PCDOE Bootstrapping a Google Cloud organization for DevOps — All Questions With Answers

Question 1

A company is setting up a new Google Cloud organization for DevOps. They want to enforce that all projects have a specific set of VPC Service Controls perimeters. Which approach should they use to ensure these perimeters are automatically applied to all new projects?

Accepted Answer

Define an organization policy with a constraint that requires all projects to be within a perimeter.. Option B is correct because Google Cloud Organization Policies allow you to define and enforce constraints at the organization, folder, or project level. The `constraints/compute.restrictVpcServiceControls` constraint can be set to require all new projects to be within a specific VPC Service Controls perimeter, ensuring automatic enforcement without manual intervention.

Answer

Configure Cloud Shell to run a script that creates a perimeter when a new project is created.

Answer

Use Deployment Manager to deploy a configuration that creates a perimeter for each new project.

Answer

Create a VPC Service Controls perimeter and add the organization node as a member.

Question 2

You are bootstrapping a Google Cloud organization for a DevOps team. You need to set up a shared VPC host project that will be used by multiple service projects. What is the minimal set of roles required for the DevOps team to create and manage service projects in the host project?

Accepted Answer

Compute Network Admin and Service Project Admin. Option B is correct because the minimal set of roles required for a DevOps team to create and manage service projects in a shared VPC host project is Compute Network Admin (roles/compute.networkAdmin) on the host project and Service Project Admin (roles/compute.xpnAdmin) at the organization or folder level. Compute Network Admin grants permissions to manage networking resources, while Service Project Admin allows attaching service projects to the host project. Without both, the team cannot configure shared VPC networking or associate service projects.

Answer

Project Creator and Service Project Admin

Answer

Compute Shared VPC Admin

Answer

Owner and Service Project Admin

Question 3

During the bootstrapping of a Google Cloud organization, the DevOps team wants to implement a policy that prevents the deletion of certain resources, such as Cloud Storage buckets or Cloud SQL instances, unless a specific approval process is followed. Which approach best achieves this goal?

Accepted Answer

Use Resource Manager locks on projects and set up a Cloud Function that triggers on audit logs to require approval before removing the lock.. Option C is correct because Resource Manager locks prevent accidental deletion of critical resources by placing a deletion prevention lock on the project or resource hierarchy. By combining this with a Cloud Function that monitors audit logs for lock removal attempts and requires an approval workflow before the lock is removed, the team enforces a controlled approval process for any deletion, meeting the policy requirement precisely.

Answer

Configure Cloud Source Repositories to require code review for any changes to Terraform configurations that delete resources.

Answer

Implement Binary Authorization to require approvals for any delete commands.

Answer

Use VPC Service Controls to block delete operations on specific services.

Question 4

A DevOps team is bootstrapping a new organization. They want to ensure that all projects created within the organization have a specific set of APIs enabled, such as Compute Engine, Cloud Storage, and Cloud Resource Manager. What is the most efficient way to achieve this?

Accepted Answer

Define an organization policy with a constraint that requires the APIs to be enabled.. Option B is correct because Organization Policies with constraints (like `constraints/compute.requireOsLogin` or custom constraints using the Resource Manager API) allow you to enforce API enablement across all projects in the organization. This is the most efficient approach as it is declarative, centrally managed, and automatically applies to new projects without any additional infrastructure or manual intervention.

Answer

Create a Cloud Function that triggers on project creation events and enables the required APIs.

Answer

Use Cloud Foundation Toolkit to deploy a project template that includes API enablement.

Answer

Create a shared VPC and enable the APIs in the host project only.

Question 5

You are bootstrapping a Google Cloud organization. You need to set up a hierarchical structure that allows you to apply policies to groups of projects based on their environment (e.g., development, staging, production). What is the recommended way to organize resources?

Accepted Answer

Create folders under the organization for each environment and place projects in the appropriate folder.. Option B is correct because Google Cloud's resource hierarchy (Organization -> Folders -> Projects) is specifically designed to group projects by environment and apply consistent policies (e.g., IAM, organization policies) at the folder level. By creating folders for development, staging, and production, you can enforce environment-specific controls (like VPC Service Controls or resource location restrictions) without duplicating policies per project.

Answer

Use resource tags to label projects by environment and apply policies via tag-based conditions.

Answer

Create separate organizations for each environment.

Answer

Use labels on projects to identify environments and then use Cloud Asset Inventory to enforce policies.

Question 6

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.. Option D is correct because workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.

Answer

Use a user account for the CI/CD pipeline and assign it the necessary roles.

Answer

Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.

Answer

Generate a single service account key and securely distribute it to the CI/CD system.

Question 7

During the bootstrapping of a Google Cloud organization, you need to ensure that all resources in a specific folder are subject to a particular VPC Service Controls perimeter. Which step is necessary to achieve this?

Accepted Answer

Add the projects within the folder as members of the existing service perimeter.. Option C is correct because VPC Service Controls perimeters are applied at the project level, not directly to folders. To enforce a perimeter on all resources within a folder, you must add each project in that folder as a member of the existing service perimeter. This ensures that all resources in those projects are subject to the perimeter's access restrictions.

Answer

Use resource tags to label the projects and then create a tag-based perimeter.

Answer

Apply the perimeter to the folder directly.

Answer

Create an organization policy that forces all projects in the folder to be in a perimeter.

Question 8

A DevOps team is setting up a Google Cloud organization. They want to centralize logging and monitoring across all projects. What is the recommended approach?

Accepted Answer

Create a dedicated project for logging and monitoring, and configure all other projects to send logs and metrics to that project.. Option B is correct because the recommended approach for centralizing logging and monitoring in a Google Cloud organization is to create a dedicated project that acts as a log sink and metric aggregator. By configuring aggregated sinks at the organization or folder level, all projects automatically forward logs to the dedicated project's Cloud Logging bucket, and metrics can be collected via the Monitoring API. This ensures a single pane of glass for operations without manual per-project setup.

Answer

Enable logging and monitoring in each project individually and use the Cloud Console to view them.

Answer

Enable Cloud Audit Logs in the organization and view them from the Organization level.

Answer

Use Stackdriver (now Operations) to aggregate logs from all projects automatically.

Question 9

Which TWO options are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose 2)

Accepted Answer

Use folders to separate environments (e.g., dev, staging, prod) and apply policies at the folder level.. Option D is correct because using folders to separate environments (e.g., dev, staging, prod) allows you to apply IAM policies and organization policies at the folder level, which are inherited by all projects within that folder. This enforces consistent security controls and resource governance across each environment, a key DevOps practice for managing lifecycle and access boundaries.

Answer

Grant the Owner role to a group of DevOps engineers to manage all projects.

Answer

Store service account keys in the source code repository for ease of use.

Answer

Create a single VPC network for all environments to simplify management.

Question 10

Which THREE actions should be taken to ensure compliance with the principle of least privilege when bootstrapping a Google Cloud organization? (Choose 3)

Accepted Answer

Use service accounts for automated processes and grant them the minimum required roles.. Option A is correct because service accounts are the recommended identity for automated processes in Google Cloud, and granting them only the minimum required roles directly implements the principle of least privilege. This prevents over-permissioning and reduces the attack surface for automated workflows.

Answer

Assign the Owner role at the organization level to a small group of administrators.

Answer

Use primitive roles (Owner, Editor, Viewer) to simplify management.

Question 11

Which TWO are benefits of using a shared VPC in a Google Cloud organization? (Choose 2)

Accepted Answer

Centralized management of network resources.. Option A is correct because a shared VPC allows network resources (subnets, routes, firewalls) to be defined in a host project and consumed by multiple service projects, enabling centralized management. This reduces administrative overhead by having a single network team control the VPC configuration rather than each project managing its own.

Answer

Eliminates the need for project administrators to have any IAM roles.

Answer

Ensures compliance with organizational policies.

Answer

Automatically enables required APIs in all service projects.

Question 12

Your organization is bootstrapping a new Google Cloud environment for a DevOps team. The team consists of 15 engineers who will be working on multiple microservices deployed across several projects. You have created a folder called 'devops' under the organization node. Within this folder, you plan to create three projects: 'devops-dev', 'devops-staging', and 'devops-prod'. You want to enforce that all resources in these projects are created in a specific region (us-central1) and that no external IP addresses can be assigned to Compute Engine instances. Additionally, you want to ensure that all service accounts used by the applications have minimal permissions. After setting up the organization policies, you notice that a developer was able to create a Compute Engine instance with an external IP in the 'devops-dev' project. You check the organization policy constraints and find that the constraint 'compute.vmExternalIpAccess' is set to 'Deny' at the organization level, but the developer bypassed it. What is the most likely reason?

Accepted Answer

The project 'devops-dev' has a policy that overrides the organization-level deny.. Option A is correct because organization policies can be overridden at a lower level in the resource hierarchy. Even though the constraint 'compute.vmExternalIpAccess' is set to 'Deny' at the organization level, a policy at the project level (or folder level) with a higher priority or a different binding can allow external IPs. In Google Cloud, organization policies are inherited by default, but a child policy can override the parent if it is explicitly set to 'Allow' or if the deny list is not enforced. The developer likely had a project-level policy that allowed external IPs, bypassing the organization-level deny.

Answer

The organization policy has not propagated to all projects yet.

Answer

The developer used the wrong constraint name; the correct constraint is 'compute.restrictExternalIp'.

Answer

The developer tagged the instance with a tag that exempts it from the organization policy.

Question 13

You are a DevOps engineer tasked with bootstrapping a Google Cloud organization for a company that develops a SaaS product. The company has three teams: Platform, Application, and Data. Each team needs to manage their own projects, but the network should be centrally managed. You decide to use a shared VPC. You create a host project 'shared-vpc-host' and attach three service projects: 'platform-service', 'app-service', and 'data-service'. You grant the Network Admin role to the Platform team for the host project. The Application team needs to deploy Compute Engine instances in their service project, but they should not be able to modify network resources. You grant them the Compute Instance Admin role at the service project level. However, the Application team reports that they cannot create instances because they don't have permission to use the subnets in the shared VPC. What is the most likely missing step?

Accepted Answer

Grant the Application team the Compute Network User role on the host project or the specific subnets.. The Application team needs the Compute Network User role (roles/compute.networkUser) on the host project or the specific subnets to use the shared VPC subnets. This role allows them to attach instances to existing subnets without granting permission to modify network resources. Granting it at the service project level (Option B) is insufficient because the subnet permissions are inherited from the host project in a shared VPC setup.

Answer

Grant the Application team the Compute Network Admin role on the host project.

Answer

Grant the Application team the Compute Network User role on the service project.

Answer

Grant the Application team the roles/compute.subnetUser on the subnet.

Question 14

Your organization requires that all new Google Cloud projects are automatically configured with a common set of VPC networks and subnets, and that these networks must be created before any resources are deployed. What is the best approach to enforce this requirement across the organization?

Accepted Answer

Use Organization Policies with a custom constraint to enforce that all projects must have a specific VPC network configuration.. Organization Policies with custom constraints allow you to enforce that all new projects automatically include specific VPC networks and subnets before any resources are deployed. This is the only approach that provides mandatory, organization-wide enforcement at the project creation level, ensuring compliance without relying on manual templates or post-creation configuration.

Answer

Create a Cloud Deployment Manager template and share it with all project owners.

Answer

Set up VPC Network Peering between all projects to enforce network connectivity.

Answer

Configure a shared VPC host project and attach all new service projects to it.

Question 15

An organization is bootstrapping its Google Cloud environment and needs to establish a secure CI/CD pipeline that deploys infrastructure using Terraform. The pipeline must run in a dedicated project, and Terraform state must be stored in a Cloud Storage bucket. What is the most secure way to grant the CI/CD service account the minimal permissions required to manage the state bucket?

Accepted Answer

Grant the service account the Storage Object Admin role on the specific Cloud Storage bucket.. Option D is correct because granting the Storage Object Admin role (roles/storage.objectAdmin) on the specific Cloud Storage bucket follows the principle of least privilege. This allows the CI/CD service account to manage objects (including Terraform state files) within that bucket without granting broader permissions to other buckets or project-level storage operations. The pipeline runs in a dedicated project, but the state bucket itself is the resource that needs access control, making a resource-level role assignment the most secure approach.

Answer

Grant the service account the Storage Object Admin role on the service account itself.

Answer

Grant the service account the Storage Object Admin role at the project level.

Answer

Grant the service account the Storage Admin role at the project level.

Question 16

A DevOps team is setting up a new Google Cloud organization. They want to enforce that all projects have a specific set of labels, and that Cloud Logging is enabled. They have written a custom Organization Policy constraint to enforce the labels. However, they are unsure how to enforce Cloud Logging. Which of the following approaches should they use?

Accepted Answer

Use the Organization Policy 'constraints/gcp.resourceAuditLogging' to enforce audit logs.. Option C is correct because the Organization Policy constraint `constraints/gcp.resourceAuditLogging` enforces that audit logs (which include Cloud Logging) are enabled for all projects in the organization. This policy ensures that logging cannot be disabled at the project level, meeting the requirement to enforce Cloud Logging across the organization.

Answer

Create a custom Organization Policy constraint that checks if Cloud Logging is enabled.

Answer

Disable the ability to turn off Cloud Logging by using the Organization Policy 'compute.disableCloudLogging'.

Answer

Set a project-level default for Cloud Logging using Organization Policies.

Question 17

During the bootstrapping of a Google Cloud organization, you need to create a shared CI/CD pipeline that can deploy resources to multiple projects. The pipeline must use a service account with minimal permissions. What is the recommended way to grant the pipeline service account permissions to deploy resources across projects?

Accepted Answer

Grant the service account the necessary roles on each target project individually.. Option C is correct because granting the service account the appropriate roles on each project is the standard method for cross-project deployments. Option A is wrong because organization-level roles would grant unnecessary broad permissions. Option B is wrong because Cloud Build service account is not needed. Option D is wrong because impersonation is not required; direct grants are simpler and more secure.

Answer

Configure the pipeline to impersonate a project-level service account in each project.

Answer

Grant the service account the Project Editor role at the organization level.

Answer

Use the Cloud Build service account and grant it permissions on each project.

Question 18

Your organization has multiple teams that need to deploy infrastructure using Terraform. You want to enforce that all Terraform state files are stored in a central Cloud Storage bucket with versioning enabled. You also need to ensure that only the CI/CD pipeline can write to the bucket. What is the best way to enforce this?

Accepted Answer

Use IAM conditions to restrict access to the bucket only when the requester is the CI/CD service account.. Option D is correct because IAM conditions allow you to bind a role to a principal (the CI/CD service account) and then restrict access based on attributes of the request, such as the requester's identity. By using a condition that checks `iam.googleapis.com/principal` equals the CI/CD service account email, you ensure that only that specific service account can write to the bucket, even if other principals have the role. This enforces the policy without relying on network constructs or overly broad role assignments.

Answer

Use VPC Service Controls to restrict access to the bucket from only the CI/CD pipeline's VPC.

Answer

Create a custom IAM role with permissions to write to the bucket and assign it to the CI/CD service account.

Answer

Grant the Storage Object Admin role to the CI/CD service account at the bucket level.

Question 19

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Option C is correct because hosting shared CI/CD tools and artifacts in a dedicated project follows the principle of resource isolation and centralized management. This approach simplifies access control, cost tracking, and lifecycle management for DevOps pipelines, as the project acts as a single source of truth for build outputs and deployment tools.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 20

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Accepted Answer

Enable audit logging and set up log sinks to a centralized logging project.. Option B is correct because audit logging is essential for security and compliance in a DevOps environment. By enabling audit logs and setting up log sinks to a centralized logging project, you ensure that all API calls and administrative actions across the organization are captured in a single, immutable location, which is critical for incident response and forensic analysis.

Answer

Use a single project for development, staging, and production to reduce overhead.

Answer

Store secrets directly in code repositories for easy access by CI/CD pipelines.

PCDOE Bootstrapping a Google Cloud organization for DevOps — All Questions With Answers

A company is setting up a new Google Cloud organization for DevOps. They want to enforce that all projects have a specific set of VPC Service Controls perimeters. Which approach should they use to ensure these perimeters are automatically applied to all new projects?

You are bootstrapping a Google Cloud organization for a DevOps team. You need to set up a shared VPC host project that will be used by multiple service projects. What is the minimal set of roles required for the DevOps team to create and manage service projects in the host project?

During the bootstrapping of a Google Cloud organization, the DevOps team wants to implement a policy that prevents the deletion of certain resources, such as Cloud Storage buckets or Cloud SQL instances, unless a specific approval process is followed. Which approach best achieves this goal?

A DevOps team is bootstrapping a new organization. They want to ensure that all projects created within the organization have a specific set of APIs enabled, such as Compute Engine, Cloud Storage, and Cloud Resource Manager. What is the most efficient way to achieve this?

You are bootstrapping a Google Cloud organization. You need to set up a hierarchical structure that allows you to apply policies to groups of projects based on their environment (e.g., development, staging, production). What is the recommended way to organize resources?

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

During the bootstrapping of a Google Cloud organization, you need to ensure that all resources in a specific folder are subject to a particular VPC Service Controls perimeter. Which step is necessary to achieve this?

A DevOps team is setting up a Google Cloud organization. They want to centralize logging and monitoring across all projects. What is the recommended approach?

Which TWO options are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose 2)

Which THREE actions should be taken to ensure compliance with the principle of least privilege when bootstrapping a Google Cloud organization? (Choose 3)

Which TWO are benefits of using a shared VPC in a Google Cloud organization? (Choose 2)

Your organization requires that all new Google Cloud projects are automatically configured with a common set of VPC networks and subnets, and that these networks must be created before any resources are deployed. What is the best approach to enforce this requirement across the organization?

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

A startup wants to implement infrastructure as code for their Google Cloud environment to ensure reproducibility. They are using Terraform and want to manage state securely. What is the recommended approach?

An organization is setting up a new Google Cloud organization and wants to enforce consistent resource naming conventions and policies across all projects. Which service should they use?

Arrange the steps to set up a Google Cloud Monitoring alerting policy for a Compute Engine instance.

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Order the steps to set up a log-based metric in Cloud Logging for error tracking.

Match each Google Cloud service to its primary purpose.

Match each Cloud Monitoring metric type to its description.

Match each Kubernetes resource to its role in a DevOps pipeline.

A DevOps team is bootstrapping a new Google Cloud organization. They want to grant a group of engineers the ability to create and manage projects within the organization, but not to modify organization policies or folders. Which IAM role should be assigned at the organization level?

A DevOps team is bootstrapping a Google Cloud organization. They have created a folder for a business unit and want to prevent users from moving projects out of that folder to other folders. Which organization policy constraint should they apply?

A DevOps team is setting up a CI/CD pipeline using Cloud Build. They want the Cloud Build service account to have permission to deploy to Cloud Run within a specific project. Which IAM role should be granted to the Cloud Build service account?

A company is bootstrapping their Google Cloud organization with multiple departments. Each department has several projects. They want to apply different IAM policies and organization policies per department. What is the recommended way to structure the resource hierarchy?

A DevOps team wants to ensure that all audit logs from projects across the organization are sent to a central project for analysis. Which approach should they use?

A DevOps team is bootstrapping CI/CD pipelines that need access to API keys stored in Secret Manager. The pipelines run on Cloud Build. What is the best practice for granting access to secrets?

A company uses a Shared VPC and wants to enforce a set of firewall rules across all projects in a folder. They want these rules to be immutable by project owners. Which approach should they use?

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

A company is bootstrapping a Google Cloud organization with multiple projects. They want to enable consistent security and compliance across all projects. Which two organization policies should they consider? (Choose TWO.)

Refer to the exhibit. The DevOps team is trying to create a new service account key. The operation fails with a permission error. What is the most likely cause?

Refer to the exhibit. The Cloud Build fails with a permission error. The Cloud Build service account has roles/cloudbuild.builds.builder and roles/cloudfunctions.developer on the project. What is the missing permission?

Exhibit

Exhibit

A company is setting up a new Google Cloud organization. They want to ensure that all projects inherit common IAM policies. What is the best practice?

A company uses Cloud Build for CI/CD. They want to allow Cloud Build to deploy to Cloud Run. What is the minimum IAM role to assign to the Cloud Build service account?

A company wants to enforce that all projects in the organization have a specific VPC Service Controls perimeter. What is the most efficient way to achieve this?

Which tool is recommended for managing the initial setup of a Google Cloud organization, including creating folders, projects, and IAM policies in an automated and repeatable manner?

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

A company is bootstrapping their organization using Terraform and wants to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which of the following is the best practice for securing the state file?

A DevOps engineer needs to assign IAM roles at the organization level. Which built-in role is specifically designed for managing IAM policies across the organization?

A company uses Cloud Build to deploy applications and wants to ensure that builds from forked repositories cannot access sensitive environment variables. What is the best practice?

A company wants to enforce that all service accounts are created with a specific naming convention (e.g., prefix 'sa-'). What is the most efficient way to enforce this?

Which TWO are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose two.)

Which THREE are valid methods to enforce resource location restrictions in a Google Cloud organization? (Choose three.)

Which THREE are required steps when setting up a CI/CD pipeline with Cloud Build for the first time? (Choose three.)

A startup is bootstrapping a Google Cloud organization for DevOps. They need to create a project for their CI/CD tooling and a separate project for logging and monitoring. What is the recommended way to structure the resource hierarchy?

A company is bootstrapping a Google Cloud organization for the first time. They want to set up Cloud Identity to manage users and groups. What is the correct order of steps?

Which TWO of the following are best practices when bootstrapping a Google Cloud organization for DevOps?

Which TWO of the following are required steps to set up a shared VPC for DevOps teams?

Which THREE of the following are valid considerations when using organization policies to enforce compliance in a DevOps environment?

A company is bootstrapping a new Google Cloud organization for DevOps. They want to separate development, staging, and production environments using folders. Which folder structure follows Google-recommended best practices?

A DevOps engineer is trying to create a service account key for a CI/CD pipeline, but receives the error: 'Constraint constraints/iam.disableServiceAccountKeyCreation violated'. What is the most likely cause and solution?

A large enterprise is designing a centralized DevOps platform across multiple business units. They want to use a shared CI/CD pipeline that deploys to projects in different folders. Which approach ensures secure, auditable deployments while minimizing IAM administration?

To securely manage secrets (e.g., API keys) used in Cloud Build pipelines, which service should be used?

A Cloud Build pipeline fails with 'Permission denied' when trying to pull a Docker image from Artifact Registry in the same project. The Cloud Build service account has the Artifact Registry Reader role. What additional configuration is likely missing?

When bootstrapping a new Google Cloud organization for DevOps, which set of initial IAM roles should be assigned to the DevOps team to enable them to create and manage projects, folders, and billing accounts?

Which Google Cloud service provides a fully managed, private Git repository that integrates with Cloud Build for continuous integration?

A DevOps engineer notices that a Cloud Build trigger is not firing when commits are pushed to a Cloud Source Repositories repository. The trigger is configured with an invert regex for the branch filter. What could be the issue?

An organization has a strict compliance requirement that all CI/CD pipelines must use customer-managed encryption keys (CMEK) for any artifacts stored in Cloud Storage. How can this be enforced at the organization level?

Which TWO Organization Policy constraints are commonly used to enhance security in a DevOps environment?

When bootstrapping a Google Cloud organization for DevOps, which THREE steps are essential to set up a secure CI/CD foundation using Cloud Build?

A Cloud Build pipeline that deploys a container to Cloud Run fails with the error: `Missing required permission run.routes.invoke`. The Cloud Build service account has the 'Cloud Run Invoker' role. Which TWO additional steps should be taken?

Refer to the exhibit. The output shows three folders created directly under the organization node. Which gcloud command was most likely executed to produce this output?

Refer to the exhibit. A Cloud Build pipeline using this configuration fails on the third step with a permission error. The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely missing permission?

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Exhibit

A company is setting up a new Google Cloud organization. They want to apply a consistent set of IAM roles to all projects within a specific department. What is the most efficient method to achieve this?

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

An organization has multiple projects under a common folder. They want to enforce that all projects use the same VPC network from a central host project. However, one project needs to use a different VPC due to compliance requirements. How can this be achieved?

A startup wants to implement Infrastructure as Code (IaC) using Terraform for their Google Cloud environment. They need to manage state files securely. What is the best practice?

A DevOps team is setting up a Google Cloud organization and wants to ensure that all billing alerts are centrally managed. What should they do?

An organization has a policy that all projects must have Cloud Logging enabled and logs must be retained for at least 365 days. What is the most efficient way to enforce this across all projects?

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Which THREE actions should be taken when bootstrapping a CI/CD pipeline on Google Cloud? (Select exactly 3)

Which TWO are valid methods to manage service account keys securely? (Select exactly 2)