PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 3 — 15 Questions

Question 1

Match each Google Cloud service to its primary purpose.

Question 2

Match each Cloud Monitoring metric type to its description.

Question 3

Match each Kubernetes resource to its role in a DevOps pipeline.

Question 4

A DevOps team is bootstrapping a new Google Cloud organization. They want to grant a group of engineers the ability to create and manage projects within the organization, but not to modify organization policies or folders. Which IAM role should be assigned at the organization level?

Accepted Answer

roles/resourcemanager.projectCreator. Option D, roles/resourcemanager.projectCreator, is correct because it grants the specific permission to create and manage projects within the organization without allowing modifications to organization policies or folders. This role includes permissions like resourcemanager.projects.create and resourcemanager.projects.update, but explicitly excludes permissions for organization-level policy management (e.g., resourcemanager.organizations.setIamPolicy) or folder administration (e.g., resourcemanager.folders.update).

Answer

roles/owner

Answer

roles/resourcemanager.folderAdmin

Answer

roles/editor

Question 5

A company is bootstrapping a Google Cloud organization. They have created a Shared VPC host project. They want to allow a service project's default compute service account to launch instances that use the Shared VPC's subnets. Which IAM role should be granted to that service account at the host project level?

Accepted Answer

roles/compute.networkUser. The correct answer is C because the `roles/compute.networkUser` role grants a service account the necessary permissions to use the subnets of a Shared VPC host project. Specifically, this role includes the `compute.subnetworks.use` permission, which allows the service account to launch instances in the host project's subnets without granting broader network management rights.

Answer

roles/compute.xpnAdmin

Answer

roles/compute.securityAdmin

Answer

roles/compute.networkAdmin

Question 6

A DevOps team is bootstrapping a Google Cloud organization. They have created a folder for a business unit and want to prevent users from moving projects out of that folder to other folders. Which organization policy constraint should they apply?

Accepted Answer

constraints/resourcemanager.disableProjectMove. Option D is correct because the `constraints/resourcemanager.disableProjectMove` organization policy constraint explicitly prevents users from moving projects out of a specified folder or organization. When applied at the folder level, this constraint blocks any move operation that would relocate a project to a different parent, ensuring projects remain within the designated business unit folder.

Answer

constraints/resourcemanager.allowedResourceRestrictions

Answer

constraints/resourcemanager.allowedPolicyMemberDomains

Answer

constraints/resourcemanager.allowedProjectParent

Question 7

A DevOps team is setting up a CI/CD pipeline using Cloud Build. They want the Cloud Build service account to have permission to deploy to Cloud Run within a specific project. Which IAM role should be granted to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs the `roles/run.admin` role to deploy services to Cloud Run. This role grants full control over Cloud Run resources, including creating, updating, and deleting services, which is required for a CI/CD pipeline to perform deployments. Without this role, the service account would lack the necessary permissions to modify Cloud Run configurations.

Answer

roles/run.invoker

Answer

roles/cloudbuild.builds.editor

Answer

roles/iam.serviceAccountUser

Question 8

A company is bootstrapping their Google Cloud organization with multiple departments. Each department has several projects. They want to apply different IAM policies and organization policies per department. What is the recommended way to structure the resource hierarchy?

Accepted Answer

Create a folder for each department, then place projects under that folder.. Option D is correct because folders in the Google Cloud resource hierarchy allow you to group projects under a common node and apply both IAM policies and organization policies (e.g., constraints from the Organization Policy Service) at the folder level. This enables each department to have its own administrative boundary and policy inheritance, while still being under a single organization for centralized billing and auditing.

Answer

Use multiple organizations, one per department.

Answer

Use organization-level IAM for all departments.

Answer

Create a project for each department, then use labels to separate.

Question 9

A DevOps engineer is troubleshooting a Cloud Build failure. The build log shows the error: 'Permission denied for resource projects/my-project/locations/us-central1/repositories/my-repo'. The Cloud Build service account (PROJECT_NUMBER@cloudbuild.gserviceaccount.com) is used. What is the most likely missing role?

Accepted Answer

roles/artifactregistry.writer. The error 'Permission denied for resource projects/my-project/locations/us-central1/repositories/my-repo' indicates that the Cloud Build service account lacks permission to write artifacts to Artifact Registry. The Cloud Build service account needs the `roles/artifactregistry.writer` role to upload build artifacts (e.g., container images) to the repository. Without this role, the build fails at the step that attempts to push artifacts.

Answer

roles/artifactregistry.reader

Answer

roles/artifactregistry.admin

Answer

roles/cloudbuild.builds.builder

Question 10

A DevOps team wants to ensure that all audit logs from projects across the organization are sent to a central project for analysis. Which approach should they use?

Accepted Answer

Use organization-level log sinks to route audit logs to a central Cloud Storage bucket.. Option C is correct because organization-level log sinks allow you to aggregate audit logs from all projects within an organization into a single destination, such as a Cloud Storage bucket. This approach ensures centralized analysis and compliance without requiring per-project configuration, leveraging the hierarchical nature of Google Cloud resource management.

Answer

Enable VPC Flow Logs in each project.

Answer

Configure each project to export logs to a central BigQuery dataset.

Answer

Use Cloud Logging's default routing.

Question 11

A DevOps team is bootstrapping CI/CD pipelines that need access to API keys stored in Secret Manager. The pipelines run on Cloud Build. What is the best practice for granting access to secrets?

Accepted Answer

Grant the Cloud Build service account roles/secretmanager.secretAccessor on the project containing secrets.. Option A is correct because granting the Cloud Build service account roles/secretmanager.secretAccessor on the project containing secrets provides fine-grained access. Option B is wrong because storing API keys as build substitutions is insecure and exposed in logs. Option C is wrong because roles/secretmanager.admin grants excessive permissions. Option D is wrong because using Cloud KMS adds complexity without being a best practice for secret access.

Answer

Use a custom service account with roles/secretmanager.admin and run Cloud Build as that account.

Answer

Store the API keys as build substitutions.

Answer

Use Cloud KMS to encrypt secrets and pass them as environment variables.

Question 12

A company uses a Shared VPC and wants to enforce a set of firewall rules across all projects in a folder. They want these rules to be immutable by project owners. Which approach should they use?

Accepted Answer

Use hierarchical firewall policies at the folder level.. Hierarchical firewall policies allow you to enforce firewall rules at the folder level, which are inherited by all projects within that folder. These policies are immutable by project owners because they are managed at the folder level, not the project or VPC level, and cannot be overridden or deleted by lower-level roles unless explicitly granted permission.

Answer

Use network tags and service accounts to enforce rules.

Answer

Use organization policy constraints to prevent project owners from modifying firewall rules.

Answer

Create firewall rules at the VPC level and assign them to the folder.

Question 13

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Option A is correct because Organization Policies can enforce that all new projects must have specific labels by using a constraint like `constraints/compute.requireOsLogin` is not for labels, but you can use a custom constraint with the `constraints/gcp.resourceLabels` to require labels on resources. However, for projects themselves, you can use an organization policy with a list constraint to mandate that certain labels are present on all projects, and the policy will block creation of any project that does not comply.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 14

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

Accepted Answer

Grant Cloud Build service account access to secrets via IAM.. A is correct because Cloud Build's service account must be granted IAM roles (e.g., roles/secretmanager.secretAccessor) on the Secret Manager secret to allow the pipeline to retrieve the secret value at build time. Without explicit IAM binding, the service account lacks permission to access the secret, causing the build to fail. This follows the principle of least privilege and ensures that only authorized identities can read secrets.

Answer

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Answer

Base64 encode secrets and store them in Cloud Build substitutions.

Question 15

A company is bootstrapping a Google Cloud organization with multiple projects. They want to enable consistent security and compliance across all projects. Which two organization policies should they consider? (Choose TWO.)

Accepted Answer

Restrict domain of users to the company domain.. Option B is correct because the 'Restrict domain of users to the company domain' organization policy (constraints/iam.allowedPolicyMemberDomains) ensures that only identities from the specified Google Workspace or Cloud Identity domain can be added as members in IAM policies across all projects. This prevents external users from gaining access, enforcing a consistent security boundary from the outset of bootstrapping.

Answer

Require all service accounts to have a unique naming convention.

Answer

Enforce that all projects have a Cloud Storage bucket.

Answer

Allow all projects to use any external IPs.