PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. The DevOps team is trying to create a new service account key. The operation fails with a permission error. What is the most likely cause?

Accepted Answer

The organization policy prevents uploading service account keys.. The correct answer is C because organization policies can explicitly restrict the creation of service account keys at the organization, folder, or project level. When a key upload fails with a permission error despite the user having the necessary IAM roles, the most likely cause is an organization policy constraint such as `iam.disableServiceAccountKeyUpload` that blocks the operation. This policy overrides any IAM permissions granted to the user.

Answer

The project-level IAM denies the action.

Answer

The service account is disabled.

Answer

The service account lacks the iam.serviceAccountKeys.create permission.

Question 2

Refer to the exhibit. The Cloud Build fails with a permission error. The Cloud Build service account has roles/cloudbuild.builds.builder and roles/cloudfunctions.developer on the project. What is the missing permission?

Accepted Answer

cloudfunctions.functions.setIamPolicy. Option A is correct because the --allow-unauthenticated flag requires the cloudfunctions.functions.setIamPolicy permission to make the function publicly accessible. The roles/cloudfunctions.developer does not include this permission. Option B is wrong because cloudfunctions.functions.get is included in the developer role. Option C is wrong because iam.serviceAccounts.actAs is not needed for this deployment. Option D is wrong because cloudfunctions.functions.sourceCodes.set is part of the developer role.

Answer

cloudfunctions.functions.get

Answer

iam.serviceAccounts.actAs

Answer

cloudfunctions.functions.sourceCodes.set

Question 3

Refer to the exhibit. A DevOps engineer is trying to create a new project using the Cloud Console. The project creation fails with a policy violation. The engineer has permissions on folders/12345678 and folders/87654321 but not on any other folders. They select folder/87654321 as the parent. What is the most likely reason for the failure?

Accepted Answer

The policy requires the project parent to be one of the allowed folders, and folder/87654321 is not listed.. Option D is correct because the policy violation indicates that the organization has a constraint restricting which folders can be used as project parents. The engineer selected folder/87654321, but the policy explicitly lists only certain allowed folders, and folder/87654321 is not among them. This is a common organization policy (e.g., a list constraint) that enforces project creation only in approved folders, regardless of the engineer's IAM permissions on that folder.

Answer

The engineer is missing the resourcemanager.projects.create permission.

Answer

The policy is enforced at the organization level but the engineer's IAM role does not allow creating projects in that folder.

Answer

The policy is set at the folder level, and folder/87654321 has a different policy.

Question 4

A company is setting up a new Google Cloud organization. They want to ensure that all projects inherit common IAM policies. What is the best practice?

Accepted Answer

Apply IAM policies at the organization level.. Applying policies at the organization level ensures all projects and folders inherit them, providing consistent enforcement and reducing administrative overhead.

Answer

Apply IAM policies at the folder level.

Answer

Apply IAM policies at the project level.

Answer

Use multiple organizations to isolate policies.

Question 5

A company uses Cloud Build for CI/CD. They want to allow Cloud Build to deploy to Cloud Run. What is the minimum IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs permission to create and manage Cloud Run resources, including deploying new revisions. The `roles/run.admin` role provides full control over Cloud Run services, which is the minimum required for deployment. The `roles/cloudbuild.builds.builder` role only allows building and managing Cloud Build triggers, not deploying to Cloud Run.

Answer

roles/cloudbuild.builds.builder

Answer

roles/editor

Answer

roles/run.invoker

Question 6

A company wants to enforce that all projects in the organization have a specific VPC Service Controls perimeter. What is the most efficient way to achieve this?

Accepted Answer

Use folder-level VPC Service Controls perimeters.. Folder-level VPC Service Controls perimeters allow you to apply a single perimeter configuration to all projects within a folder, ensuring consistent enforcement across the organization without needing to configure each project individually. This is the most efficient method because it leverages the resource hierarchy to inherit the policy, reducing administrative overhead and preventing misconfigurations.

Answer

Use project-level VPC Service Controls perimeters.

Answer

Use organization policies to set the perimeter.

Answer

Use a custom script to monitor and alert on non-compliant projects.

Question 7

Which tool is recommended for managing the initial setup of a Google Cloud organization, including creating folders, projects, and IAM policies in an automated and repeatable manner?

Accepted Answer

Terraform. Terraform is the recommended tool for bootstrapping a Google Cloud organization because it is declarative, idempotent, and supports infrastructure-as-code (IaC) for creating folders, projects, and IAM policies in an automated and repeatable manner. Unlike Google Cloud's Deployment Manager, Terraform is cloud-agnostic and has a mature provider (hashicorp/google) that directly manages organization-level resources such as google_folder, google_project, and google_organization_iam_member. This aligns with DevOps best practices for version-controlled, reproducible infrastructure provisioning.

Answer

Deployment Manager

Answer

Cloud Console

Answer

gcloud command line

Question 8

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the roles/run.admin role.. The Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) requires the roles/run.admin role to deploy to Cloud Run. This role grants permission to create, update, and manage Cloud Run services. Without it, the deployment step fails with a 'Permission denied' error, even though the build itself succeeds.

Answer

The Cloud Run service account lacks the roles/cloudbuild.builds.builder role.

Answer

The trigger is missing the required deployment configuration.

Answer

The cloudbuild.yaml file has an incorrect image tag.

Question 9

A company is bootstrapping their organization using Terraform and wants to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which of the following is the best practice for securing the state file?

Accepted Answer

Use a bucket with a CMEK key and grant roles/storage.objectAdmin to the Terraform service account.. Option C is correct because using a CMEK (Customer-Managed Encryption Key) ensures the state file is encrypted at rest with a key controlled by the organization, and granting roles/storage.objectAdmin to the Terraform service account provides the necessary read, write, and delete permissions on objects. This combination meets the security requirements for a bootstrapping scenario where the state file contains sensitive infrastructure configuration and must be protected from unauthorized access while allowing Terraform to manage it.

Answer

Use a bucket with fine-grained access and grant roles/storage.objectCreator to the Terraform service account.

Answer

Use a bucket with object versioning and enable VPC Service Controls.

Answer

Use a bucket with uniform access and grant roles/storage.objectViewer to the Terraform service account.

Question 10

A DevOps engineer needs to assign IAM roles at the organization level. Which built-in role is specifically designed for managing IAM policies across the organization?

Accepted Answer

roles/iam.securityAdmin. The role `roles/iam.securityAdmin` is the built-in IAM role specifically designed for managing IAM policies across the organization. It grants permissions to get and set IAM policies at the organization, folder, and project levels, without granting other resource management permissions. This makes it the correct choice for a DevOps engineer who needs to assign IAM roles organization-wide.

Answer

roles/resourcemanager.organizationAdmin

Answer

roles/owner

Answer

roles/editor

Question 11

A company uses Cloud Build to deploy applications and wants to ensure that builds from forked repositories cannot access sensitive environment variables. What is the best practice?

Accepted Answer

Use Cloud Build's 'encrypted variables' and mark them as 'not available for pull requests from forks'.. Option B is correct because Cloud Build allows you to mark encrypted variables as 'not available for pull requests from forks', which prevents forked PRs from accessing sensitive environment variables. This is the most direct and secure method to protect secrets in CI/CD pipelines involving external contributions.

Answer

Disable builds from forks entirely.

Answer

Use Cloud Build's 'substitutions' instead of environment variables.

Answer

Use Cloud Build's 'secrets' manager instead of environment variables.

Question 12

A company wants to enforce that all service accounts are created with a specific naming convention (e.g., prefix 'sa-'). What is the most efficient way to enforce this?

Accepted Answer

Use a Cloud Function that monitors and remediates non-compliant service accounts.. Option B is correct because a Cloud Function can be triggered by a Pub/Sub notification on the `google.cloud.audit.log.v1.activityLog` topic for `google.iam.admin.v1.CreateServiceAccount` events. The function can immediately delete or disable non-compliant service accounts that do not match the 'sa-' prefix, providing automated enforcement without blocking legitimate creation attempts. This approach is event-driven and avoids the latency or complexity of periodic scanning.

Answer

Use a custom role that restricts service account creation to users who follow the naming convention.

Answer

Use an organization policy constraint with a condition on the service account name.

Answer

Use a folder-level attribute with a policy on service account names.

Question 13

Which TWO are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose two.)

Accepted Answer

Use separate service accounts for each environment.. Option A is correct because using separate service accounts for each environment enforces the principle of least privilege, ensuring that credentials used in development cannot accidentally or maliciously affect production resources. This isolation aligns with Google Cloud's IAM best practices, where each service account should have only the permissions necessary for its specific environment, reducing the blast radius of a compromised account.

Answer

Create a single service account for all environments to simplify permissions.

Answer

Disable audit logging to reduce costs.

Question 14

Which THREE are valid methods to enforce resource location restrictions in a Google Cloud organization? (Choose three.)

Accepted Answer

Use VPC Service Controls to limit resource access to specific regions.. Option A is correct because VPC Service Controls allow you to define perimeters that restrict resource access based on attributes such as region, preventing data exfiltration and ensuring resources are only accessible from allowed locations. This is a dedicated security feature that enforces location restrictions at the network level, complementing organization policies.

Answer

Use folder-level IAM policies to restrict locations.

Answer

Use Cloud Audit Logs to detect and alert on resources created in non-compliant locations.

Question 15

Which THREE are required steps when setting up a CI/CD pipeline with Cloud Build for the first time? (Choose three.)

Accepted Answer

Enable the Cloud Build API.. Option B is correct because the Cloud Build API must be enabled in your Google Cloud project before you can use any Cloud Build features, including triggers and builds. Without enabling the API, Cloud Build services are unavailable, and any attempt to create or run builds will fail with an API not found error.

Answer

Create a custom base image for builds.

Answer

Set up a Cloud Router for network connectivity.