PCDE Bootstrapping a Google Cloud Organisation for DevOps Practice Test 4 — 15 Questions

Question 1

An organization wants to enforce that all Compute Engine instances are created in a specific set of regions. Which Google Cloud feature should be used?

Accepted Answer

Organization policies. Organization policies allow you to set constraints on resources, such as the allowed locations for resource creation. The constraint `gcp.resourceLocations` restricts the regions where resources can be created.

Answer

VPC Service Controls

Answer

IAM conditions

Answer

Firewall rules

Question 2

A DevOps team uses Terraform to manage infrastructure. They want to store state files in a shared backend that supports locking and versioning. Which backend meets these requirements?

Accepted Answer

Google Cloud Storage (GCS) backend. The Google Cloud Storage (GCS) backend is correct because it natively supports state file locking via object write consistency and versioning through object versioning, which are essential for preventing concurrent state corruption and enabling state rollback. Terraform's GCS backend uses a write-lock mechanism that relies on GCS's strong consistency for object creation, ensuring only one operation can modify the state at a time.

Answer

Consul backend

Answer

Local backend

Answer

Terraform Cloud backend

Question 3

A company wants to centralize audit logs and billing data from multiple projects in a single project for analysis. What is the best approach?

Accepted Answer

Create a dedicated logging project, set up aggregated log sinks from all projects to that project, and export billing data to BigQuery in the same project. Using a separate project for logging centralization with aggregated sinks to export logs and billing export to BigQuery in that project is the recommended landing zone design pattern.

Answer

Use Cloud Monitoring to view logs from all projects in one dashboard

Answer

Create a shared VPC project and enable VPC flow logs

Answer

Enable billing export to BigQuery in each project and query across projects

Question 4

A team uses Terraform with a GCS backend. After a failed apply, the state file is corrupted. How can they recover to the last known good state?

Accepted Answer

Restore a previous version of the state file from GCS object versioning. With versioning enabled on the GCS bucket, each state file version is preserved. You can restore a previous version by copying it over the current state file.

Answer

Use 'terraform force-unlock' to release the lock and then 'terraform apply' again

Answer

Run 'terraform state rm' to remove corrupted resources and re-import

Answer

Manually edit the state file in GCS using the JSON editor

Question 5

An organization wants to enforce that no Compute Engine VM has an external IP address. Which approach should be used?

Accepted Answer

Use an organization policy with constraint `compute.vmExternalIpAccess`. Option A is correct because the organization policy constraint `compute.vmExternalIpAccess` is specifically designed to prevent Compute Engine VMs from being assigned external IP addresses. This policy can be applied at the organization, folder, or project level to enforce that no VM in the scope can have an external IP, regardless of how the VM is created. It directly addresses the requirement without affecting other resources or relying on indirect controls.

Answer

Set IAM roles to deny `compute.instances.create` on all projects

Answer

Configure a firewall rule to block all traffic to 0.0.0.0/0

Answer

Use Shared VPC and only allow internal IPs

Question 6

A DevOps engineer wants to manage Google Cloud resources as code using a declarative language. Which tool is the current industry standard and recommended by Google?

Accepted Answer

Terraform. Terraform is the current industry standard for Infrastructure as Code (IaC) and is recommended by Google for managing Google Cloud resources declaratively. It uses the HashiCorp Configuration Language (HCL) to define cloud resources, supports state management for tracking resource changes, and provides a consistent workflow across multiple cloud providers. Google’s own documentation and professional certification materials explicitly endorse Terraform as the primary IaC tool for GCP.

Answer

Cloud Deployment Manager

Answer

Pulumi

Answer

Ansible

Question 7

A team wants to implement GitOps for their Terraform infrastructure. They want to automatically apply changes when a pull request is merged to the main branch. Which approach should they use?

Accepted Answer

Use Cloud Build with a trigger on push to main branch to run `terraform apply`. GitOps involves using a tool like Cloud Build with a trigger that runs Terraform on merge to main. Cloud Build can execute Terraform commands and apply changes.

Answer

Use Cloud Source Repositories with a webhook to a Compute Engine instance that runs Terraform

Answer

Set up a cron job that runs `terraform apply` every hour

Answer

Use Terraform Cloud with VCS integration

Question 8

An organization wants to implement least-privilege IAM for their DevOps team. They need permissions to manage Compute Engine instances but not to create or delete them. Which IAM role should be assigned?

Accepted Answer

roles/compute.instanceAdmin.v1. The role roles/compute.instanceAdmin.v1 provides permissions to manage Compute Engine instances, including starting, stopping, and modifying them, but explicitly excludes the ability to create or delete instances. This aligns with the least-privilege requirement for the DevOps team, as they need operational control without lifecycle management rights.

Answer

roles/compute.networkAdmin

Answer

roles/compute.admin

Answer

roles/compute.viewer

Question 9

A company has multiple teams in a GCP organization. They want to isolate environments (prod, staging, dev) and give each team a separate project for development. Which folder structure is recommended?

Accepted Answer

Create folders for each environment (prod, staging, dev), and within each, folders for teams/products containing projects. Option C is correct because it aligns with Google Cloud's recommended resource hierarchy for multi-team, multi-environment isolation. By creating folders for each environment (prod, staging, dev) and then sub-folders for teams/products, you can apply consistent IAM policies and organization policies at the environment level (e.g., restrict prod access) while delegating project-level control to teams. This structure also supports the principle of least privilege and simplifies auditing.

Answer

Create a flat list of projects with naming conventions like `team-project-env`

Answer

Create a single folder per team, with projects for each environment inside

Answer

Create folders per product, and within each, environment folders

Question 10

An organization wants to enforce that all Cloud Run services are not publicly accessible. Which organization policy should they use?

Accepted Answer

`run.allowedIngress`. The `run.allowedIngress` organization policy constraint is specifically designed to control ingress settings for Cloud Run services, allowing administrators to enforce that all services restrict traffic to internal sources only (e.g., `internal` or `internal-and-cloud-load-balancing`). This directly prevents public accessibility by blocking external HTTP/S requests at the platform level, overriding any per-service configuration.

Answer

`compute.vmExternalIpAccess`

Answer

`iam.allowedPolicyMemberDomains`

Answer

`cloudrun.allowedIngress`

Question 11

A DevOps engineer is using Terraform and wants to reference outputs from another Terraform configuration that manages networking. Which approach should they use?

Accepted Answer

Use `terraform_remote_state` data source pointing to the networking project's GCS state. The `terraform_remote_state` data source is the correct approach because it allows one Terraform configuration to securely read the latest state outputs (e.g., VPC IDs, subnet CIDRs) from another configuration's state file stored in a remote backend like Google Cloud Storage (GCS). This avoids hardcoding or manual copying of values, ensures consistency, and supports dependency management across configurations. By pointing to the networking project's GCS state, the DevOps engineer can dynamically reference outputs like `networking.vpc_id` without exposing sensitive data in environment variables or variable files.

Answer

Use Cloud Shell environment variables

Answer

Use Terraform Cloud's variable sets

Answer

Hardcode the networking values in variables

Question 12

An organization wants to track cloud costs per team and per project. They have already enabled billing export to BigQuery. What additional step should they take to enable cost attribution?

Accepted Answer

Apply labels to resources (team, environment) and query BigQuery billing export. Labels are key-value pairs attached to resources. By applying labels like `team` and `environment`, billing data in BigQuery can be queried to attribute costs.

Answer

Create separate billing accounts per team

Answer

Use resource hierarchy folders to track costs

Answer

Enable VPC flow logs for cost tracking

Question 13

A DevOps team is designing a landing zone on GCP. They want to centralize networking, logging, and security. Which TWO projects should they create? (Choose 2)

Accepted Answer

A central Logging project. In a GCP landing zone, centralizing logging into a dedicated project ensures that audit logs, VPC flow logs, and other operational logs are aggregated in a single, secure location. This project is used to configure log sinks, export logs to BigQuery or Cloud Storage, and enforce retention policies across the organization, which is a best practice for compliance and troubleshooting.

Answer

A project for IAM roles

Answer

A project for each environment

Answer

A separate project per application

Question 14

An organization wants to enforce policy as code for Terraform configurations. Which TWO tools can be used to validate Terraform plans against custom policies before apply? (Choose 2)

Accepted Answer

Open Policy Agent (OPA) with Conftest. Sentinel is a policy-as-code framework for Terraform Enterprise/Cloud, and OPA (Open Policy Agent) with Conftest can be used to evaluate policies against Terraform plans or HCL files. Both can be integrated into CI/CD.

Answer

Cloud Build

Answer

Cloud Audit Logs

Answer

gcloud CLI

Question 15

A company wants to implement security controls for Compute Engine VMs across their organization. Which THREE organization policies can enforce VM security? (Choose 3)

Accepted Answer

`compute.requireShieldedVm`. These three policies enforce VM security: external IP restriction, shielded VM requirement, and trusted image projects.

Answer

`storage.uniformBucketLevelAccess`

Answer

`iam.disableServiceAccountKeyCreation`