PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 5 — 15 Questions

Question 1

A DevOps team is migrating their infrastructure to Google Cloud. They have a complex environment with multiple VPC networks, shared services, and separate development and production projects. They want to bootstrap a new organization that supports: (1) centralized network management with shared VPC, (2) separate folders for dev and prod, (3) consistent firewall rules across all projects, (4) a single Cloud NAT for outbound traffic. They have an existing on-premises VPN that must connect to all projects. What is the most efficient approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a host project for Shared VPC, attach all projects as service projects, and configure Cloud NAT and VPN in the host project. Use organization policies to enforce firewall rules.. Shared VPC allows you to create a host project that centrally manages network resources (VPC, subnets, firewall rules, Cloud NAT, VPN) while attaching development and production projects as service projects. This satisfies all requirements: centralized network management, separate folders for dev/prod, consistent firewall rules via organization policies, a single Cloud NAT for outbound traffic, and a single VPN connection to on-premises that routes to all service projects through the host project's VPC.

Answer

Create separate VPCs for each project and peer them all together, then configure Cloud NAT and VPN in each project.

Answer

Use a single project for all environments and rely on VPC subnets and firewall rules to isolate workloads.

Answer

Create a folder for networking and a folder for projects, then use a Cloud VPN appliance from the Marketplace.

Question 2

A large enterprise is bootstrapping a Google Cloud organization with strict security requirements. They need to: (1) enforce multi-factor authentication (MFA) for all users, (2) prevent any new project from using default VPCs, (3) require customer-managed encryption keys (CMEK) for all Cloud Storage buckets, (4) automatically revoke access for offboarded employees within 24 hours. They have an existing Active Directory and plan to use Google Cloud's Identity Platform for SSO. Which combination of Google Cloud services and policies should they implement?

Accepted Answer

Use Identity Platform with MFA enforced in OIDC, apply organization policy 'compute.skipDefaultNetworkCreation' and 'storage.cmekRequired', and use Cloud Audit Logs to detect offboarded users.. It uses Identity Platform with OIDC to enforce MFA via the existing Active Directory SSO, applies the organization policy 'compute.skipDefaultNetworkCreation' to prevent default VPCs, uses 'storage.cmekRequired' to enforce CMEK on Cloud Storage buckets, and leverages Cloud Audit Logs to detect offboarded users by monitoring identity changes, enabling automated revocation within 24 hours. This combination directly addresses all four requirements using native Google Cloud policies and services without custom code.

Answer

Configure MFA via organization policy, use a project creation Cloud Function to disable default VPC and enforce CMEK, and use a Cloud Scheduler job to scan for offboarded users daily.

Answer

Set up a Cloud VPN to Active Directory, use Cloud Run to enforce MFA, apply a custom organization policy for CMEK, and use Cloud Monitoring alerts for offboarding.

Answer

Use Cloud Identity with MFA, apply organization policy for default VPC and CMEK, and use Cloud Functions to deactivate IAM accounts offboarded in HR system via a custom integration.

Question 3

A startup is bootstrapping their Google Cloud organization with the following constraints: they have a small team of 10 developers, each with varying levels of expertise. They want a simple setup that allows developers to experiment in their own projects but prevents them from deleting production resources. They also want to enforce a budget limit on each project to avoid unexpected costs. The team has no prior Google Cloud experience and wants minimal operational overhead. Which of the following approaches best meets their needs?

Accepted Answer

Create a folder for production and a folder for development, assign developers Editor on dev projects and Viewer on prod, set budget alerts on both folders.. It establishes a clear separation of concerns using folders: a production folder with Viewer access (preventing deletion) and a development folder with Editor access (allowing experimentation). Budget alerts at the folder level enforce cost controls across all projects within each folder, minimizing operational overhead while meeting all constraints.

Answer

Use a single project with VPC Service Controls to isolate resources.

Answer

Create a single project for all developers, use budget alerts, and give everyone Owner role.

Answer

Create a project per developer, give them Owner role, and set a budget on each project.

Question 4

A government agency is bootstrapping a Google Cloud organization with strict compliance requirements. They must: (1) store all logs in a centralized project with retention of 7 years, (2) ensure no data leaves the United States, (3) use customer-managed encryption keys (CMEK) for all persistent disks and buckets, (4) automatically reject any resource creation outside allowed regions (us-central1 and us-east1). They have an existing on-premises SIEM that needs to receive logs via Pub/Sub. The network team wants to use Shared VPC. What is the correct order of steps to implement this?

Accepted Answer

Create folder hierarchy, set org policies for allowed regions and CMEK, configure aggregated log sink to centralized project, set up Shared VPC, and create Pub/Sub topic for SIEM.. It follows the recommended Google Cloud landing zone bootstrap order: first establish the folder hierarchy to apply organization policies (like constraints/compute.restrictResourceCreation and constraints/gcp.resourceLocations) and CMEK requirements at the correct level, then create the aggregated log sink to the centralized project with a 7-year retention bucket, set up Shared VPC for network isolation, and finally create the Pub/Sub topic for the SIEM. This sequence ensures that policies are inherited before resources are created, preventing non-compliant resource creation and ensuring logs are captured from the start.

Answer

Set up Pub/Sub for SIEM first, then create log sink, then apply org policies.

Answer

Create all projects first, then move them into folders, then apply org policies.

Answer

Create Shared VPC first, then set up org policies, then create log sink, then create folders.

Question 5

Refer to the exhibit. A DevOps engineer is bootstrapping a Google Cloud organization and wants to ensure that no Compute Engine VM instances can have external IP addresses. The engineer applies this Terraform configuration. What is the effect of this configuration on the organization?

Accepted Answer

It blocks external IP access for all VMs in all projects under the organization.. The Terraform configuration uses a Google Cloud Organization Policy constraint (`compute.vmExternalIpAccess`) set to `true` in a list policy with `deny` as the enforcement action. This blocks external IP access for all Compute Engine VM instances across all projects within the organization, as organization policies are inherited by all child projects unless overridden. The policy applies to both new and existing VMs, as it is enforced at the resource creation and modification level.

Answer

It requires a separate script to enforce the policy on existing VMs.

Answer

It blocks external IP access only for the first project created in the organization.

Answer

It blocks both internal and external IP access for all VMs.

Question 6

Your organization has just been created in Google Cloud. The security team wants to ensure that no service account keys can be created in any project under the organization, now or in the future. You have the Organization Administrator role. What should you do?

Accepted Answer

Create an organization policy constraint constraints/iam.disableServiceAccountKeyCreation with a deny rule and apply it at the organization node.. Organization policies are the only mechanism that can enforce preventive controls across all projects in an organization. The constraint constraints/iam.disableServiceAccountKeyCreation, when applied at the organization node, blocks the creation of service account keys for all principals, regardless of their IAM roles. This satisfies the requirement to prevent key creation now and in the future.

Answer

Use Cloud Asset Inventory to monitor for new service account keys and delete them automatically with a Cloud Function.

Answer

Create a custom IAM role that excludes the iam.serviceAccountKeys.create permission and assign it to all users.

Answer

Enable the IAM API and set a quota limit on service account key creation to zero for the organization.

Question 7

Your organization recently migrated to Google Cloud and you are bootstrapping it for DevOps. You need to ensure that all projects created under the 'production' folder automatically inherit a set of required labels for cost allocation and ownership. What should you do?

Accepted Answer

Create a custom constraint that requires specific labels, and apply it as an organization policy on the 'production' folder.. To enforce labels on new projects under a folder, you need a policy that denies project creation without the required labels. Custom constraints support this by validating resource fields. Organization policies based on custom constraints can be attached at the folder level, ensuring all child projects comply. This is the only option that actively enforces label presence rather than merely restricting or tagging.

Answer

Create an organization policy of type constraints/gcp.resourceLabels with an allowed list of label keys and values, and attach it to the 'production' folder.

Answer

Create a tag key and tag values, then attach the tag to the 'production' folder and use an organization policy with a condition to enforce the tag.

Answer

Create an organization policy of type constraints/gcp.resourceLocations with a condition to enforce labels.

Question 8

Your organization has a folder structure with 'Development', 'Staging', and 'Production' folders. You need to ensure that all projects in the 'Production' folder have the 'compute.instances.create' permission restricted to only a specific group of users. You want to enforce this consistently and prevent any project-level IAM changes from overriding it. What should you do?

Accepted Answer

Grant the Compute Instance Admin role (roles/compute.instanceAdmin.v1) to the specific group at the 'Production' folder level and remove any broader IAM grants on projects.. IAM policies are the appropriate mechanism to control which principals can perform actions. Granting the required role to the specific group at the 'Production' folder level ensures that the permission is inherited by all projects in that folder. By not granting broader roles at the project level, you prevent accidental expansion of access. This approach enforces the restriction consistently.

Answer

Use a custom organization policy constraint that denies the compute.instances.create permission for all principals except the specific group.

Answer

Create an organization policy constraint constraints/compute.restrictInstanceCreation and apply it to the 'Production' folder.

Answer

Set an IAM deny policy on the 'Production' folder that denies compute.instances.create for all principals, then grant the specific group an exception.

Question 9

Your organization is bootstrapping a new Google Cloud environment and you need to provision projects programmatically from a CI/CD pipeline running in Cloud Build. The pipeline must create projects inside a specific folder and attach them to a billing account. You want to avoid using a user account and minimize long-lived credentials. What should you do?

Accepted Answer

Create a service account in the seed project, grant it the Folder Admin and Billing Account User roles at the folder and billing account respectively, and use it as the Cloud Build service account with the cloud-platform OAuth scope.. Automating project creation from Cloud Build requires a service account with permissions to create projects in a folder and associate billing accounts. The Folder Admin role allows creating projects under a folder, and Billing Account User allows linking projects to a billing account. Using the Cloud Build service account with these roles avoids user credentials and follows least privilege.

Answer

Create a user account with the Project Creator role and store its credentials in Secret Manager, then have Cloud Build fetch and use them.

Answer

Use the default Compute Engine service account with the Editor role and rely on the metadata server for credentials.

Answer

Grant the Cloud Build service account the Organization Administrator role and let it create projects at the organization level.

Question 10

You are responsible for bootstrapping a new Google Cloud organization with a strict security posture. You need to ensure that all service accounts in the organization cannot be used to create keys, but you also need to allow a specific CI/CD pipeline in the 'dev' folder to create keys for a dedicated service account. What should you do?

Accepted Answer

Apply the organization policy constraints/iam.disableServiceAccountKeyCreation at the organization level, and then set a folder-level policy on the 'dev' folder to allow key creation for the specific service account.. Organization policies are hierarchical and can be overridden at lower levels. To allow a specific exception, you set a more permissive policy at the folder level. The organization-level policy denies all key creation, but the folder-level policy allows it for the 'dev' folder. This is the standard method to create exceptions. IAM alone cannot override organization policies.

Answer

Apply the organization policy constraints/iam.disableServiceAccountKeyCreation at the organization level, and then use IAM to grant the CI/CD pipeline the Service Account Key Admin role on the specific service account.

Answer

Apply the organization policy constraints/iam.disableServiceAccountKeyCreation at the organization level, and then create an exception for the 'dev' folder by using a policy tag.

Answer

Apply the organization policy constraints/iam.disableServiceAccountKeyCreation at the organization level, and then create a custom constraint that allows key creation only for the specific service account in the 'dev' folder.

Question 11

A platform team is bootstrapping a Google Cloud organization with Terraform. They want every new project created under the 'prod' folder to automatically receive a baseline set of IAM bindings, audit logging, and a budget alert, regardless of who creates it. Projects are created both by Terraform and manually by developers in the console. Which mechanism should the team implement to enforce this consistently?

Accepted Answer

Deploy an Eventarc trigger on the Cloud Resource Manager project creation event that runs a Cloud Run function to apply the baseline IAM, logging, and budget resources.. Enforcement that must cover every creation path, including manual console actions, requires an event-driven response rather than a voluntary template or an authorization-only control. Triggering automation from the project creation audit event ensures the baseline IAM bindings, logging configuration, and budget alerts are applied uniformly no matter how the project was created.

Answer

Use an organization policy with a custom constraint that blocks project creation outside the prod folder, and rely on that policy as the baseline configuration.

Answer

Grant developers roles/resourcemanager.projectCreator on the prod folder and rely on IAM Conditions to attach the baseline bindings at project creation time.

Answer

Write a Terraform module that developers must import into their own configurations, and document it in the internal developer portal.

Question 12

Your organization is bootstrapping Google Cloud for DevOps and wants to enforce that all Compute Engine instances in the 'production' folder have Shielded VM features enabled (vTPM and Integrity Monitoring). You need to ensure this is enforced automatically for all new instances. What should you do?

Accepted Answer

Create an organization policy of type constraints/compute.requireShieldedVm and apply it to the 'production' folder.. The predefined organization policy constraint constraints/compute.requireShieldedVm is designed to enforce Shielded VM features on Compute Engine instances. Applying it at the folder level ensures all projects under 'production' inherit the policy. This is the most direct and effective method, as it prevents non-compliant instances from being created.

Answer

Create a Cloud Function that monitors instance creation and enables Shielded VM features if missing.

Answer

Use a Terraform module to enable Shielded VM features on all instances and apply it via CI/CD.

Answer

Create a custom constraint that requires Shielded VM features and apply it as an organization policy on the 'production' folder.

Question 13

You are bootstrapping a shared services project that will host the organization's Terraform state and CI/CD runners. The security team requires that the CI/CD service accounts cannot be used from outside the corporate network and cannot persist beyond a defined session. Which two configurations should you implement? (Choose two.)

Accepted Answer

Configure VPC Service Controls with a service perimeter around the shared services project and add an access level requiring corporate network IP ranges, so service account calls from outside are denied.. The two requirements are network origin and bounded session lifetime. VPC Service Controls with an access level tied to corporate IP ranges enforces that calls originate from the approved network, while IAM conditions on request.time combined with short-lived credentials from the IAM Credentials API ensure the identity cannot persist beyond a defined window.

Answer

Apply an IAM Conditions attribute to the service account's IAM bindings using the access boundary or resource attribute so that requests must originate from the corporate network.

Answer

Set an organization policy with constraints/iam.serviceAccountKeyExpiryTime? No such constraint; instead use constraints/iam.disableServiceAccountKeyCreation to prevent key-based access.

Answer

Create an organization policy with constraints/iam.allowedPolicyMemberDomains to restrict which identities can be granted IAM roles in the organization.

Question 14

A platform team is bootstrapping a shared VPC for their DevOps organization. The host project resides in the 'network' folder and service projects reside in 'dev' and 'prod'. They want each service project's DevOps team to manage its own subnet-level firewall rules but not the shared network itself. What should they configure?

Accepted Answer

Grant each DevOps team the Compute Network User role on the host project and the Compute Security Admin role on their own service project.. In a Shared VPC, service project members need Compute Network User on the host project to consume shared subnets, and they need firewall management scoped to their own project. Compute Security Admin on the service project provides that scoped firewall control without granting the ability to alter the shared network. Together these roles meet the requirement while keeping the shared VPC itself under platform team control.

Answer

Grant each DevOps team the Compute Network Admin role on the host project so they can manage the shared VPC.

Answer

Grant each DevOps team the Compute Instance Admin role on the host project so they can manage instances and firewall rules together.

Answer

Grant each DevOps team the Compute Shared VPC Admin role on the organization so they can attach service projects themselves.

Question 15

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.. Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.

Answer

Use a user account for the CI/CD pipeline and assign it the necessary roles.

Answer

Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.

Answer

Generate a single service account key and securely distribute it to the CI/CD system.