PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 4 — 15 Questions

Question 1

Which TWO Organization Policy constraints are commonly used to enhance security in a DevOps environment?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. Option C (constraints/iam.disableServiceAccountKeyCreation) is correct because it blocks the creation of long-lived service account keys, forcing workloads in a DevOps pipeline to use short-lived credentials via Workload Identity Federation or attached service accounts, which removes a major credential-leak vector. Option E (constraints/compute.disablePublicIpAddress) is correct because it prevents VM instances from receiving external IP addresses, keeping build agents, runners, and deployment targets on private networks reachable only through Cloud NAT, IAP, or a bastion, which sharply reduces the attack surface. The unmarked options do not belong: constraints/cloudbuild.enableBuildManager is not a real Organization Policy constraint, constraints/storage.uniformBucketLevelAccess is a bucket-level setting rather than an org policy constraint, and constraints/appengine.disableCodeDownload targets App Engine code download behavior rather than the core DevOps credential and network exposure risks addressed by C and E.

Answer

constraints/cloudbuild.enableBuildManager

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/appengine.disableCodeDownload

Question 2

When bootstrapping a Google Cloud organization for DevOps, which THREE steps are essential to set up a secure CI/CD foundation using Cloud Build?

Accepted Answer

Create a Cloud Source Repository for each application's code.. Option A is correct because a Cloud Source Repository (or equivalent connected repo) is required to host each application's code so Cloud Build triggers have a source to build from. Option B is correct because a Cloud Build trigger configured to fire on commits to the main branch is the core mechanism that automates CI builds on every code change. Option D is correct because the Cloud Build API must be enabled and the Cloud Build service account needs IAM roles such as Cloud Run Admin and Artifact Registry Writer to deploy and push artifacts. Option C is not essential here because disabling default service accounts is a hardening practice, not a required CI/CD bootstrap step, and can break workloads. Option E is not essential because VPC Service Controls is an advanced perimeter control, not a prerequisite for a basic secure Cloud Build CI/CD foundation.

Answer

Disable default service accounts in all projects.

Answer

Configure VPC Service Controls for all projects.

Question 3

A Cloud Build pipeline that deploys a container to Cloud Run fails with the error: `Missing required permission run.routes.invoke`. The Cloud Build service account has the 'Cloud Run Invoker' role. Which TWO additional steps should be taken?

Accepted Answer

Ensure the service account has the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account.. Option A is correct because deploying to Cloud Run requires the Cloud Build service account to impersonate the Cloud Run runtime service account, which needs the iam.serviceAccounts.actAs permission on that runtime service account. Option C is correct because the Cloud Run Developer role (roles/run.developer) includes the permissions needed to deploy and manage Cloud Run services, such as run.services.create and run.services.update, which the Cloud Run Invoker role alone does not provide. The Cloud Run Invoker role only grants run.routes.invoke for invoking services, so it is insufficient for deployment. Option B is not the issue because the error is a permission error, not an API-disabled error. Option D is unnecessary because the existing service account can be granted the required roles. Option E is incorrect because run.routes.invoke is already included in the Cloud Run Invoker role and adding it to a custom role does not address the missing deployment permissions.

Answer

Enable the Cloud Run API in the project.

Answer

Use a different service account for deployment.

Answer

Add the `run.routes.invoke` permission to a custom role.

Question 4

An organization has multiple projects under a common folder. They want to enforce that all projects use the same VPC network from a central host project. However, one project needs to use a different VPC due to compliance requirements. How can this be achieved?

Accepted Answer

Set an organization policy to enforce shared VPC and create an exception for the specific project using the policy condition.. Google Cloud Organization Policies can enforce constraints like `compute.restrictSharedVpcHostProjects` to mandate shared VPC usage across projects. You can use policy conditions (e.g., `resource.matchTag`) to create an exception for a specific project that needs its own VPC, allowing it to bypass the constraint while all other projects remain bound to the central host project.

Answer

Use VPC Network Peering to connect the project to the host project.

Answer

Create a separate folder for the exception project and apply a different organizational policy.

Answer

Grant the project the necessary permissions to use its own VPC.

Question 5

A startup wants to implement Infrastructure as Code (IaC) using Terraform for their Google Cloud environment. They need to manage state files securely. What is the best practice?

Accepted Answer

Store Terraform state in Cloud Storage with uniform bucket-level access using a dedicated bucket.. Storing Terraform state in Cloud Storage with uniform bucket-level access is the best practice because it provides a centralized, durable, and versioned backend that supports state locking via object lease mechanisms. This approach prevents concurrent modifications and ensures consistency across team members, while uniform bucket-level access simplifies IAM management by disabling ACLs and enforcing bucket policies exclusively.

Answer

Use a Cloud SQL database to store state.

Answer

Store state in a Git repository.

Answer

Store state locally on the developer's machine.

Question 6

A DevOps team is setting up a Google Cloud organization and wants to ensure that all billing alerts are centrally managed. What should they do?

Accepted Answer

Set up billing alerts at the organization level using Cloud Billing.. Setting up billing alerts at the organization level using Cloud Billing (Option D) is correct because it allows centralized management of billing thresholds, notifications, and budget policies across all projects within the organization. This approach leverages the Cloud Billing budget feature, which can be configured at the billing account level to send alerts to Pub/Sub topics or email recipients, ensuring consistent oversight without per-project configuration.

Answer

Use Cloud Monitoring to create custom metrics for billing.

Answer

Set up billing alerts individually for each project.

Answer

Create a project dedicated to billing and manage alerts there.

Question 7

An organization has a policy that all projects must have Cloud Logging enabled and logs must be retained for at least 365 days. What is the most efficient way to enforce this across all projects?

Accepted Answer

Configure a sink at the organization level to aggregate logs and set retention.. Configuring a sink at the organization level allows you to aggregate logs from all projects into a single destination (e.g., a Cloud Storage bucket or BigQuery dataset) and set a retention policy of 365 days on that destination. This is the most efficient method as it enforces the logging and retention requirements centrally without needing to configure each project individually.

Answer

Create a custom role with logging permissions and assign to all projects.

Answer

Use an organization policy to enforce logging requirements.

Answer

Use Cloud Asset Inventory to monitor logging configurations.

Question 8

Which TWO are valid methods to manage service account keys securely? (Select exactly 2)

Accepted Answer

Automate key rotation using a Cloud Function.. Option B is correct because automating key rotation with a Cloud Function removes human error and ensures keys are replaced on a reliable schedule, which is a recommended practice for managing service account keys securely. Option C is correct because workload identity federation lets workloads authenticate to Google Cloud using short-lived, automatically rotated credentials from an external identity provider, eliminating the need to create or store long-lived service account keys at all. Option A is not ideal because manual rotation every 90 days is error-prone and does not scale, and it still relies on long-lived keys. Option D is wrong because embedding keys in application code exposes them in source control and build artifacts. Option E is wrong because storing keys in a publicly accessible Cloud Storage bucket makes them readable by anyone on the internet.

Answer

Rotate keys manually every 90 days.

Answer

Embed keys in application code.

Answer

Store keys in Cloud Storage with public access.

Question 9

Refer to the exhibit. A DevOps engineer tries to create a project but gets this error. What is the most likely cause?

Accepted Answer

The organization has an organizational policy that restricts project creation.. The error message indicates that project creation is blocked by an organizational policy. In Google Cloud, organization policies (e.g., constraints/compute.restrictNonCcmlProjects) can be set at the organization or folder level to restrict project creation. This is a common control for governance and cost management, and it overrides individual user permissions.

Answer

The project ID already exists.

Answer

The user's billing account is not linked.

Answer

The user does not have the Project Creator role.

Question 10

Your company has recently migrated to Google Cloud and has set up an organization with three folders: Development, Staging, and Production. Each folder contains multiple projects. The DevOps team has established a centralized CI/CD pipeline using Cloud Build and Artifact Registry in a tools project under the Development folder. They want to ensure that only images built by the CI/CD pipeline are allowed to be deployed to the Production environment. They have configured Binary Authorization with a policy that requires attestations from the Cloud Build service account. However, a developer accidentally pushes a container image directly from their local machine to Artifact Registry using their personal IAM permissions, and then deploys that image to a Production project by bypassing the CI/CD pipeline. How can you prevent this from happening in the future?

Accepted Answer

Remove the Artifact Registry Writer role from all developers and only grant it to the Cloud Build service account.. The root cause of the bypass is that developers have the Artifact Registry Writer (roles/artifactregistry.writer) IAM role, which allows them to push images directly. By removing this role from all developers and granting it exclusively to the Cloud Build service account, you enforce that only the CI/CD pipeline can write to the registry. Binary Authorization then requires attestations from that same service account, ensuring that only pipeline-built images can be deployed to Production.

Answer

Enable Cloud Audit Logs for Artifact Registry and set up alerts to detect unauthorized pushes.

Answer

Create a VPC Service Controls perimeter around Artifact Registry to restrict access.

Answer

Configure a Cloud Function to automatically delete images pushed outside of Cloud Build.

Question 11

A company wants to ensure that all projects in the organization have Cloud Resource Manager API enabled. What is the most efficient method?

Accepted Answer

Set an organization policy to require the API.. Organization policies allow you to enforce constraints across all projects in the organization, ensuring the Cloud Resource Manager API is enabled automatically and cannot be disabled. This is the most efficient method as it requires no manual intervention or scripting, and it leverages the native Google Cloud policy framework to enforce compliance at scale.

Answer

Use a Cloud Scheduler job to enable the API in new projects.

Answer

Enable the API manually in each project.

Answer

Use a Terraform script that iterates over all projects.

Question 12

A company is bootstrapping a new Google Cloud organization. They want to ensure that all projects are created under specific folders and that certain IAM roles are automatically granted to a group for new projects. What is the most efficient approach?

Accepted Answer

Use a Cloud Function triggered by project creation events to apply IAM roles.. It leverages a Cloud Function that listens to the `google.cloud.resourcemanager.project.v1.created` event via Eventarc, enabling automated, event-driven application of IAM roles to new projects without manual intervention or polling. This approach is the most efficient for bootstrapping because it ensures that every newly created project automatically inherits the required IAM bindings, regardless of how the project was created (e.g., via Console, gcloud, or API).

Answer

Use folder-level IAM roles to grant permissions to projects.

Answer

Use Terraform to create projects and assign IAM roles.

Answer

Use organization policies to restrict project creation to specific folders.

Question 13

A DevOps engineer notices that developers are accidentally deleting Cloud Storage buckets. The organization wants to prevent accidental deletion while still allowing developers to manage bucket objects. What is the best practice?

Accepted Answer

Set a bucket retention policy with deletion lock.. A bucket retention policy with a deletion lock prevents the deletion of the bucket itself, even by users with owner permissions, while still allowing developers to manage objects within the bucket. This is the only option that directly enforces a hard, irreversible lock on bucket deletion, meeting the requirement to prevent accidental deletion without restricting object management.

Answer

Enable Cloud Audit Logging and set up alerts on bucket deletion.

Answer

Set a bucket IAM policy denying storage.objects.delete for developers.

Answer

Use an organization policy to disable bucket deletion across the org.

Question 14

A financial company is bootstrapping their Google Cloud organization for DevOps. They have strict compliance requirements: all projects must be under a folder hierarchy based on business units, and each project must have a Cloud Storage bucket with a retention policy of at least 1 year. They have 50 existing projects that need to be migrated into this hierarchy, and all future projects must comply. The team wants to automate as much as possible using Google Cloud services. Currently, projects are created manually with various ad-hoc permissions. What is the best approach to meet these requirements?

Accepted Answer

Define a resource hierarchy with folders, use a Cloud Build trigger to run a script that creates new projects and applies bucket retention, and use an organization policy to restrict project creation to a service account.. It uses Cloud Build triggers to automate project creation and bucket retention policy application, while restricting project creation to a service account via an organization policy ensures only authorized automation can create projects. This enforces the folder hierarchy and compliance requirements without manual intervention, aligning with DevOps automation principles.

Answer

Write a Terraform config to create folders and projects, but allow any user to create projects.

Answer

Create folders for each business unit, use a Cloud Function to move existing projects into folders, and set up an organization policy to require retention policies on buckets.

Answer

Use a single folder for all projects, apply a bucket retention policy at the folder level using a custom organization policy.

Question 15

A small team is setting up a Google Cloud organization for their DevOps pipeline. They have zero existing projects. Their planned architecture uses Cloud Build for CI/CD, Cloud Source Repositories for code, and Artifact Registry for images. They want to ensure that developers can only deploy to the production environment after code review and approval. They also want to automatically trigger builds on commits to the main branch. Which of the following is the most efficient way to implement this?

Accepted Answer

Create separate Cloud Build triggers for development and production, and use manual approval steps in the production trigger.. It uses separate Cloud Build triggers for development and production, allowing the production trigger to include a manual approval step. This enforces that code review and approval occur before deployment to production, while the development trigger can automatically build on commits to the main branch. Cloud Build's approval gates are the native way to require human sign-off before executing a build, aligning with the requirement for controlled production deployments.

Answer

Use a single trigger and a build step that checks for a label in the commit to decide if deployment is allowed.

Answer

Use a Cloud Function to deploy code after a Pub/Sub message from a code review tool.

Answer

Set up a Cloud Build trigger on the main branch without any approval, and rely on code review outside Google Cloud.