PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 3 — 15 Questions

Question 1

Order the steps to set up a log-based metric in Cloud Logging for error tracking.

Accepted Answer

Filter logs -> Create metric -> Set alert -> Test -> Verify. The correct sequence to set up a log-based metric in Cloud Logging for error tracking is: first, filter logs to isolate relevant entries; second, create a metric based on that filter; third, set an alert to trigger on metric conditions; fourth, test the alert to ensure it works; and finally, verify the setup. This order ensures each step builds logically on the previous one.

Answer

Create metric -> Filter logs -> Set alert -> Test -> Verify

Answer

Filter logs -> Set alert -> Create metric -> Test -> Verify

Answer

Filter logs -> Create metric -> Test -> Set alert -> Verify

Question 2

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud Build: Continuous integration/continuous delivery platform. The correct matches are: Cloud Build for CI/CD, Cloud Source Repositories for Git hosting, Cloud Functions for event-driven serverless functions, and Cloud Run for serverless containers. Common confusions include swapping the purposes of Cloud Build and Cloud Source Repositories.

Answer

Cloud Build: Private Git repository hosting

Answer

Cloud Source Repositories: Continuous integration/continuous delivery platform

Question 3

Match each Cloud Monitoring metric type to its description.

Accepted Answer

Gauge: A metric that measures a value at a specific point in time.. The correct matches are: Gauge measures a point-in-time value, Cumulative measures accumulated value over time, and Delta measures rate of change. Common confusions include swapping definitions between gauge and cumulative, or misunderstanding delta as cumulative.

Answer

Gauge: A metric that measures an accumulated value over time.

Answer

Cumulative: A metric that measures a value at a specific point in time.

Answer

Delta: A metric that measures an accumulated value over time.

Question 4

Match each Kubernetes resource to its role in a DevOps pipeline.

Accepted Answer

Pod: Smallest deployable unit, runs containers.. Key Kubernetes objects for application management. Pod runs containers, Deployment manages replicas and updates, Service provides stable networking, ConfigMap stores non-sensitive configuration, and Ingress controls external HTTP access.

Answer

Pod: Provides stable IP and DNS for a set of pods.

Answer

Deployment: Stores configuration data as key-value pairs.

Answer

ConfigMap: Manages external HTTP access to services.

Question 5

A DevOps team is bootstrapping a new Google Cloud organization. They want to grant a group of engineers the ability to create and manage projects within the organization, but not to modify organization policies or folders. Which IAM role should be assigned at the organization level?

Accepted Answer

roles/resourcemanager.projectCreator. Roles/resourcemanager.projectCreator, is correct because it grants the specific permission to create and manage projects within the organization without allowing modifications to organization policies or folders. This role includes permissions like resourcemanager.projects.create and resourcemanager.projects.update, but explicitly excludes permissions for organization-level policy management (e.g., resourcemanager.organizations.setIamPolicy) or folder administration (e.g., resourcemanager.folders.update).

Answer

roles/owner

Answer

roles/resourcemanager.folderAdmin

Answer

roles/editor

Question 6

A company is bootstrapping a Google Cloud organization. They have created a Shared VPC host project. They want to allow a service project's default compute service account to launch instances that use the Shared VPC's subnets. Which IAM role should be granted to that service account at the host project level?

Accepted Answer

roles/compute.networkUser. The `roles/compute.networkUser` role grants a service account the necessary permissions to use the subnets of a Shared VPC host project. Specifically, this role includes the `compute.subnetworks.use` permission, which allows the service account to launch instances in the host project's subnets without granting broader network management rights.

Answer

roles/compute.xpnAdmin

Answer

roles/compute.securityAdmin

Answer

roles/compute.networkAdmin

Question 7

A DevOps team is bootstrapping a Google Cloud organization. They have created a folder for a business unit and want to prevent users from moving projects out of that folder to other folders. Which organization policy constraint should they apply?

Accepted Answer

constraints/resourcemanager.disableProjectMove. The `constraints/resourcemanager.disableProjectMove` organization policy constraint explicitly prevents users from moving projects out of a specified folder or organization. When applied at the folder level, this constraint blocks any move operation that would relocate a project to a different parent, ensuring projects remain within the designated business unit folder. Options A, B, and C are invalid: `allowedResourceRestrictions` is not a real constraint, `allowedPolicyMemberDomains` restricts member domains, and `allowedProjectParent` does not exist.

Answer

constraints/resourcemanager.allowedResourceRestrictions

Answer

constraints/resourcemanager.allowedPolicyMemberDomains

Answer

constraints/resourcemanager.allowedProjectParent

Question 8

A DevOps team is setting up a CI/CD pipeline using Cloud Build. They want the Cloud Build service account to have permission to deploy to Cloud Run within a specific project. Which IAM role should be granted to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs the `roles/run.admin` role to deploy services to Cloud Run. This role grants full control over Cloud Run resources, including creating, updating, and deleting services, which is required for a CI/CD pipeline to perform deployments. Without this role, the service account would lack the necessary permissions to modify Cloud Run configurations.

Answer

roles/run.invoker

Answer

roles/cloudbuild.builds.editor

Answer

roles/iam.serviceAccountUser

Question 9

A company is bootstrapping their Google Cloud organization with multiple departments. Each department has several projects. They want to apply different IAM policies and organization policies per department. What is the recommended way to structure the resource hierarchy?

Accepted Answer

Create a folder for each department, then place projects under that folder.. Folders in the Google Cloud resource hierarchy allow you to group projects under a common node and apply both IAM policies and organization policies (e.g., constraints from the Organization Policy Service) at the folder level. This enables each department to have its own administrative boundary and policy inheritance, while still being under a single organization for centralized billing and auditing.

Answer

Use multiple organizations, one per department.

Answer

Use organization-level IAM for all departments.

Answer

Create a project for each department, then use labels to separate.

Question 10

A DevOps team wants to ensure that all audit logs from projects across the organization are sent to a central project for analysis. Which approach should they use?

Accepted Answer

Use organization-level log sinks to route audit logs to a central Cloud Storage bucket.. Organization-level log sinks allow you to aggregate audit logs from all projects within an organization into a single destination, such as a Cloud Storage bucket. This approach ensures centralized analysis and compliance without requiring per-project configuration, leveraging the hierarchical nature of Google Cloud resource management.

Answer

Enable VPC Flow Logs in each project.

Answer

Configure each project to export logs to a central BigQuery dataset.

Answer

Use Cloud Logging's default routing.

Question 11

A DevOps team is bootstrapping CI/CD pipelines that need access to API keys stored in Secret Manager. The pipelines run on Cloud Build. What is the best practice for granting access to secrets?

Accepted Answer

Grant the Cloud Build service account roles/secretmanager.secretAccessor on the project containing secrets.. Granting the Cloud Build service account the roles/secretmanager.secretAccessor role on the project containing secrets follows the principle of least privilege. Option A is wrong because using a custom service account with roles/secretmanager.admin grants excessive permissions. Option B is wrong because storing API keys as build substitutions is insecure and exposes them in logs. Option D is wrong because Cloud KMS is used for encryption, not as a best practice for secret access.

Answer

Use a custom service account with roles/secretmanager.admin and run Cloud Build as that account.

Answer

Store the API keys as build substitutions.

Answer

Use Cloud KMS to encrypt secrets and pass them as environment variables.

Question 12

A company uses a Shared VPC and wants to enforce a set of firewall rules across all projects in a folder. They want these rules to be immutable by project owners. Which approach should they use?

Accepted Answer

Use hierarchical firewall policies at the folder level.. Hierarchical firewall policies allow you to enforce firewall rules at the folder level, which are inherited by all projects within that folder. These policies are immutable by project owners because they are managed at the folder level, not the project or VPC level, and cannot be overridden or deleted by lower-level roles unless explicitly granted permission.

Answer

Use network tags and service accounts to enforce rules.

Answer

Use organization policy constraints to prevent project owners from modifying firewall rules.

Answer

Create firewall rules at the VPC level and assign them to the folder.

Question 13

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Organization Policies can enforce that all new projects must have specific labels by using a constraint like `constraints/compute.requireOsLogin` is not for labels, but you can use a custom constraint with the `constraints/gcp.resourceLabels` to require labels on resources. However, for projects themselves, you can use an organization policy with a list constraint to mandate that certain labels are present on all projects, and the policy will block creation of any project that does not comply.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 14

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

Accepted Answer

Grant Cloud Build service account access to secrets via IAM.. A is correct because Cloud Build's service account must be granted IAM roles (e.g., roles/secretmanager.secretAccessor) on the Secret Manager secret to allow the pipeline to retrieve the secret value at build time. Without explicit IAM binding, the service account lacks permission to access the secret, causing the build to fail. This follows the principle of least privilege and ensures that only authorized identities can read secrets.

Answer

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Answer

Base64 encode secrets and store them in Cloud Build substitutions.

Question 15

A company is bootstrapping a Google Cloud organization with multiple projects. They want to enable consistent security and compliance across all projects. Which two organization policies should they consider? (Choose TWO.)

Accepted Answer

Restrict domain of users to the company domain.. The 'Restrict domain of users to the company domain' organization policy (constraints/iam.allowedPolicyMemberDomains) ensures that only identities from the specified Google Workspace or Cloud Identity domain can be added as members in IAM policies across all projects. This prevents external users from gaining access, enforcing a consistent security boundary from the outset of bootstrapping.

Answer

Require all service accounts to have a unique naming convention.

Answer

Enforce that all projects have a Cloud Storage bucket.

Answer

Allow all projects to use any external IPs.