis by team and environment without custom scripting. This is the native, scalable, and recommended approach for multi-dimensional cost breakdowns in Google Cloud.

Answer

Use the Cloud Billing API to stream costs and store them in Firestore.

Answer

Export billing data to a Cloud Storage bucket and use a custom script to parse labels.

Answer

Configure budgets and alerts for each label combination.

Question 9

A team is migrating from Cloud Deployment Manager to Terraform. They need to manage state for multiple environments (dev, staging, prod) using a single Terraform configuration. Which Terraform feature should they use to achieve this?

Accepted Answer

Use Terraform workspaces, with each workspace mapping to an environment and storing state in the same GCS bucket with workspace-specific prefixes.. Terraform workspaces allow you to manage multiple distinct state files from a single configuration. By mapping each workspace to an environment (dev, staging, prod) and configuring a single GCS backend with workspace-specific prefixes (e.g., `prefix = "terraform/state"`), Terraform automatically stores each workspace's state in a separate path within the same bucket. This enables isolated state management without duplicating configuration code.

Answer

Use Terraform data sources to switch between environments.

Answer

Use Terraform modules with different variable files for each environment.

Answer

Create separate Terraform configurations in separate directories.

Question 10

An organization wants to implement privileged access management (PAM) for their Google Cloud environment. They need to grant temporary, just-in-time access to production projects for incident responders. Which GCP service should they use?

Accepted Answer

Use Cloud IAM Conditions to grant roles with a time constraint (e.g., request.time < timestamp).. Cloud IAM Conditions with Access Context Manager can be used to enforce time-based conditions on IAM roles. Additionally, using Cloud IAM's 'iam.roles.update' with time-based conditions or using the Cloud Asset Inventory for access approval are not standard. The best approach is to use Cloud IAM Conditions to grant roles that expire after a defined duration, combined with Access Approval for review.

Answer

Create custom roles that are only granted during incident response drills.

Answer

Use Cloud Audit Logs to monitor and revoke access after the incident.

Answer

Use VPC Service Controls to allow access only from specific IPs.

Question 11

A company wants to ensure that all new projects created in their Google Cloud organization automatically inherit a set of baseline IAM roles for the security team. Which approach should they use?

Accepted Answer

Grant the roles at the folder or organization level.. IAM roles can be granted at the folder or organization level, and they are inherited by all child projects. Granting roles at the organization level ensures every new project inherits them automatically.

Answer

Use Cloud Audit Logs to detect new projects and trigger a Cloud Function to add roles.

Answer

Grant the roles at the project level after each project is created.

Answer

Use a custom script that runs periodically to add roles.

Question 12

A DevOps team uses Terraform Cloud to manage infrastructure. They want to enforce that all Terraform plans must pass a set of policy checks before they can be applied. The policies include restricting resource types and ensuring proper tagging. Which Terraform Cloud feature should they use?

Accepted Answer

Use Terraform Cloud's Sentinel policies.. Sentinel is Terraform Cloud's policy-as-code framework. It allows writing policies (in Sentinel language) that are evaluated during the plan phase. Policies can enforce constraints on resources and tags.

Answer

Use Terraform Cloud's Cost Estimation feature.

Answer

Use Terraform Cloud's Run Triggers to chain workspaces.

Answer

Use Terraform Cloud's API to run custom scripts after plan.

Question 13

A company is designing a landing zone in Google Cloud. They need to set up a shared VPC for multiple projects. Which TWO steps should they take? (Choose two.)

Accepted Answer

Attach service projects to the host project using the Shared VPC admin.. Option B is correct because attaching service projects to a host project is the fundamental step in setting up a Shared VPC. This allows the service projects to consume resources (like VMs and GKE clusters) from the shared VPC network in the host project, enabling centralized network management and isolation.

Answer

Create a VPC network in each service project and peer them with the host project.

Answer

Configure VPC peering between the host project and each service project.

Answer

Grant the compute.networkUser role on the host project to users who need to create resources in the shared VPC.

Question 14

An organization uses Terraform with a GCS backend for state. They want to implement a GitOps workflow where changes merged to the main branch are automatically applied. The CI/CD pipeline uses a service account with Workload Identity Federation. Which THREE components are required? (Choose three.)

Accepted Answer

A service account with permissions to modify resources in the target projects.. GitOps requires a Git repository as the source of truth, a CI/CD pipeline that triggers on changes to main, and a service account with appropriate permissions to apply changes. Terraform Cloud is not required; the pipeline can run Terraform directly.

Answer

A Cloud Storage bucket with object versioning enabled for Terraform state.

Answer

A Terraform Cloud workspace configured with the same GCS backend.

Question 15

A team wants to enforce that all Compute Engine disks must be encrypted with Customer-Managed Encryption Keys (CMEK) stored in Cloud Key Management Service (KMS). Which TWO steps should they take? (Choose two.)

Accepted Answer

Apply an organization policy 'constraints/compute.requireCmek' at the desired level.. Option A is correct because the organization policy constraint 'constraints/compute.requireCmek' enforces that all new Compute Engine disks in the specified hierarchy must be encrypted with a Customer-Managed Encryption Key (CMEK) from Cloud KMS. This policy prevents the creation of unencrypted disks or disks encrypted with Google-managed keys, ensuring compliance with security requirements.

Answer

Use gcloud commands to encrypt all existing disks with the KMS key.

Answer

Enable the Cloud KMS API in each project where the policy is enforced.

Answer

Grant the cloudkms.cryptoKeyEncrypterDecrypter role to the Compute Engine service account.