PCDE Bootstrapping a Google Cloud Organisation for DevOps Practice Test 5 — 15 Questions

Question 1

A company is setting up a new Google Cloud organization. The DevOps team wants to enforce that all Compute Engine instances are created only in us-central1 or europe-west1. Which approach should they use?

Accepted Answer

Create an organization policy with constraint `resourceLocations` and set allowed values to `us-central1` and `europe-west1`.. Option D is correct because the `resourceLocations` organization policy constraint is specifically designed to restrict the set of Google Cloud locations where resources can be created. By setting allowed values to `us-central1` and `europe-west1`, the DevOps team enforces that Compute Engine instances (and other supported resources) can only be provisioned in those regions. This policy is evaluated at resource creation time and applies across the entire organization, project, or folder hierarchy.

Answer

Set a IAM policy on the organization to allow Compute Engine instances only in those regions.

Answer

Configure a VPC Service Controls perimeter to restrict resource creation to allowed regions.

Answer

Use Cloud Deployment Manager to enforce regions via a template that validates location.

Question 2

A team manages Terraform state for multiple projects using a single GCS bucket. They need to ensure that state operations are not concurrent to avoid corruption. What should they do?

Accepted Answer

Configure the GCS backend with `prefix` per project and rely on Terraform's built-in state locking via GCS.. Option C is correct because Terraform's GCS backend natively supports state locking using the GCS object's generation number. By configuring a unique `prefix` per project, each project's state is stored in a separate object within the same bucket. Terraform automatically acquires a lock by creating a temporary lock file in GCS before any state operation, and releases it afterward, preventing concurrent modifications and state corruption.

Answer

Store state in a single file and use IAM to allow only one user at a time.

Answer

Use `terraform force_unlock` before each run.

Answer

Enable object versioning on the GCS bucket.

Question 3

An organization wants to use a GitOps workflow for infrastructure deployment with Terraform. They use GitHub as the source of truth and want to automatically apply Terraform changes when a pull request is merged to the main branch. They need to review Terraform plans before apply. Which solution meets these requirements?

Accepted Answer

Use Terraform Cloud with VCS integration: plan on pull request, apply on merge to main.. Terraform Cloud / Enterprise supports VCS-driven workflows with speculative plans on PRs and automatic applies on merges. Atlantis is a self-hosted option that also does plan on PR and apply on merge. Cloud Build would require custom scripting. Cloud Source Repositories is a Git host but lacks native plan/apply workflow.

Answer

Use Cloud Source Repositories and Cloud Functions to trigger Terraform on merge.

Answer

Use Terraform workspaces with remote state and manual apply after merging.

Answer

Configure Cloud Build triggers to run `terraform apply` on every push to main.

Question 4

A DevOps engineer needs to create a custom IAM role that allows only the permission to create Compute Engine instances, but not to modify or delete them. What is the best practice for defining this role?

Accepted Answer

Create a custom role with permission `compute.instances.create`.. Custom roles are created with a list of permissions. To allow creation only, the role should include the `instances.create` permission. It should not include `instances.update`, `instances.delete`, or wildcards.

Answer

Use the predefined role `roles/compute.instanceAdmin.v1` and remove permissions.

Answer

Create a custom role with permission `compute.instances.*`.

Answer

Use the predefined role `roles/compute.instanceAdmin` and restrict it with conditions.

Question 5

A company has multiple GCP projects and wants to audit all IAM policy changes. They need a solution that captures who made the change, what was changed, and when. The solution should be cost-effective and require minimal setup. What should they use?

Accepted Answer

Enable Cloud Audit Logs for Admin Activity for all projects.. Cloud Audit Logs for Admin Activity automatically captures all API calls that modify IAM policies, including the identity of the caller, the change made, and the timestamp. This is enabled by default for all GCP projects at no additional cost, making it the most cost-effective and minimal-setup solution for auditing IAM changes.

Answer

Enable Access Transparency logs.

Answer

Use Cloud Asset Inventory to export IAM policies daily.

Answer

Set up Stackdriver (now Cloud Monitoring) alerts on IAM changes.

Question 6

A team uses Terraform to manage infrastructure. They want to ensure that all Terraform code passes policy checks before being applied. They use Terraform Cloud. Which built-in feature allows them to define policies that are checked during the plan phase?

Accepted Answer

Sentinel. Sentinel is Terraform Cloud's built-in policy-as-code framework that allows teams to define and enforce policies during the plan phase. It integrates directly with Terraform Cloud's run lifecycle, enabling policy checks to be evaluated against the planned infrastructure changes before they are applied. This ensures compliance and governance without requiring external tools.

Answer

`terraform validate`

Answer

Conftest

Answer

OPA (Open Policy Agent)

Question 7

An organization wants to set up a landing zone with separate projects for development, staging, and production environments. They also need a shared VPC for networking and a centralized logging project. Which folder structure aligns with Google Cloud best practices?

Accepted Answer

Create folders: /environments/dev, /environments/staging, /environments/prod, and /common. Place networking and logging projects in /common.. Option C is correct because it follows Google Cloud best practices by separating environments (dev, staging, prod) into their own folder under an /environments parent, and placing shared resources like networking and logging into a /common folder. This structure enables consistent IAM policy inheritance, resource isolation, and centralized management of shared services, which is critical for a landing zone in a DevOps pipeline.

Answer

Create a single folder /landing-zone and put all projects there.

Answer

Create folders: /dev, /staging, /prod. Place all projects directly under the root.

Answer

Create folders: /prod, /non-prod, /shared. Put dev and staging in /non-prod.

Question 8

What is the purpose of a Google Cloud organization node in the resource hierarchy?

Accepted Answer

It is the root node in the GCP resource hierarchy for centralized policy and billing management.. The organization node is the root resource. It allows centralized management of policies, roles, and billing across all folders and projects. It is required for organization-level IAM and organization policies.

Answer

It is used to group billing accounts.

Answer

It is an alias for a project.

Answer

It represents a team within a company.

Question 9

A company wants to implement least-privilege IAM for their DevOps team. The team needs to manage Compute Engine instances and Cloud Storage buckets, but not delete resources. Which approach is recommended?

Accepted Answer

Grant predefined roles `roles/compute.instanceAdmin.v1` and `roles/storage.objectAdmin`.. Both Option A and Option B are correct approaches for implementing least-privilege IAM. Option A uses predefined roles `roles/compute.instanceAdmin.v1` and `roles/storage.objectAdmin`, which provide the necessary permissions to manage Compute Engine instances and Cloud Storage objects without granting delete permissions on the resources themselves (instances and buckets). Option B allows creating custom roles that explicitly exclude delete permissions, offering more granular control. Google recommends using predefined roles when they already meet the requirements, as they are maintained and reduce the risk of misconfiguration.

Answer

Use Cloud KMS to manage access.

Answer

Grant the primitive roles `roles/editor` and `roles/viewer`.

Question 10

A team uses Terraform with a GCS backend for state. They want to use remote state from another project to read output values. What Terraform configuration element is used to retrieve outputs from a different state file?

Accepted Answer

`data.terraform_remote_state`. The `data.terraform_remote_state` data source is the correct Terraform configuration element used to retrieve output values from a different state file stored in a remote backend, such as GCS. It reads the state data from the specified backend configuration and exposes the outputs via the `outputs` attribute, allowing cross-project or cross-workspace state access without requiring direct module dependencies.

Answer

`module.terraform_remote_state`

Answer

`output.terraform_remote_state`

Answer

`resource.terraform_remote_state`

Question 11

A company needs to control cost by setting a budget alert on their billing account. They want to be notified when spending exceeds 80% of the budget. What should they configure?

Accepted Answer

Create a budget in the GCP Billing console with alert threshold at 80%.. Option B is correct because Google Cloud's native budget alerts in the Billing console allow you to set a threshold (e.g., 80%) and automatically send email notifications when actual spending exceeds that percentage of the budget. This is the simplest, most direct, and recommended approach for cost control without needing additional services or custom code.

Answer

Export billing data to BigQuery and set up a scheduled query with a Cloud Function to send alerts.

Answer

Create a budget alert rule in Cloud Monitoring with a metric threshold.

Answer

Use Cloud Scheduler to run a script that checks billing API and sends email.

Question 12

Which Git branching strategy is recommended for infrastructure as code in a DevOps environment to enable continuous delivery?

Accepted Answer

Trunk-based development. Trunk-based development is recommended for IaC to avoid long-lived branches and merge conflicts. It involves short-lived feature branches and frequent merges to main. GitFlow is more complex and not ideal for IaC. GitHub Flow is similar but trunk-based is the standard.

Answer

Forking workflow

Answer

Feature branch workflow without merging to main often

Answer

GitFlow

Question 13

A company wants to enforce that all Compute Engine VMs have Shielded VM features enabled. Which mechanism should they use?

Accepted Answer

Set an organization policy with constraint `compute.requireShieldedVm`.. Organization policy `compute.requireShieldedVm` enforces that new VMs must have Shielded VM features. This is an organization policy constraint.

Answer

Configure a VPC firewall rule to block non-Shielded VMs.

Answer

Use Cloud Security Command Center to detect non-Shielded VMs.

Answer

Use IAM to restrict VM creation to users who have permissions to enable Shielded VM.

Question 14

A team is migrating to GCP and wants to use Cloud Deployment Manager for infrastructure. They have existing Terraform modules. What is the best approach?

Accepted Answer

Use Terraform with a GCS backend; avoid Deployment Manager.. Option D is correct because the team already has existing Terraform modules, and using Terraform with a GCS backend allows them to continue leveraging their investment in Terraform without rewriting or bridging tools. Cloud Deployment Manager is a native Google Cloud IaC tool, but it does not natively import or execute Terraform configurations; forcing a migration or hybrid approach introduces unnecessary complexity and risk. The best practice is to standardize on one IaC tool, and since Terraform is already in use, using it with a GCS backend for state management is the most efficient and reliable path.

Answer

Use Deployment Manager only for new resources and Terraform for existing.

Answer

Convert Terraform modules to Deployment Manager templates manually.

Answer

Run Terraform as a subprocess within Deployment Manager.

Question 15

An organization wants to restrict the creation of Cloud SQL instances outside of specific regions. Which organization policy constraint should they use?

Accepted Answer

`resourceLocations`. The `resourceLocations` constraint is the correct organization policy to restrict Cloud SQL instance creation to specific regions. This policy defines a list of allowed locations (e.g., `us-central1`, `europe-west1`) where all resources, including Cloud SQL instances, can be created. By setting this constraint at the organization, folder, or project level, any attempt to create a Cloud SQL instance outside the permitted regions will be denied.

Answer

`compute.requireShieldedVm`

Answer

`iam.disableServiceAccountKeyCreation`

Answer

`sql.restrictPublicIp`