PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 3 — 15 Questions

Question 1

A company wants to enforce that all service accounts are created with a specific naming convention (e.g., prefix 'sa-'). What is the most efficient way to enforce this?

Accepted Answer

Use a Cloud Function that monitors and remediates non-compliant service accounts.. A Cloud Function can be triggered by a Pub/Sub notification on the `google.cloud.audit.log.v1.activityLog` topic for `google.iam.admin.v1.CreateServiceAccount` events. The function can immediately delete or disable non-compliant service accounts that do not match the 'sa-' prefix, providing automated enforcement without blocking legitimate creation attempts. This approach is event-driven and avoids the latency or complexity of periodic scanning.

Answer

Use a custom role that restricts service account creation to users who follow the naming convention.

Answer

Use an organization policy constraint with a condition on the service account name.

Answer

Use a folder-level attribute with a policy on service account names.

Question 2

Which TWO are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose two.)

Accepted Answer

Use separate service accounts for each environment.. Option A is correct because using separate service accounts for each environment (development, staging, production) enforces least privilege and blast-radius containment: each workload identity only holds the IAM roles needed for its own environment, so a compromised dev service account cannot touch production resources. Option B is correct because organizing projects into separate folders per environment lets you apply IAM policies, Organization Policies, and billing/quota controls hierarchically at the folder level, which is the standard Google Cloud resource hierarchy pattern for isolating dev, staging, and prod. Option C is not among the marked answers: while enabling audit logging is generally good, the question asks for the two best practices specifically tied to bootstrapping an organization for DevOps, and the marked pair (A and B) addresses identity isolation and environment separation. Option D is wrong because a single shared service account across all environments violates least privilege and dramatically increases the blast radius of a credential leak. Option E is wrong because disabling audit logging removes the Cloud Audit Logs trail needed for security, compliance, and incident forensics, and cost reduction is not a valid reason to disable it.

Answer

Enable audit logging for all projects at the organization level.

Answer

Create a single service account for all environments to simplify permissions.

Answer

Disable audit logging to reduce costs.

Question 3

Which THREE are valid methods to enforce resource location restrictions in a Google Cloud organization? (Choose three.)

Accepted Answer

Use VPC Service Controls to limit resource access to specific regions.. Option A is correct because VPC Service Controls perimeter configurations can include an access policy with an ingress/egress rule or a perimeter restriction that limits access to resources based on region, effectively enforcing location restrictions for services inside the perimeter. Option C is correct because Google Cloud organization policies are hierarchical: applying the same constraint (for example, constraints/gcp.resourceLocations) at a folder level enforces the location restriction for all projects and resources under that folder, inheriting from the organization root. Option D is correct because constraints/gcp.resourceLocations is the exact predefined organization policy constraint that restricts where resources can be created by allowing or denying specific locations (for example, in:us-locations or in:eu-locations). Option B is not correct because IAM policies control identities and permissions, not resource locations; there is no location condition in folder-level IAM that enforces where resources may be created. Option E is not correct because Cloud Audit Logs are detective and monitoring controls that record and alert on activity, but they do not prevent or enforce resource location restrictions.

Answer

Use folder-level IAM policies to restrict locations.

Answer

Use Cloud Audit Logs to detect and alert on resources created in non-compliant locations.

Question 4

Which THREE are required steps when setting up a CI/CD pipeline with Cloud Build for the first time? (Choose three.)

Accepted Answer

Enable the Cloud Build API.. Option B is correct because the Cloud Build API (cloudbuild.googleapis.com) must be enabled in the project before any builds or triggers can run. Option C is correct because the Cloud Build service account needs the roles/cloudbuild.builds.builder role to execute builds, including reading source and writing logs/artifacts. Option E is correct because a trigger requires a repository connection (e.g., via Cloud Source Repositories or the GitHub/GitLab app) to define what source change initiates the pipeline. Option A is not required, since Cloud Build provides managed builders and a custom base image is optional. Option D is not required, as Cloud Router is used for dynamic routing in VPC networks (e.g., with Cloud NAT or hybrid connectivity), not for CI/CD pipelines.

Answer

Create a custom base image for builds.

Answer

Set up a Cloud Router for network connectivity.

Question 5

A DevOps engineer is setting up a Cloud Build trigger that builds a container image and deploys it to Cloud Run. The build fails with a permission error when trying to access resources in a different project. The engineer has created a service account in the project where Cloud Build runs and granted it roles/run.admin and roles/storage.objectViewer on the target project. What is the most likely cause of the failure?

Accepted Answer

The Cloud Build service account lacks the iam.serviceAccounts.actAs permission on the Cloud Run runtime service account.. The error occurs because Cloud Build needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account to impersonate it when deploying the container. Even though the custom service account has `roles/run.admin` and `roles/storage.objectViewer` on the target project, without the `actAs` permission, Cloud Build cannot assume the runtime service account's identity to push the image and deploy the revision. This permission is typically granted via `roles/iam.serviceAccountUser` on the runtime service account itself.

Answer

The service account has been deleted or disabled.

Answer

Cloud Build’s default compute engine service account is being used instead of the custom one.

Answer

The service account must be created in the target project instead of the source project.

Question 6

A DevOps team is bootstrapping their Google Cloud organization and wants to enable Infrastructure as Code (IaC) using Terraform. They need a service account that Terraform can use to create and manage resources across multiple projects. What is the best practice for creating and managing this service account?

Accepted Answer

Create a service account in a separate 'admin' project and grant it the required roles on each project via IAM.. Google Cloud best practice for Terraform automation is to create a dedicated service account in a separate administrative project and grant it the necessary IAM roles on each target project. This centralizes identity management, limits blast radius, and avoids tying automation to a single project's lifecycle. It also aligns with the principle of least privilege and separation of duties.

Answer

Generate a service account key and store it in a Cloud Storage bucket accessible to the team.

Answer

Use a user account with two-factor authentication for Terraform automation.

Answer

Use the Compute Engine default service account from the project where Terraform runs.

Question 7

During bootstrapping, a DevOps engineer wants to ensure that all new projects automatically have a set of APIs enabled, such as Cloud Resource Manager API and Cloud Billing API. They also want to enforce that certain APIs cannot be disabled accidentally. What is the most efficient way to achieve this?

Accepted Answer

Use a custom Cloud Function that runs every time a project is created and enables the APIs.. Google Cloud provides event-driven capabilities through Cloud Functions that can be triggered by project creation events (via Cloud Audit Logs or Eventarc). By deploying a Cloud Function that listens for new projects and enables the desired APIs (e.g., Cloud Resource Manager API, Cloud Billing API), the DevOps engineer can automate API enablement without manual intervention. This is the most efficient and reliable approach for automatically enabling APIs on new projects.

Option C is incorrect because organization policies enforce constraints (e.g., 'serviceuser.services') that restrict which APIs can be disabled, but they cannot automatically enable APIs. Organization policies are used to prevent disabling of APIs, not to enable them proactively.

Answer

Grant the roles/serviceusage.serviceUsageAdmin role to the DevOps team and have them manually enable APIs when creating projects.

Answer

Use organization policies to define the constraints 'compute.requireOsLogin' and 'serviceuser.services' to restrict/enable APIs.

Answer

Create a folder with a 'Required APIs' setting that applies to all child projects.

Question 8

A company is bootstrapping a Google Cloud organization for the first time. They want to set up Cloud Identity to manage users and groups. What is the correct order of steps?

Accepted Answer

Sign up for Cloud Identity, create the Google Cloud organization node, add users and groups, then enable Google Cloud services and set up billing.. Cloud Identity is the foundation for managing users and groups in a Google Cloud organization. You must first sign up for Cloud Identity to create the identity realm, then create the organization node (which requires a Cloud Identity account), add users and groups, and finally enable services and set up billing. This order ensures that the organization node is linked to the correct Cloud Identity tenant and that users exist before they are granted access to resources.

Answer

Add users and groups directly in Google Cloud without Cloud Identity.

Answer

Create the organization node first, then sign up for Cloud Identity, then add users.

Answer

Create the organization node, set up billing, then add Cloud Identity.

Question 9

A multinational corporation is bootstrapping a Google Cloud organization with multiple subsidiaries. Each subsidiary needs its own folder with IAM policies that are managed locally, but the parent company wants to enforce a global policy that restricts the use of certain machine types (e.g., N2D) for cost control. However, one subsidiary has a legitimate need for those machine types in a specific project. What is the best way to handle this exception while maintaining the global policy?

Accepted Answer

Create a custom organization policy with a condition that excludes the exception project from the restriction.. Google Cloud Organization Policies support hierarchical inheritance with conditional overrides. By creating a custom organization policy with a condition that excludes the specific project (e.g., using `resource.name` or a custom attribute), the global restriction on N2D machine types is enforced for all subsidiaries except the exempted project, maintaining centralized cost control while allowing the legitimate exception.

Answer

Set an organization policy that denies N2D machine types, then create a separate policy at the project level to allow them for the exception project.

Answer

Use an audit-only policy and rely on a team to review and approve machine type usage.

Answer

Place each subsidiary in its own folder and set the machine type restriction only on folders that require it.

Question 10

Which TWO of the following are best practices when bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Create separate projects for development, staging, and production environments.. Option B is correct because isolating development, staging, and production into separate Google Cloud projects provides blast-radius containment, independent IAM bindings, and separate quotas/billing so that a failure or misconfiguration in one environment cannot affect the others. Option D is correct because CI/CD pipeline service accounts should be granted only the specific predefined or custom roles (and resource-level conditions) needed for their tasks, following the principle of least privilege to limit the impact of compromised credentials. Option A is not recommended because the default Compute Engine service account is broadly scoped (historically Editor) and shared across workloads, so using it for all automation violates least privilege. Option C is not a best practice for centralized DevOps because a dedicated admin/CI-CD project hosting pipeline service accounts with narrowly scoped cross-project IAM bindings is the recommended pattern, rather than duplicating service accounts per project. Option E is incorrect because organization policies are most effective when applied at the organization or folder level so they are inherited and enforced consistently across all projects.

Answer

Use the default Compute Engine service account for all DevOps automation.

Answer

Create a service account in each project that needs it, rather than a central admin project.

Answer

Set organization policies only at the project level, not at the folder or organization level.

Question 11

A company is bootstrapping a new Google Cloud organization for DevOps. They want to separate development, staging, and production environments using folders. Which folder structure follows Google-recommended best practices?

Accepted Answer

Create folders under the Organization node: Development, Staging, Production. Place all projects in the appropriate folder.. Google Cloud best practices recommend creating top-level folders under the Organization node for each environment (Development, Staging, Production) to enforce consistent policy inheritance and resource isolation. This structure allows you to apply organization policies and IAM roles at the environment level, ensuring that production resources are strictly separated from development and staging resources, which is critical for compliance and security.

Answer

Create a single folder called 'Environments' with subfolders Dev, Staging, Prod, and place projects in the subfolders.

Answer

Create a folder for each team, then subfolders for environments (e.g., Team1/Dev, Team1/Prod).

Answer

Use labels on projects to denote environment (e.g., env=dev) instead of folders.

Question 12

To securely manage secrets (e.g., API keys) used in Cloud Build pipelines, which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the recommended service for storing and accessing secrets like API keys. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not designed for secrets, and Cloud KMS is not for direct secret storage.

Answer

Cloud KMS

Answer

Cloud Key Management Service (duplicate)

Answer

Cloud Storage

Question 13

A Cloud Build pipeline fails with 'Permission denied' when trying to pull a Docker image from Artifact Registry in the same project. The Cloud Build service account has the Artifact Registry Reader role. What additional configuration is likely missing?

Accepted Answer

The Artifact Registry repository has a VPC-SC perimeter blocking access.. The Cloud Build service account has the Artifact Registry Reader role, which grants permission to read (pull) images. However, if the Artifact Registry repository is inside a VPC Service Controls (VPC-SC) perimeter, the service account must also be explicitly added to the perimeter's allowed identities or the request must originate from within the perimeter. Without this, VPC-SC blocks all API calls from outside the perimeter, resulting in a 'Permission denied' error despite valid IAM roles.

Answer

Cloud Build needs to be enabled in the Artifact Registry region.

Answer

The Docker image tag is incorrect.

Answer

The service account needs the Artifact Registry Writer role as well.

Question 14

When bootstrapping a new Google Cloud organization for DevOps, which set of initial IAM roles should be assigned to the DevOps team to enable them to create and manage projects, folders, and billing accounts?

Accepted Answer

Project Creator, Billing Account User, Organization Policy Administrator. The DevOps team needs the Project Creator role to create new projects, the Billing Account User role to link billing accounts to those projects, and the Organization Policy Administrator role to set organization-wide policies that control resource constraints. These three roles together provide the minimum necessary permissions for bootstrapping a Google Cloud organization without granting excessive administrative privileges.

Answer

Folder Admin, Billing Admin, Security Reviewer

Answer

Org Admin, Project Creator, Billing Admin

Answer

Project Creator, Billing Admin, Folder Admin

Question 15

An organization has a strict compliance requirement that all CI/CD pipelines must use customer-managed encryption keys (CMEK) for any artifacts stored in Cloud Storage. How can this be enforced at the organization level?

Accepted Answer

Create an Organization Policy with constraint `constraints/gcp.storageRequireCmeK`.. The Organization Policy constraint `constraints/gcp.storageRequireCmeK` is specifically designed to enforce that all new Cloud Storage buckets must be created with a customer-managed encryption key (CMEK). This policy is applied at the organization, folder, or project level and prevents the creation of buckets that do not use CMEK, thereby meeting the compliance requirement at the organizational level.

Answer

Use IAM conditions on storage buckets to require CMEK.

Answer

Use Cloud Asset Inventory to scan for non-compliant buckets.

Answer

Configure Cloud Audit Logs to monitor and alert on non-CMEK usage.