PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 2 — 15 Questions

Question 1

A DevOps team is setting up a new Google Cloud organization. They want to enforce that all projects have a specific set of labels, and that Cloud Logging is enabled. They have written a custom Organization Policy constraint to enforce the labels. However, they are unsure how to enforce Cloud Logging. Which of the following approaches should they use?

Accepted Answer

Use the Organization Policy 'constraints/gcp.resourceAuditLogging' to enforce audit logs.. Option C is correct because the Organization Policy constraint `constraints/gcp.resourceAuditLogging` enforces that audit logs (which include Cloud Logging) are enabled for all projects in the organization. This policy ensures that logging cannot be disabled at the project level, meeting the requirement to enforce Cloud Logging across the organization.

Answer

Create a custom Organization Policy constraint that checks if Cloud Logging is enabled.

Answer

Disable the ability to turn off Cloud Logging by using the Organization Policy 'compute.disableCloudLogging'.

Answer

Set a project-level default for Cloud Logging using Organization Policies.

Question 2

During the bootstrapping of a Google Cloud organization, you need to create a shared CI/CD pipeline that can deploy resources to multiple projects. The pipeline must use a service account with minimal permissions. What is the recommended way to grant the pipeline service account permissions to deploy resources across projects?

Accepted Answer

Grant the service account the necessary roles on each target project individually.. Option C is correct because granting the service account the appropriate roles on each project is the standard method for cross-project deployments. Option A is wrong because organization-level roles would grant unnecessary broad permissions. Option B is wrong because Cloud Build service account is not needed. Option D is wrong because impersonation is not required; direct grants are simpler and more secure.

Answer

Configure the pipeline to impersonate a project-level service account in each project.

Answer

Grant the service account the Project Editor role at the organization level.

Answer

Use the Cloud Build service account and grant it permissions on each project.

Question 3

Your organization has multiple teams that need to deploy infrastructure using Terraform. You want to enforce that all Terraform state files are stored in a central Cloud Storage bucket with versioning enabled. You also need to ensure that only the CI/CD pipeline can write to the bucket. What is the best way to enforce this?

Accepted Answer

Use IAM conditions to restrict access to the bucket only when the requester is the CI/CD service account.. Option D is correct because IAM conditions allow you to bind a role to a principal (the CI/CD service account) and then restrict access based on attributes of the request, such as the requester's identity. By using a condition that checks `iam.googleapis.com/principal` equals the CI/CD service account email, you ensure that only that specific service account can write to the bucket, even if other principals have the role. This enforces the policy without relying on network constructs or overly broad role assignments.

Answer

Use VPC Service Controls to restrict access to the bucket from only the CI/CD pipeline's VPC.

Answer

Create a custom IAM role with permissions to write to the bucket and assign it to the CI/CD service account.

Answer

Grant the Storage Object Admin role to the CI/CD service account at the bucket level.

Question 4

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Option C is correct because hosting shared CI/CD tools and artifacts in a dedicated project follows the principle of resource isolation and centralized management. This approach simplifies access control, cost tracking, and lifecycle management for DevOps pipelines, as the project acts as a single source of truth for build outputs and deployment tools.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 5

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Accepted Answer

Enable audit logging and set up log sinks to a centralized logging project.. Option B is correct because audit logging is essential for security and compliance in a DevOps environment. By enabling audit logs and setting up log sinks to a centralized logging project, you ensure that all API calls and administrative actions across the organization are captured in a single, immutable location, which is critical for incident response and forensic analysis.

Answer

Use a single project for development, staging, and production to reduce overhead.

Answer

Store secrets directly in code repositories for easy access by CI/CD pipelines.

Question 6

Your organization is adopting DevOps practices and needs to bootstrap a Google Cloud organization with multiple projects. You want to enforce consistent resource naming conventions and apply common organization policies across all projects. Which two services should you use together to achieve this?

Accepted Answer

Service Accounts and IAM roles. Organization Policies allow you to centrally constrain actions across all projects in the hierarchy, while Resource Manager folders let you group projects and apply policies consistently. Together, they enable you to enforce naming conventions (e.g., via a custom constraint) and common policies (e.g., disabling external IPs) across multiple projects without manual per-project configuration.

Answer

Cloud Shell and Cloud Source Repositories

Answer

Cloud Deployment Manager and Cloud Audit Logs

Question 7

A company is bootstrapping a Google Cloud organization for DevOps. They have multiple teams that need to deploy infrastructure using a shared CI/CD pipeline. The security team requires that all deployments be reviewed and approved before production rollout. However, they also want to maintain a fast feedback loop for developers. What is the best way to balance these requirements?

Accepted Answer

Use Spinnaker on GKE with a manual judgment stage between test and production. Spinnaker on GKE provides a native manual judgment stage that can be inserted between test and production deployments, enabling mandatory approval gates without sacrificing the fast feedback loop for developers. This balances security requirements with DevOps velocity by allowing automated testing to proceed quickly while blocking production rollout until explicit approval is given.

Answer

Use Cloud Build with a manual approval step triggered via Cloud Pub/Sub

Answer

Use Cloud Run for production and Cloud Functions for testing, with IAM roles controlling access

Answer

Use Cloud Source Repositories with branch restrictions requiring code review

Question 8

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

Accepted Answer

Cloud Asset Inventory can be used to discover all resources in the organization.. Cloud Asset Inventory provides a complete view of all resources (e.g., Compute Engine instances, Cloud Storage buckets, IAM policies) across the entire organization, including all folders and projects. This is essential for DevOps bootstrapping to audit, monitor, and manage resources at scale. It uses the Cloud Asset API to export asset metadata and supports real-time feeds for change detection.

Answer

After enabling the cloudresourcemanager.googleapis.com API, organization policies are automatically applied.

Answer

All projects in an organization automatically share a default VPC network.

Answer

Cloud Audit Logs are disabled by default and must be enabled for each service.

Question 9

Your company is bootstrapping a Google Cloud organization for DevOps. The organization consists of three folders: Dev, Staging, and Prod. Each folder contains multiple projects for different microservices. You have been tasked with setting up a centralized CI/CD pipeline using Cloud Build and Cloud Deploy. The pipeline must deploy to multiple environments in sequence: Dev → Staging → Prod. Each environment requires approval from a different approver group. You have set up Cloud Deploy delivery pipelines with targets pointing to each environment. However, during testing, you notice that after a successful deployment to Dev, the pipeline automatically proceeds to Staging without waiting for approval. What is the most likely cause and solution?

Accepted Answer

Cause: The targets in Staging and Prod are missing the `require_approval` attribute set to `true`. Solution: Add `require_approval: true` to the Staging and Prod target definitions.. The correct answer is D because Cloud Deploy requires explicit `require_approval: true` on each target to enforce manual approval gates. Without this attribute, the pipeline treats the target as automatically approved and proceeds to the next target in the promotion sequence. The behavior described—automatic progression after Dev—indicates that Staging and Prod targets lack this flag, causing the pipeline to skip the approval step.

Answer

Cause: The delivery pipeline is defined with a single target instead of multiple targets. Solution: Create separate delivery pipelines for each environment.

Answer

Cause: The delivery pipeline has a single promotion sequence that includes all targets. Solution: Remove Staging and Prod from the pipeline and create separate pipelines.

Answer

Cause: The Cloud Deploy service account lacks the `clouddeploy.approver` role on Staging and Prod projects. Solution: Grant the role to the service account.

Question 10

A startup wants to implement infrastructure as code for their Google Cloud environment to ensure reproducibility. They are using Terraform and want to manage state securely. What is the recommended approach?

Accepted Answer

Store Terraform state in a Cloud Storage bucket with object versioning enabled.. Storing Terraform state in a Cloud Storage bucket with object versioning enabled is the recommended approach because it provides a centralized, remote backend that supports state locking (via Cloud Storage's object lease mechanism) and version history for rollback. This ensures consistency across team members and protects against state corruption or accidental deletion, aligning with infrastructure as code best practices for reproducibility.

Answer

Store Terraform state in a file in Cloud Shell home directory.

Answer

Store Terraform state in Cloud Source Repositories as a YAML file.

Answer

Store Terraform state locally on each developer's machine and use git to sync.

Question 11

An organization is setting up a new Google Cloud organization and wants to enforce consistent resource naming conventions and policies across all projects. Which service should they use?

Accepted Answer

Organization Policies. Organization Policies allow you to centrally constrain specific behaviors and enforce consistent naming conventions across all projects in a Google Cloud organization using constraints like `constraints/gcp.resourceLocations` or custom constraints via the `OrganizationPolicy` API. This service is the correct choice because it directly applies hierarchical policy enforcement at the organization, folder, or project level, ensuring resource naming and other governance rules are uniformly applied without requiring per-project configuration.

Answer

VPC Service Controls

Answer

Cloud Run

Answer

Cloud Armor

Question 12

A DevOps team wants to automate the deployment of a microservice application to Google Kubernetes Engine (GKE) using Cloud Build. They have a Cloud Build configuration file that builds a container image and deploys it to GKE. However, the deployment step fails with an authorization error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Kubernetes Engine Developer IAM role.. Cloud Build uses a default service account (the Cloud Build service account) to execute build steps, including deploying to GKE. The Kubernetes Engine Developer IAM role (roles/container.developer) grants the necessary permissions to deploy and manage workloads on GKE clusters. Without this role, the Cloud Build service account cannot authenticate to the GKE cluster's Kubernetes API, resulting in an authorization error during the deployment step.

Answer

The user triggering the build does not have IAM permissions to deploy to GKE.

Answer

Cloud Build does not have permission to access the source code repository.

Answer

The Docker image build step failed due to missing dependencies.

Question 13

Arrange the steps to set up a Google Cloud Monitoring alerting policy for a Compute Engine instance.

Question 14

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Question 15

Order the steps to set up a log-based metric in Cloud Logging for error tracking.