PCDOE Practice Test 27 — 15 Questions

Question 1

A DevOps team is bootstrapping a new Google Cloud organization. They want to grant a group of engineers the ability to create and manage projects within the organization, but not to modify organization policies or folders. Which IAM role should be assigned at the organization level?

Accepted Answer

roles/resourcemanager.projectCreator. Option D, roles/resourcemanager.projectCreator, is correct because it grants the specific permission to create and manage projects within the organization without allowing modifications to organization policies or folders. This role includes permissions like resourcemanager.projects.create and resourcemanager.projects.update, but explicitly excludes permissions for organization-level policy management (e.g., resourcemanager.organizations.setIamPolicy) or folder administration (e.g., resourcemanager.folders.update).

Answer

roles/owner

Answer

roles/resourcemanager.folderAdmin

Answer

roles/editor

Question 2

A company is bootstrapping a Google Cloud organization. They have created a Shared VPC host project. They want to allow a service project's default compute service account to launch instances that use the Shared VPC's subnets. Which IAM role should be granted to that service account at the host project level?

Accepted Answer

roles/compute.networkUser. The correct answer is C because the `roles/compute.networkUser` role grants a service account the necessary permissions to use the subnets of a Shared VPC host project. Specifically, this role includes the `compute.subnetworks.use` permission, which allows the service account to launch instances in the host project's subnets without granting broader network management rights.

Answer

roles/compute.xpnAdmin

Answer

roles/compute.securityAdmin

Answer

roles/compute.networkAdmin

Question 3

Refer to the exhibit. The DevOps team is trying to create a new service account key. The operation fails with a permission error. What is the most likely cause?

Accepted Answer

The organization policy prevents uploading service account keys.. The correct answer is C because organization policies can explicitly restrict the creation of service account keys at the organization, folder, or project level. When a key upload fails with a permission error despite the user having the necessary IAM roles, the most likely cause is an organization policy constraint such as `iam.disableServiceAccountKeyUpload` that blocks the operation. This policy overrides any IAM permissions granted to the user.

Answer

The project-level IAM denies the action.

Answer

The service account is disabled.

Answer

The service account lacks the iam.serviceAccountKeys.create permission.

Question 4

Which TWO are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose two.)

Accepted Answer

Use separate service accounts for each environment.. Option A is correct because using separate service accounts for each environment enforces the principle of least privilege, ensuring that credentials used in development cannot accidentally or maliciously affect production resources. This isolation aligns with Google Cloud's IAM best practices, where each service account should have only the permissions necessary for its specific environment, reducing the blast radius of a compromised account.

Answer

Create a single service account for all environments to simplify permissions.

Answer

Disable audit logging to reduce costs.

Question 5

A company uses a Shared VPC and wants to enforce a set of firewall rules across all projects in a folder. They want these rules to be immutable by project owners. Which approach should they use?

Accepted Answer

Use hierarchical firewall policies at the folder level.. Hierarchical firewall policies allow you to enforce firewall rules at the folder level, which are inherited by all projects within that folder. These policies are immutable by project owners because they are managed at the folder level, not the project or VPC level, and cannot be overridden or deleted by lower-level roles unless explicitly granted permission.

Answer

Use network tags and service accounts to enforce rules.

Answer

Use organization policy constraints to prevent project owners from modifying firewall rules.

Answer

Create firewall rules at the VPC level and assign them to the folder.

Question 6

Which tool is recommended for managing the initial setup of a Google Cloud organization, including creating folders, projects, and IAM policies in an automated and repeatable manner?

Accepted Answer

Terraform. Terraform is the recommended tool for bootstrapping a Google Cloud organization because it is declarative, idempotent, and supports infrastructure-as-code (IaC) for creating folders, projects, and IAM policies in an automated and repeatable manner. Unlike Google Cloud's Deployment Manager, Terraform is cloud-agnostic and has a mature provider (hashicorp/google) that directly manages organization-level resources such as google_folder, google_project, and google_organization_iam_member. This aligns with DevOps best practices for version-controlled, reproducible infrastructure provisioning.

Answer

Deployment Manager

Answer

Cloud Console

Answer

gcloud command line

Question 7

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

Accepted Answer

Grant Cloud Build service account access to secrets via IAM.. A is correct because Cloud Build's service account must be granted IAM roles (e.g., roles/secretmanager.secretAccessor) on the Secret Manager secret to allow the pipeline to retrieve the secret value at build time. Without explicit IAM binding, the service account lacks permission to access the secret, causing the build to fail. This follows the principle of least privilege and ensures that only authorized identities can read secrets.

Answer

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Answer

Base64 encode secrets and store them in Cloud Build substitutions.

Question 8

A company uses Cloud Build for CI/CD. They want to allow Cloud Build to deploy to Cloud Run. What is the minimum IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs permission to create and manage Cloud Run resources, including deploying new revisions. The `roles/run.admin` role provides full control over Cloud Run services, which is the minimum required for deployment. The `roles/cloudbuild.builds.builder` role only allows building and managing Cloud Build triggers, not deploying to Cloud Run.

Answer

roles/cloudbuild.builds.builder

Answer

roles/editor

Answer

roles/run.invoker

Question 9

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the roles/run.admin role.. The Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) requires the roles/run.admin role to deploy to Cloud Run. This role grants permission to create, update, and manage Cloud Run services. Without it, the deployment step fails with a 'Permission denied' error, even though the build itself succeeds.

Answer

The Cloud Run service account lacks the roles/cloudbuild.builds.builder role.

Answer

The trigger is missing the required deployment configuration.

Answer

The cloudbuild.yaml file has an incorrect image tag.

Question 10

Which TWO of the following are best practices when bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Create separate projects for development, staging, and production environments.. Option B is correct because creating separate projects for development, staging, and production environments enforces resource isolation, simplifies IAM policy management, and aligns with Google Cloud's recommended multi-project architecture for DevOps. This approach allows you to apply distinct organization policies, budgets, and monitoring per environment, reducing the risk of accidental changes to production.

Answer

Use the default Compute Engine service account for all DevOps automation.

Answer

Create a service account in each project that needs it, rather than a central admin project.

Answer

Set organization policies only at the project level, not at the folder or organization level.

Question 11

A company is bootstrapping their organization using Terraform and wants to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which of the following is the best practice for securing the state file?

Accepted Answer

Use a bucket with a CMEK key and grant roles/storage.objectAdmin to the Terraform service account.. Option C is correct because using a CMEK (Customer-Managed Encryption Key) ensures the state file is encrypted at rest with a key controlled by the organization, and granting roles/storage.objectAdmin to the Terraform service account provides the necessary read, write, and delete permissions on objects. This combination meets the security requirements for a bootstrapping scenario where the state file contains sensitive infrastructure configuration and must be protected from unauthorized access while allowing Terraform to manage it.

Answer

Use a bucket with fine-grained access and grant roles/storage.objectCreator to the Terraform service account.

Answer

Use a bucket with object versioning and enable VPC Service Controls.

Answer

Use a bucket with uniform access and grant roles/storage.objectViewer to the Terraform service account.

Question 12

A DevOps engineer needs to assign IAM roles at the organization level. Which built-in role is specifically designed for managing IAM policies across the organization?

Accepted Answer

roles/iam.securityAdmin. The role `roles/iam.securityAdmin` is the built-in IAM role specifically designed for managing IAM policies across the organization. It grants permissions to get and set IAM policies at the organization, folder, and project levels, without granting other resource management permissions. This makes it the correct choice for a DevOps engineer who needs to assign IAM roles organization-wide.

Answer

roles/resourcemanager.organizationAdmin

Answer

roles/owner

Answer

roles/editor

Question 13

A company uses Cloud Build to deploy applications and wants to ensure that builds from forked repositories cannot access sensitive environment variables. What is the best practice?

Accepted Answer

Use Cloud Build's 'encrypted variables' and mark them as 'not available for pull requests from forks'.. Option B is correct because Cloud Build allows you to mark encrypted variables as 'not available for pull requests from forks', which prevents forked PRs from accessing sensitive environment variables. This is the most direct and secure method to protect secrets in CI/CD pipelines involving external contributions.

Answer

Disable builds from forks entirely.

Answer

Use Cloud Build's 'substitutions' instead of environment variables.

Answer

Use Cloud Build's 'secrets' manager instead of environment variables.

Question 14

Which Google Cloud service provides a fully managed, private Git repository that integrates with Cloud Build for continuous integration?

Accepted Answer

Cloud Source Repositories. Cloud Source Repositories is the correct answer because it provides fully managed, private Git repositories hosted on Google Cloud. It integrates natively with Cloud Build, enabling automatic triggers for continuous integration (CI) pipelines whenever code is pushed to a repository branch or tag, without requiring external Git hosting.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Container Registry

Question 15

During bootstrapping, a DevOps engineer wants to ensure that all new projects automatically have a set of APIs enabled, such as Cloud Resource Manager API and Cloud Billing API. They also want to enforce that certain APIs cannot be disabled accidentally. What is the most efficient way to achieve this?

Accepted Answer

Use organization policies to define the constraints 'compute.requireOsLogin' and 'serviceuser.services' to restrict/enable APIs.. Option C is correct because organization policies in Google Cloud allow you to enforce constraints at the organization, folder, or project level. The `serviceuser.services` constraint can be used to specify a list of APIs that must be enabled (or cannot be disabled) on all projects under the policy scope, ensuring compliance without manual intervention or additional infrastructure.

Answer

Use a custom Cloud Function that runs every time a project is created and enables the APIs.

Answer

Grant the roles/serviceusage.serviceUsageAdmin role to the DevOps team and have them manually enable APIs when creating projects.

Answer

Create a folder with a 'Required APIs' setting that applies to all child projects.