PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 5 — 15 Questions

Question 1

A startup is bootstrapping a Google Cloud organization for DevOps. They need to create a project for their CI/CD tooling and a separate project for logging and monitoring. What is the recommended way to structure the resource hierarchy?

Accepted Answer

Create a folder called 'DevOps' and place both projects inside it, sharing a billing account.. Option D is correct because the recommended Google Cloud resource hierarchy for DevOps bootstrapping is to create a folder (e.g., 'DevOps') under the organization node and place both projects inside it. This structure allows centralized policy inheritance (e.g., IAM, org policies) and shared billing via a single billing account, while maintaining logical separation between CI/CD and logging/monitoring workloads. It aligns with Google's best practices for multi-project isolation without unnecessary organizational complexity.

Answer

Create a single project for all workloads and use labels to differentiate environments.

Answer

Create both projects directly under the organization node, with separate billing accounts.

Answer

Create a separate organization for each project to ensure isolation.

Question 2

A DevOps engineer is setting up a Cloud Build trigger that builds a container image and deploys it to Cloud Run. The build fails with a permission error when trying to access resources in a different project. The engineer has created a service account in the project where Cloud Build runs and granted it roles/run.admin and roles/storage.objectViewer on the target project. What is the most likely cause of the failure?

Accepted Answer

The Cloud Build service account lacks the iam.serviceAccounts.actAs permission on the Cloud Run runtime service account.. The error occurs because Cloud Build needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account to impersonate it when deploying the container. Even though the custom service account has `roles/run.admin` and `roles/storage.objectViewer` on the target project, without the `actAs` permission, Cloud Build cannot assume the runtime service account's identity to push the image and deploy the revision. This permission is typically granted via `roles/iam.serviceAccountUser` on the runtime service account itself.

Answer

The service account has been deleted or disabled.

Answer

Cloud Build’s default compute engine service account is being used instead of the custom one.

Answer

The service account must be created in the target project instead of the source project.

Question 3

A large enterprise is migrating to Google Cloud and wants to bootstrap their organization for DevOps. They have multiple business units, each needing their own folder with projects. Security requires that all projects in the 'prod' folder must have a specific set of organization policies enforced, such as restricting service account key creation. They also want to allow individual teams to create project-level policies as long as they don't conflict with the organization policies. Which approach ensures this while minimizing administrative overhead?

Accepted Answer

Set the required organization policies on the 'prod' folder and allow teams to set additional policies at the project level as long as they don't conflict.. Option A is correct because Google Cloud Organization Policies can be set at the folder level, allowing the 'prod' folder to inherit constraints like `iam.disableServiceAccountKeyCreation` across all its projects. Teams can then add additional project-level policies that are more restrictive, as long as they do not conflict with the inherited folder-level policies, which is enforced by the policy hierarchy. This minimizes administrative overhead by centralizing mandatory controls at the folder level while delegating flexibility to teams.

Answer

Set organization policies at the organization level and use IAM conditions to apply them only to the prod folder.

Answer

Create custom roles containing the required constraints and assign them to the team's IAM members.

Answer

Place all production workloads in a single project and use VPC Service Controls for security.

Question 4

A DevOps team is bootstrapping their Google Cloud organization and wants to enable Infrastructure as Code (IaC) using Terraform. They need a service account that Terraform can use to create and manage resources across multiple projects. What is the best practice for creating and managing this service account?

Accepted Answer

Create a service account in a separate 'admin' project and grant it the required roles on each project via IAM.. Option A is correct because creating a service account in a dedicated 'admin' project and granting it necessary roles across projects is a common pattern. Option B is wrong because the default service account has too many permissions and is not recommended. Option C is wrong because service account keys should be avoided in source control. Option D is wrong because using a user account is not secure for automation.

Answer

Generate a service account key and store it in a Cloud Storage bucket accessible to the team.

Answer

Use a user account with two-factor authentication for Terraform automation.

Answer

Use the Compute Engine default service account from the project where Terraform runs.

Question 5

During bootstrapping, a DevOps engineer wants to ensure that all new projects automatically have a set of APIs enabled, such as Cloud Resource Manager API and Cloud Billing API. They also want to enforce that certain APIs cannot be disabled accidentally. What is the most efficient way to achieve this?

Accepted Answer

Use organization policies to define the constraints 'compute.requireOsLogin' and 'serviceuser.services' to restrict/enable APIs.. Option C is correct because organization policies in Google Cloud allow you to enforce constraints at the organization, folder, or project level. The `serviceuser.services` constraint can be used to specify a list of APIs that must be enabled (or cannot be disabled) on all projects under the policy scope, ensuring compliance without manual intervention or additional infrastructure.

Answer

Use a custom Cloud Function that runs every time a project is created and enables the APIs.

Answer

Grant the roles/serviceusage.serviceUsageAdmin role to the DevOps team and have them manually enable APIs when creating projects.

Answer

Create a folder with a 'Required APIs' setting that applies to all child projects.

Question 6

An organization is bootstrapping their Google Cloud environment and wants to implement a shared VPC for DevOps workloads. The network team manages the host project, while DevOps teams have service projects. They need to ensure that DevOps teams can create resources in their service projects that use the shared VPC, but they cannot change the host project's network configuration. Which IAM roles should be granted to the DevOps team's service account on the host project?

Accepted Answer

roles/compute.networkUser. The DevOps team needs to use the shared VPC's resources (e.g., subnets) from their service projects without modifying the host project's network configuration. The `roles/compute.networkUser` role grants permission to use existing networks and subnets in the host project, but not to create, modify, or delete them. This aligns with the principle of least privilege for a shared VPC setup.

Answer

roles/compute.securityViewer

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Question 7

A company is bootstrapping a Google Cloud organization for the first time. They want to set up Cloud Identity to manage users and groups. What is the correct order of steps?

Accepted Answer

Sign up for Cloud Identity, create the Google Cloud organization node, add users and groups, then enable Google Cloud services and set up billing.. Option B is correct because Cloud Identity is the foundation for managing users and groups in a Google Cloud organization. You must first sign up for Cloud Identity to create the identity realm, then create the organization node (which requires a Cloud Identity account), add users and groups, and finally enable services and set up billing. This order ensures that the organization node is linked to the correct Cloud Identity tenant and that users exist before they are granted access to resources.

Answer

Add users and groups directly in Google Cloud without Cloud Identity.

Answer

Create the organization node first, then sign up for Cloud Identity, then add users.

Answer

Create the organization node, set up billing, then add Cloud Identity.

Question 8

During bootstrapping, a DevOps lead wants to ensure that all projects in the 'dev' folder have a consistent set of VPC firewall rules and network policies. They are considering using a shared VPC or VPC Network Peering. Which approach provides the most control and consistency for DevOps teams while minimizing administrative overhead?

Accepted Answer

Implement a shared VPC with a host project managed by the network team, and allow DevOps teams to use subnets in their service projects.. A shared VPC with a host project managed by the network team provides centralized control over VPC firewall rules and network policies, ensuring consistency across all service projects in the 'dev' folder. This approach minimizes administrative overhead because DevOps teams can create subnets in their service projects without needing to manage network infrastructure, while the network team enforces a uniform security posture.

Answer

Use VPC Service Controls to define perimeters for each project.

Answer

Create a separate VPC in each project and use Cloud VPN to connect them.

Answer

Use VPC Network Peering between all projects to allow connectivity.

Question 9

A multinational corporation is bootstrapping a Google Cloud organization with multiple subsidiaries. Each subsidiary needs its own folder with IAM policies that are managed locally, but the parent company wants to enforce a global policy that restricts the use of certain machine types (e.g., N2D) for cost control. However, one subsidiary has a legitimate need for those machine types in a specific project. What is the best way to handle this exception while maintaining the global policy?

Accepted Answer

Create a custom organization policy with a condition that excludes the exception project from the restriction.. Option B is correct because custom organization policies with conditions can selectively exclude projects from certain restrictions. Option A is wrong because standard machine type constraints do not support per-project whitelists. Option C is wrong because it does not enforce the global policy across subsidiaries. Option D is wrong because it only audits, not enforces.

Answer

Set an organization policy that denies N2D machine types, then create a separate policy at the project level to allow them for the exception project.

Answer

Use an audit-only policy and rely on a team to review and approve machine type usage.

Answer

Place each subsidiary in its own folder and set the machine type restriction only on folders that require it.

Question 10

Which TWO of the following are best practices when bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Create separate projects for development, staging, and production environments.. Option B is correct because creating separate projects for development, staging, and production environments enforces resource isolation, simplifies IAM policy management, and aligns with Google Cloud's recommended multi-project architecture for DevOps. This approach allows you to apply distinct organization policies, budgets, and monitoring per environment, reducing the risk of accidental changes to production.

Answer

Use the default Compute Engine service account for all DevOps automation.

Answer

Create a service account in each project that needs it, rather than a central admin project.

Answer

Set organization policies only at the project level, not at the folder or organization level.

Question 11

Which TWO of the following are required steps to set up a shared VPC for DevOps teams?

Accepted Answer

Attach the service projects to the host project.. Option A is correct because attaching service projects to the host project is a mandatory step in Shared VPC setup. After designating the host project and enabling Shared VPC, you must attach each service project to the host project so that the service projects can consume subnets from the host project's VPC. Without this attachment, the service projects cannot use the shared networking resources.

Answer

Create a new VPC in the service project and peer it with the host project.

Answer

Configure Cloud Interconnect between the host and service projects.

Answer

Grant the Shared VPC Admin role (roles/compute.xpnAdmin) to the service project team.

Question 12

Which THREE of the following are valid considerations when using organization policies to enforce compliance in a DevOps environment?

Accepted Answer

Child-level organization policies can only add more restrictions, not remove restrictions set by a parent.. Option A is correct because organization policies follow a hierarchical inheritance model where child policies can only impose additional restrictions (i.e., they are more restrictive) than the parent policy. This is enforced by the Google Cloud Resource Manager hierarchy, ensuring that a policy set at the organization level cannot be relaxed by a folder or project policy.

Answer

An organization policy must be enabled by a service agent before it can be used.

Answer

IAM conditions can be used to override an organization policy for specific resources.

Question 13

A company is bootstrapping a new Google Cloud organization for DevOps. They want to separate development, staging, and production environments using folders. Which folder structure follows Google-recommended best practices?

Accepted Answer

Create folders under the Organization node: Development, Staging, Production. Place all projects in the appropriate folder.. Option D is correct because Google Cloud best practices recommend creating top-level folders under the Organization node for each environment (Development, Staging, Production) to enforce consistent policy inheritance and resource isolation. This structure allows you to apply organization policies and IAM roles at the environment level, ensuring that production resources are strictly separated from development and staging resources, which is critical for compliance and security.

Answer

Create a single folder called 'Environments' with subfolders Dev, Staging, Prod, and place projects in the subfolders.

Answer

Create a folder for each team, then subfolders for environments (e.g., Team1/Dev, Team1/Prod).

Answer

Use labels on projects to denote environment (e.g., env=dev) instead of folders.

Question 14

A DevOps engineer is trying to create a service account key for a CI/CD pipeline, but receives the error: 'Constraint constraints/iam.disableServiceAccountKeyCreation violated'. What is the most likely cause and solution?

Accepted Answer

The Organization Policy prevents key creation; the engineer needs to request an exception from the security team.. The error 'Constraint constraints/iam.disableServiceAccountKeyCreation violated' indicates that an Organization Policy with the constraint `iam.disableServiceAccountKeyCreation` is enforced at the organization, folder, or project level. This policy explicitly blocks the creation of service account keys, which is why the engineer cannot generate a key for the CI/CD pipeline. The correct solution is to request an exception from the security team, who can either remove the policy or add the engineer's project to an exemption list.

Answer

The Cloud Resource Manager API is disabled; enable it.

Answer

The project does not have billing enabled; enable billing.

Answer

The service account has been deleted; the engineer must recreate it.

Question 15

A large enterprise is designing a centralized DevOps platform across multiple business units. They want to use a shared CI/CD pipeline that deploys to projects in different folders. Which approach ensures secure, auditable deployments while minimizing IAM administration?

Accepted Answer

Use a cross-project service account in the CI/CD project with required roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM.. Option A is correct because a cross-project service account in the CI/CD project, granted the necessary roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM, allows the shared pipeline to deploy resources across folders without duplicating service accounts. This centralizes IAM administration, ensures auditability through a single identity, and follows the principle of least privilege by granting only required roles on target projects.

Answer

Use Cloud Build triggers directly in each target project with separate code repositories.

Answer

Grant the Cloud Build Editor role to all developers across projects to allow them to create pipelines.

Answer

Create a separate service account in each target project with the Cloud Build service agent role, and use impersonation from the CI/CD project.