PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 2 — 15 Questions

Question 1

An organization is bootstrapping its Google Cloud environment and needs to establish a secure CI/CD pipeline that deploys infrastructure using Terraform. The pipeline must run in a dedicated project, and Terraform state must be stored in a Cloud Storage bucket. What is the most secure way to grant the CI/CD service account the minimal permissions required to manage the state bucket?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the service account the Storage Object Admin role on the specific Cloud Storage bucket.. Granting the Storage Object Admin role (roles/storage.objectAdmin) on the specific Cloud Storage bucket follows the principle of least privilege. This allows the CI/CD service account to manage objects (including Terraform state files) within that bucket without granting broader permissions to other buckets or project-level storage operations. The pipeline runs in a dedicated project, but the state bucket itself is the resource that needs access control, making a resource-level role assignment the most secure approach.

Answer

Grant the service account the Storage Object Admin role on the service account itself.

Answer

Grant the service account the Storage Object Admin role at the project level.

Answer

Grant the service account the Storage Admin role at the project level.

Question 2

A DevOps team is setting up a new Google Cloud organization. They want to enforce that all projects have a specific set of labels, and that Cloud Logging is enabled. They have written a custom Organization Policy constraint to enforce the labels. However, they are unsure how to enforce Cloud Logging. Which of the following approaches should they use?

Accepted Answer

Create a custom Organization Policy constraint that checks if Cloud Logging is enabled.. There is no built-in Organization Policy constraint that enforces Cloud Logging for all projects. The constraint `constraints/gcp.resourceAuditLoggingExemption` only prevents exemptions from audit logging, not all Cloud Logging. Therefore, the team must create a custom Organization Policy constraint to check whether Cloud Logging is enabled, as this is the only way to meet their requirement using Organization Policies.

Answer

Disable the ability to turn off Cloud Logging by using the Organization Policy 'compute.disableCloudLogging'.

Answer

Use the built-in Organization Policy constraint 'constraints/gcp.resourceAuditLoggingExemption' to enforce audit logging.

Answer

Set a project-level default for Cloud Logging using Organization Policies.

Question 3

During the bootstrapping of a Google Cloud organization, you need to create a shared CI/CD pipeline that can deploy resources to multiple projects. The pipeline must use a service account with minimal permissions. What is the recommended way to grant the pipeline service account permissions to deploy resources across projects?

Accepted Answer

Grant the service account the necessary roles on each target project individually.. Granting the service account the necessary roles (e.g., roles/container.developer, roles/storage.admin) on each target project directly provides the least-privilege access needed for cross-project deployments. Option A is incorrect because impersonation adds unnecessary complexity and does not inherently reduce permissions. Option C is incorrect because the Project Editor role at the organization level grants broad permissions across all projects, violating the principle of minimal permissions. Option D is incorrect because the Cloud Build service account is designed for Cloud Build itself, not for a custom CI/CD pipeline; using it would require additional configuration and may not align with the pipeline's service account requirements.

Answer

Configure the pipeline to impersonate a project-level service account in each project.

Answer

Grant the service account the Project Editor role at the organization level.

Answer

Use the Cloud Build service account and grant it permissions on each project.

Question 4

Your organization has multiple teams that need to deploy infrastructure using Terraform. You want to enforce that all Terraform state files are stored in a central Cloud Storage bucket with versioning enabled. You also need to ensure that only the CI/CD pipeline can write to the bucket. What is the best way to enforce this?

Accepted Answer

Use IAM conditions to restrict access to the bucket only when the requester is the CI/CD service account.. IAM conditions allow you to bind a role to a principal (the CI/CD service account) and then restrict access based on attributes of the request, such as the requester's identity. By using a condition that checks `iam.googleapis.com/principal` equals the CI/CD service account email, you ensure that only that specific service account can write to the bucket, even if other principals have the role. This enforces the policy without relying on network constructs or overly broad role assignments.

Answer

Use VPC Service Controls to restrict access to the bucket from only the CI/CD pipeline's VPC.

Answer

Create a custom IAM role with permissions to write to the bucket and assign it to the CI/CD service account.

Answer

Grant the Storage Object Admin role to the CI/CD service account at the bucket level.

Question 5

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Hosting shared CI/CD tools and artifacts in a dedicated project follows the principle of resource isolation and centralized management. This approach simplifies access control, cost tracking, and lifecycle management for DevOps pipelines, as the project acts as a single source of truth for build outputs and deployment tools.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 6

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Accepted Answer

Enable audit logging and set up log sinks to a centralized logging project.. Audit logging is essential for security and compliance in a DevOps environment. By enabling audit logs and setting up log sinks to a centralized logging project, you ensure that all API calls and administrative actions across the organization are captured in a single, immutable location, which is critical for incident response and forensic analysis.

Answer

Use a single project for development, staging, and production to reduce overhead.

Answer

Store secrets directly in code repositories for easy access by CI/CD pipelines.

Question 7

Your organization is adopting DevOps practices and needs to bootstrap a Google Cloud organization with multiple projects. You want to enforce consistent resource naming conventions and apply common organization policies across all projects. Which two services should you use together to achieve this?

Accepted Answer

Organization Policies and Resource Manager folders. To enforce consistent resource naming conventions and common organization policies across all projects, you need Organization Policies (via constraints) and Resource Manager folders. Organization Policies allow you to set rules such as custom naming constraints or disabling external IPs that apply across the entire resource hierarchy. Resource Manager folders help organize projects and can inherit policies. Service Accounts and IAM roles (C) control access but do not enforce naming conventions or policies directly. Therefore, only option D provides the appropriate services to achieve the goal.

Answer

Cloud Shell and Cloud Source Repositories

Answer

Cloud Deployment Manager and Cloud Audit Logs

Answer

Service Accounts and IAM roles

Question 8

A company is bootstrapping a Google Cloud organization for DevOps. They have multiple teams that need to deploy infrastructure using a shared CI/CD pipeline. The security team requires that all deployments be reviewed and approved before production rollout. However, they also want to maintain a fast feedback loop for developers. What is the best way to balance these requirements?

Accepted Answer

Use Spinnaker on GKE with a manual judgment stage between test and production. Spinnaker on GKE provides a native manual judgment stage that can be inserted between test and production deployments, enabling mandatory approval gates without sacrificing the fast feedback loop for developers. This balances security requirements with DevOps velocity by allowing automated testing to proceed quickly while blocking production rollout until explicit approval is given.

Answer

Use Cloud Build with a manual approval step triggered via Cloud Pub/Sub

Answer

Use Cloud Run for production and Cloud Functions for testing, with IAM roles controlling access

Answer

Use Cloud Source Repositories with branch restrictions requiring code review

Question 9

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

Accepted Answer

Cloud Asset Inventory can be used to discover all resources in the organization.. Cloud Asset Inventory provides a complete view of all resources (e.g., Compute Engine instances, Cloud Storage buckets, IAM policies) across the entire organization, including all folders and projects. This is essential for DevOps bootstrapping to audit, monitor, and manage resources at scale. It uses the Cloud Asset API to export asset metadata and supports real-time feeds for change detection.

Answer

After enabling the cloudresourcemanager.googleapis.com API, organization policies are automatically applied.

Answer

All projects in an organization automatically share a default VPC network.

Answer

Cloud Audit Logs are disabled by default and must be enabled for each service.

Question 10

Your company is bootstrapping a Google Cloud organization for DevOps. The organization consists of three folders: Dev, Staging, and Prod. Each folder contains multiple projects for different microservices. You have been tasked with setting up a centralized CI/CD pipeline using Cloud Build and Cloud Deploy. The pipeline must deploy to multiple environments in sequence: Dev → Staging → Prod. Each environment requires approval from a different approver group. You have set up Cloud Deploy delivery pipelines with targets pointing to each environment. However, during testing, you notice that after a successful deployment to Dev, the pipeline automatically proceeds to Staging without waiting for approval. What is the most likely cause and solution?

Accepted Answer

Cause: The targets in Staging and Prod are missing the `require_approval` attribute set to `true`. Solution: Add `require_approval: true` to the Staging and Prod target definitions.. Cloud Deploy requires explicit `require_approval: true` on each target to enforce manual approval gates. Without this attribute, the pipeline treats the target as automatically approved and proceeds to the next target in the promotion sequence. The behavior described—automatic progression after Dev—indicates that Staging and Prod targets lack this flag, causing the pipeline to skip the approval step.

Answer

Cause: The delivery pipeline is defined with a single target instead of multiple targets. Solution: Create separate delivery pipelines for each environment.

Answer

Cause: The delivery pipeline has a single promotion sequence that includes all targets. Solution: Remove Staging and Prod from the pipeline and create separate pipelines.

Answer

Cause: The Cloud Deploy service account lacks the `clouddeploy.approver` role on Staging and Prod projects. Solution: Grant the role to the service account.

Question 11

A startup wants to implement infrastructure as code for their Google Cloud environment to ensure reproducibility. They are using Terraform and want to manage state securely. What is the recommended approach?

Accepted Answer

Store Terraform state in a Cloud Storage bucket with object versioning enabled.. Storing Terraform state in a Cloud Storage bucket with object versioning enabled is the recommended approach because it provides a centralized, remote backend that supports state locking (via Cloud Storage's object lease mechanism) and version history for rollback. This ensures consistency across team members and protects against state corruption or accidental deletion, aligning with infrastructure as code best practices for reproducibility.

Answer

Store Terraform state in a file in Cloud Shell home directory.

Answer

Store Terraform state in Cloud Source Repositories as a YAML file.

Answer

Store Terraform state locally on each developer's machine and use git to sync.

Question 12

An organization is setting up a new Google Cloud organization and wants to enforce consistent resource naming conventions and policies across all projects. Which service should they use?

Accepted Answer

Organization Policies. Organization Policies allow you to centrally constrain specific behaviors and enforce consistent naming conventions across all projects in a Google Cloud organization using constraints like `constraints/gcp.resourceLocations` or custom constraints via the `OrganizationPolicy` API. This service is the correct choice because it directly applies hierarchical policy enforcement at the organization, folder, or project level, ensuring resource naming and other governance rules are uniformly applied without requiring per-project configuration.

Answer

VPC Service Controls

Answer

Cloud Run

Answer

Cloud Armor

Question 13

A DevOps team wants to automate the deployment of a microservice application to Google Kubernetes Engine (GKE) using Cloud Build. They have a Cloud Build configuration file that builds a container image and deploys it to GKE. However, the deployment step fails with an authorization error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Kubernetes Engine Developer IAM role.. Cloud Build uses a default service account (the Cloud Build service account) to execute build steps, including deploying to GKE. The Kubernetes Engine Developer IAM role (roles/container.developer) grants the necessary permissions to deploy and manage workloads on GKE clusters. Without this role, the Cloud Build service account cannot authenticate to the GKE cluster's Kubernetes API, resulting in an authorization error during the deployment step.

Answer

The user triggering the build does not have IAM permissions to deploy to GKE.

Answer

Cloud Build does not have permission to access the source code repository.

Answer

The Docker image build step failed due to missing dependencies.

Question 14

Arrange the steps to set up a Google Cloud Monitoring alerting policy for a Compute Engine instance.

Accepted Answer

Create notification channel, then define condition, set evaluation parameters, attach the channel, then save.. First create a notification channel, then define the condition, set evaluation parameters, attach the channel, and save.

Answer

Save, then attach the channel, set evaluation parameters, define condition, then create notification channel.

Answer

Define condition, then create notification channel, attach the channel, set evaluation parameters, then save.

Answer

Create notification channel, set evaluation parameters, define condition, attach the channel, then save.

Question 15

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Accepted Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Define delivery pipeline → Step 4: Push code → Step 5: Promote. The correct order for setting up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service begins with creating a build configuration file (cloudbuild.yaml) that specifies how to build and test the application. Next, you set a trigger (e.g., on push to a branch) in Cloud Build to automatically start builds. Then, you define a delivery pipeline in Cloud Deploy with targets (e.g., staging, production) and approval gates. After that, you push code to the repository, which triggers the build and, if successful, creates a release in the delivery pipeline. Finally, you promote the release through the stages (e.g., from staging to production) either automatically or after manual approval. This order ensures each prerequisite is in place before the next step, enabling a seamless automated workflow.

Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Push code → Step 4: Define delivery pipeline → Step 5: Promote

Answer

Step 1: Define delivery pipeline → Step 2: Create build config → Step 3: Set trigger → Step 4: Push code → Step 5: Promote

Answer

Step 1: Push code → Step 2: Create build config → Step 3: Set trigger → Step 4: Define delivery pipeline → Step 5: Promote