PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 2 — 15 Questions

Question 1

Your company is bootstrapping a Google Cloud organization for DevOps. The organization consists of three folders: Dev, Staging, and Prod. Each folder contains multiple projects for different microservices. You have been tasked with setting up a centralized CI/CD pipeline using Cloud Build and Cloud Deploy. The pipeline must deploy to multiple environments in sequence: Dev → Staging → Prod. Each environment requires approval from a different approver group. You have set up Cloud Deploy delivery pipelines with targets pointing to each environment. However, during testing, you notice that after a successful deployment to Dev, the pipeline automatically proceeds to Staging without waiting for approval. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cause: The targets in Staging and Prod are missing the `require_approval` attribute set to `true`. Solution: Add `require_approval: true` to the Staging and Prod target definitions.. Cloud Deploy requires explicit `require_approval: true` on each target to enforce manual approval gates. Without this attribute, the pipeline treats the target as automatically approved and proceeds to the next target in the promotion sequence. The behavior described—automatic progression after Dev—indicates that Staging and Prod targets lack this flag, causing the pipeline to skip the approval step.

Answer

Cause: The delivery pipeline is defined with a single target instead of multiple targets. Solution: Create separate delivery pipelines for each environment.

Answer

Cause: The delivery pipeline has a single promotion sequence that includes all targets. Solution: Remove Staging and Prod from the pipeline and create separate pipelines.

Answer

Cause: The Cloud Deploy service account lacks the `clouddeploy.approver` role on Staging and Prod projects. Solution: Grant the role to the service account.

Question 2

An organization is setting up a new Google Cloud organization and wants to enforce consistent resource naming conventions and policies across all projects. Which service should they use?

Accepted Answer

Organization Policies. Organization Policies allow you to centrally constrain specific behaviors and enforce consistent naming conventions across all projects in a Google Cloud organization using constraints like `constraints/gcp.resourceLocations` or custom constraints via the `OrganizationPolicy` API. This service is the correct choice because it directly applies hierarchical policy enforcement at the organization, folder, or project level, ensuring resource naming and other governance rules are uniformly applied without requiring per-project configuration.

Answer

VPC Service Controls

Answer

Cloud Run

Answer

Cloud Armor

Question 3

Match each Kubernetes resource to its role in a DevOps pipeline.

Accepted Answer

Pod: Smallest deployable unit, runs containers.. Key Kubernetes objects for application management. Pod runs containers, Deployment manages replicas and updates, Service provides stable networking, ConfigMap stores non-sensitive configuration, and Ingress controls external HTTP access.

Answer

Pod: Provides stable IP and DNS for a set of pods.

Answer

Deployment: Stores configuration data as key-value pairs.

Answer

ConfigMap: Manages external HTTP access to services.

Question 4

A DevOps team is bootstrapping a new Google Cloud organization. They want to grant a group of engineers the ability to create and manage projects within the organization, but not to modify organization policies or folders. Which IAM role should be assigned at the organization level?

Accepted Answer

roles/resourcemanager.projectCreator. Roles/resourcemanager.projectCreator, is correct because it grants the specific permission to create and manage projects within the organization without allowing modifications to organization policies or folders. This role includes permissions like resourcemanager.projects.create and resourcemanager.projects.update, but explicitly excludes permissions for organization-level policy management (e.g., resourcemanager.organizations.setIamPolicy) or folder administration (e.g., resourcemanager.folders.update).

Answer

roles/owner

Answer

roles/resourcemanager.folderAdmin

Answer

roles/editor

Question 5

A DevOps team is bootstrapping a Google Cloud organization. They have created a folder for a business unit and want to prevent users from moving projects out of that folder to other folders. Which organization policy constraint should they apply?

Accepted Answer

constraints/resourcemanager.disableProjectMove. The `constraints/resourcemanager.disableProjectMove` organization policy constraint explicitly prevents users from moving projects out of a specified folder or organization. When applied at the folder level, this constraint blocks any move operation that would relocate a project to a different parent, ensuring projects remain within the designated business unit folder. Options A, B, and C are invalid: `allowedResourceRestrictions` is not a real constraint, `allowedPolicyMemberDomains` restricts member domains, and `allowedProjectParent` does not exist.

Answer

constraints/resourcemanager.allowedResourceRestrictions

Answer

constraints/resourcemanager.allowedPolicyMemberDomains

Answer

constraints/resourcemanager.allowedProjectParent

Question 6

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Option A is correct because an organization policy (specifically a custom constraint or the built-in constraint on resource labels, e.g., constraints/gcp.resourceLabels or a custom constraint requiring specific label keys) can enforce that projects must carry required labels at creation time, ensuring consistency across the organization. Option C is correct because a Cloud Function triggered by Cloud Logging/Eventarc Project creation events (google.cloud.resourcemanager.v3.Project create audit logs) can programmatically apply the standard label set to every new project, providing automatic, consistent labeling. Option B is not correct because a Terraform module only labels projects that are provisioned through that module, so it cannot guarantee consistency for projects created by other means. Option D is not correct because constraints are defined and enforced at the organization or folder level via organization policy, not as a separate 'folder-level constraint' mechanism for labels. Option E is not correct because Cloud Asset Inventory is a read-only inventory and monitoring service; it can report on labels but cannot apply or enforce them.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 7

A company is bootstrapping a Google Cloud organization with multiple projects. They want to enable consistent security and compliance across all projects. Which two organization policies should they consider? (Choose TWO.)

Accepted Answer

Restrict domain of users to the company domain.. Option B is correct because the organization policy constraint iam.allowedPolicyMemberDomains (formerly restrictDomain) limits IAM policy members to identities from the company's own domain, ensuring that only corporate users can be granted access across all projects in the organization. Option E is correct because the constraint iam.disableAuditLogging (or the equivalent audit logging prevention constraint) blocks users from turning off audit logging, preserving the audit trail needed for security and compliance across every project. Option A is not a valid organization policy constraint — there is no built-in policy enforcing service account naming conventions, and naming is not a security control. Option C is not a real organization policy; there is no constraint requiring every project to contain a Cloud Storage bucket. Option D contradicts the goal of consistent security, since allowing any external IPs would loosen network controls rather than enforce compliance.

Answer

Require all service accounts to have a unique naming convention.

Answer

Enforce that all projects have a Cloud Storage bucket.

Answer

Allow all projects to use any external IPs.

Question 8

Refer to the exhibit. The DevOps team is trying to create a new service account key. The operation fails with a permission error. What is the most likely cause?

Accepted Answer

The organization policy prevents uploading service account keys.. Organization policies can explicitly restrict the creation of service account keys at the organization, folder, or project level. When a key upload fails with a permission error despite the user having the necessary IAM roles, the most likely cause is an organization policy constraint such as `iam.disableServiceAccountKeyUpload` that blocks the operation. This policy overrides any IAM permissions granted to the user.

Answer

The project-level IAM denies the action.

Answer

The service account is disabled.

Answer

The service account lacks the iam.serviceAccountKeys.create permission.

Question 9

Refer to the exhibit. The Cloud Build fails with a permission error. The Cloud Build service account has roles/cloudbuild.builds.builder and roles/cloudfunctions.developer on the project. What is the missing permission?

Accepted Answer

cloudfunctions.functions.setIamPolicy. The Cloud Build service account needs to deploy a Cloud Function, which requires setting IAM policy on the function to allow the Cloud Functions service account to be invoked. The permission cloudfunctions.functions.setIamPolicy is required to set the IAM policy on the function, which is missing from the roles/cloudfunctions.developer role. Therefore, the missing permission is cloudfunctions.functions.setIamPolicy.

Answer

cloudfunctions.functions.get

Answer

iam.serviceAccounts.actAs

Answer

cloudfunctions.functions.sourceCodes.set

Question 10

Refer to the exhibit. A DevOps engineer is trying to create a new project using the Cloud Console. The project creation fails with a policy violation. The engineer has permissions on folders/12345678 and folders/87654321 but not on any other folders. They select folder/87654321 as the parent. What is the most likely reason for the failure?

Accepted Answer

The policy requires the project parent to be one of the allowed folders, and folder/87654321 is not listed.. The policy violation indicates that the organization has a constraint restricting which folders can be used as project parents. The engineer selected folder/87654321, but the policy explicitly lists only certain allowed folders, and folder/87654321 is not among them. This is a common organization policy (e.g., a list constraint) that enforces project creation only in approved folders, regardless of the engineer's IAM permissions on that folder.

Answer

The engineer is missing the resourcemanager.projects.create permission.

Answer

The policy is enforced at the organization level but the engineer's IAM role does not allow creating projects in that folder.

Answer

The policy is set at the folder level, and folder/87654321 has a different policy.

Question 11

A company uses Cloud Build for CI/CD. They want to allow Cloud Build to deploy to Cloud Run. What is the minimum IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs permission to create and manage Cloud Run resources, including deploying new revisions. The `roles/run.admin` role provides full control over Cloud Run services, which is the minimum required for deployment. The `roles/cloudbuild.builds.builder` role only allows building and managing Cloud Build triggers, not deploying to Cloud Run.

Answer

roles/cloudbuild.builds.builder

Answer

roles/editor

Answer

roles/run.invoker

Question 12

A company wants to enforce that all projects in the organization have a specific VPC Service Controls perimeter. What is the most efficient way to achieve this?

Accepted Answer

Use folder-level VPC Service Controls perimeters.. Folder-level VPC Service Controls perimeters allow you to apply a single perimeter configuration to all projects within a folder, ensuring consistent enforcement across the organization without needing to configure each project individually. This is the most efficient method because it leverages the resource hierarchy to inherit the policy, reducing administrative overhead and preventing misconfigurations.

Answer

Use project-level VPC Service Controls perimeters.

Answer

Use organization policies to set the perimeter.

Answer

Use a custom script to monitor and alert on non-compliant projects.

Question 13

A company is bootstrapping their organization using Terraform and wants to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which of the following is the best practice for securing the state file?

Accepted Answer

Use a bucket with a CMEK key and grant roles/storage.objectAdmin to the Terraform service account.. Using a CMEK (Customer-Managed Encryption Key) ensures the state file is encrypted at rest with a key controlled by the organization, and granting roles/storage.objectAdmin to the Terraform service account provides the necessary read, write, and delete permissions on objects. This combination meets the security requirements for a bootstrapping scenario where the state file contains sensitive infrastructure configuration and must be protected from unauthorized access while allowing Terraform to manage it.

Answer

Use a bucket with fine-grained access and grant roles/storage.objectCreator to the Terraform service account.

Answer

Use a bucket with object versioning and enable VPC Service Controls.

Answer

Use a bucket with uniform access and grant roles/storage.objectViewer to the Terraform service account.

Question 14

A DevOps engineer needs to assign IAM roles at the organization level. Which built-in role is specifically designed for managing IAM policies across the organization?

Accepted Answer

roles/iam.securityAdmin. The role `roles/iam.securityAdmin` is the built-in IAM role specifically designed for managing IAM policies across the organization. It grants permissions to get and set IAM policies at the organization, folder, and project levels, without granting other resource management permissions. This makes it the correct choice for a DevOps engineer who needs to assign IAM roles organization-wide.

Answer

roles/resourcemanager.organizationAdmin

Answer

roles/owner

Answer

roles/editor

Question 15

A company uses Cloud Build to deploy applications and wants to ensure that builds from forked repositories cannot access sensitive environment variables. What is the best practice?

Accepted Answer

Use Cloud Build's 'encrypted variables' and mark them as 'not available for pull requests from forks'.. Cloud Build allows you to mark encrypted variables as 'not available for pull requests from forks', which prevents forked PRs from accessing sensitive environment variables. This is the most direct and secure method to protect secrets in CI/CD pipelines involving external contributions.

Answer

Disable builds from forks entirely.

Answer

Use Cloud Build's 'substitutions' instead of environment variables.

Answer

Use Cloud Build's 'secrets' manager instead of environment variables.