PCDOE Practice Test 29 — 15 Questions

Question 1

An organization has multiple projects under a common folder. They want to enforce that all projects use the same VPC network from a central host project. However, one project needs to use a different VPC due to compliance requirements. How can this be achieved?

Accepted Answer

Set an organization policy to enforce shared VPC and create an exception for the specific project using the policy condition.. Option A is correct because Google Cloud Organization Policies can enforce constraints like `compute.restrictSharedVpcHostProjects` to mandate shared VPC usage across projects. You can use policy conditions (e.g., `resource.matchTag`) to create an exception for a specific project that needs its own VPC, allowing it to bypass the constraint while all other projects remain bound to the central host project.

Answer

Use VPC Network Peering to connect the project to the host project.

Answer

Create a separate folder for the exception project and apply a different organizational policy.

Answer

Grant the project the necessary permissions to use its own VPC.

Question 2

An organization has a strict compliance requirement that all CI/CD pipelines must use customer-managed encryption keys (CMEK) for any artifacts stored in Cloud Storage. How can this be enforced at the organization level?

Accepted Answer

Create an Organization Policy with constraint `constraints/gcp.storageRequireCmeK`.. Option B is correct because the Organization Policy constraint `constraints/gcp.storageRequireCmeK` is specifically designed to enforce that all new Cloud Storage buckets must be created with a customer-managed encryption key (CMEK). This policy is applied at the organization, folder, or project level and prevents the creation of buckets that do not use CMEK, thereby meeting the compliance requirement at the organizational level.

Answer

Use IAM conditions on storage buckets to require CMEK.

Answer

Use Cloud Asset Inventory to scan for non-compliant buckets.

Answer

Configure Cloud Audit Logs to monitor and alert on non-CMEK usage.

Question 3

Refer to the exhibit. A Cloud Build pipeline using this configuration fails on the third step with a permission error. The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely missing permission?

Accepted Answer

iam.serviceAccounts.actAs on the Cloud Run runtime service account. The Cloud Build pipeline fails on the third step with a permission error because the Cloud Build service account, despite having the 'Cloud Run Admin' role, lacks the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account. This permission is required for Cloud Build to impersonate the runtime service account when deploying to Cloud Run, as the deployment step needs to act on behalf of that service account to create or update the service.

Answer

run.routes.invoke

Answer

storage.objects.list on the artifact bucket

Answer

resourcemanager.projects.get

Question 4

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Accepted Answer

secretmanager.versions.access. The custom role assigned to the Cloud Build service account lacks the `secretmanager.versions.access` permission, which is required to access the payload of a secret version in Secret Manager. Without this permission, any attempt to read the secret value during a build step will fail with a permission denied error, even if the service account has other roles on the project.

Answer

cloudbuild.builds.update

Answer

run.services.get

Answer

iam.serviceAccounts.actAs

Question 5

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

Accepted Answer

Use Cloud Build triggers with regular expressions on branch patterns and restrict access via IAM.. Option D is correct because Cloud Build triggers natively support regular expressions on branch patterns, and IAM conditions can restrict which service accounts are allowed to invoke specific triggers. This provides a declarative, auditable, and least-privilege approach without custom code or external services.

Answer

Use Cloud Functions to validate branch names before triggering builds.

Answer

Use Cloud Source Repositories with branch protection rules.

Answer

Store the service account keys in Secret Manager and use them in build steps.

Question 6

Your company has recently migrated to Google Cloud and has set up an organization with three folders: Development, Staging, and Production. Each folder contains multiple projects. The DevOps team has established a centralized CI/CD pipeline using Cloud Build and Artifact Registry in a tools project under the Development folder. They want to ensure that only images built by the CI/CD pipeline are allowed to be deployed to the Production environment. They have configured Binary Authorization with a policy that requires attestations from the Cloud Build service account. However, a developer accidentally pushes a container image directly from their local machine to Artifact Registry using their personal IAM permissions, and then deploys that image to a Production project by bypassing the CI/CD pipeline. How can you prevent this from happening in the future?

Accepted Answer

Remove the Artifact Registry Writer role from all developers and only grant it to the Cloud Build service account.. Option B is correct because the root cause of the bypass is that developers have the Artifact Registry Writer (roles/artifactregistry.writer) IAM role, which allows them to push images directly. By removing this role from all developers and granting it exclusively to the Cloud Build service account, you enforce that only the CI/CD pipeline can write to the registry. Binary Authorization then requires attestations from that same service account, ensuring that only pipeline-built images can be deployed to Production.

Answer

Enable Cloud Audit Logs for Artifact Registry and set up alerts to detect unauthorized pushes.

Answer

Create a VPC Service Controls perimeter around Artifact Registry to restrict access.

Answer

Configure a Cloud Function to automatically delete images pushed outside of Cloud Build.

Question 7

A DevOps team is setting up a Google Cloud organization and wants to ensure that all billing alerts are centrally managed. What should they do?

Accepted Answer

Set up billing alerts at the organization level using Cloud Billing.. Setting up billing alerts at the organization level using Cloud Billing (Option D) is correct because it allows centralized management of billing thresholds, notifications, and budget policies across all projects within the organization. This approach leverages the Cloud Billing budget feature, which can be configured at the billing account level to send alerts to Pub/Sub topics or email recipients, ensuring consistent oversight without per-project configuration.

Answer

Use Cloud Monitoring to create custom metrics for billing.

Answer

Set up billing alerts individually for each project.

Answer

Create a project dedicated to billing and manage alerts there.

Question 8

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. A shared VPC allows multiple projects to share a common VPC network, enabling centralized control of networking resources, firewall rules, and IP addressing. This is a best practice for multi-team organizations because it reduces administrative overhead, ensures consistent network policies, and simplifies connectivity between projects without requiring complex peering or VPN setups.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 9

You are a DevOps engineer for a startup bootstrapping their Google Cloud organization. They have a single project for all environments (dev, test, prod) and a flat resource hierarchy. Recently, a developer accidentally deleted a production Cloud Storage bucket, causing data loss. The team wants to prevent this in the future with minimal disruption. They also want to enforce that all new projects follow a naming convention like 'company-environment-xxx'. The CTO wants a solution using native Google Cloud services without third-party tools. What should you do?

Accepted Answer

Create folders for each environment, move existing resources into folders, and apply an organization policy to enforce the naming convention on project creation.. Option D is correct because creating folders for each environment (dev, test, prod) and moving existing resources into them establishes a hierarchical resource structure that allows organization policies to be applied at the folder level. The organization policy constraint `constraints/resourcemanager.allowedProjectCreation` can enforce the naming convention on project creation, and IAM roles can be scoped to folders to restrict bucket deletion (e.g., using `roles/storage.objectAdmin` instead of `roles/storage.admin`). This solution uses native Google Cloud services (Resource Manager, Organization Policies, IAM) with minimal disruption by not requiring code changes or third-party tools.

Answer

Implement a Cloud Function that renames projects not following the convention and deletes buckets not in a folder.

Answer

Grant all users the Project Creator role but restrict bucket deletion with IAM.

Answer

Use Google Cloud Deployment Manager to create projects with predefined templates.

Question 10

A team is bootstrapping a new Google Cloud organization. Which TWO practices are recommended for managing project creation and resource hierarchy? (Choose two.)

Accepted Answer

Create a folder for each department to isolate resources.. Option B is correct because creating a folder for each department allows you to isolate resources, apply IAM policies at the folder level, and enforce organizational boundaries. This follows Google Cloud's recommended resource hierarchy best practices for multi-team environments, enabling delegated administration and cost tracking per department.

Answer

Use a centralized service account to create projects via API.

Answer

Use a single project for all development environments.

Answer

Assign project creator role to all users by default.

Question 11

Which THREE actions should be taken when bootstrapping a CI/CD pipeline on Google Cloud? (Select exactly 3)

Accepted Answer

Use Cloud Build with a Dockerfile.. Option B is correct because Cloud Build can use a Dockerfile to build a container image from source code, which is a fundamental step in bootstrapping a CI/CD pipeline. This allows automated builds triggered by code changes, enabling continuous integration and delivery to services like Cloud Run or GKE.

Answer

Store secrets in Cloud Source Repositories.

Answer

Enable the Cloud Run API.

Question 12

A company uses Cloud Build and wants to trigger builds only from the master branch. Which configuration is required?

Accepted Answer

Set the branch filter to 'master' in the trigger.. Option B is correct because Cloud Build triggers allow you to specify a branch filter using a regex pattern. Setting the filter to 'master' ensures that only pushes or pull requests targeting the master branch initiate the build. This is the native, supported method for branch-based triggering without additional overhead.

Answer

Create separate triggers for each branch.

Answer

Use a custom Cloud Build step to check the branch name.

Answer

Use a Cloud Function to call Cloud Build for master only.

Question 13

Refer to the exhibit. A DevOps engineer applies this Terraform configuration but gets an error: "Error creating Project: googleapi: Error 403: The caller does not have permission to enable services". What is the most likely cause?

Accepted Answer

The service account used by Terraform lacks the Service Usage Admin role on the project.. The error 'The caller does not have permission to enable services' indicates that the identity (service account) used by Terraform to authenticate with the Google Cloud API lacks the required IAM permission to enable Google APIs on the project. The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) grants the necessary permissions, including serviceusage.services.enable and serviceusage.services.list, which are required to enable services like the Compute Engine API during resource creation. Without this role, the API call to enable services fails with a 403 error.

Answer

The org_id is incorrect.

Answer

The organization requires that the Compute Engine API be enabled before project creation.

Answer

The project ID already exists.

Question 14

A company wants to ensure that all projects in the organization have Cloud Resource Manager API enabled. What is the most efficient method?

Accepted Answer

Set an organization policy to require the API.. Option D is correct because organization policies allow you to enforce constraints across all projects in the organization, ensuring the Cloud Resource Manager API is enabled automatically and cannot be disabled. This is the most efficient method as it requires no manual intervention or scripting, and it leverages the native Google Cloud policy framework to enforce compliance at scale.

Answer

Use a Cloud Scheduler job to enable the API in new projects.

Answer

Enable the API manually in each project.

Answer

Use a Terraform script that iterates over all projects.

Question 15

A company is bootstrapping a new Google Cloud organization. They want to ensure that all projects are created under specific folders and that certain IAM roles are automatically granted to a group for new projects. What is the most efficient approach?

Accepted Answer

Use a Cloud Function triggered by project creation events to apply IAM roles.. Option C is correct because it leverages a Cloud Function that listens to the `google.cloud.resourcemanager.project.v1.created` event via Eventarc, enabling automated, event-driven application of IAM roles to new projects without manual intervention or polling. This approach is the most efficient for bootstrapping because it ensures that every newly created project automatically inherits the required IAM bindings, regardless of how the project was created (e.g., via Console, gcloud, or API).

Answer

Use folder-level IAM roles to grant permissions to projects.

Answer

Use Terraform to create projects and assign IAM roles.

Answer

Use organization policies to restrict project creation to specific folders.