PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 6 — 15 Questions

Question 1

A DevOps team is setting up a Google Cloud organization. They want to centralize logging and monitoring across all projects. What is the recommended approach?

Accepted Answer

Create a dedicated project for logging and monitoring, and configure all other projects to send logs and metrics to that project.. The recommended approach for centralizing logging and monitoring in a Google Cloud organization is to create a dedicated project that acts as a log sink and metric aggregator. By configuring aggregated sinks at the organization or folder level, all projects automatically forward logs to the dedicated project's Cloud Logging bucket, and metrics can be collected via the Monitoring API. This ensures a single pane of glass for operations without manual per-project setup.

Answer

Enable logging and monitoring in each project individually and use the Cloud Console to view them.

Answer

Enable Cloud Audit Logs in the organization and view them from the Organization level.

Answer

Use Stackdriver (now Operations) to aggregate logs from all projects automatically.

Question 2

Which THREE actions should be taken to ensure compliance with the principle of least privilege when bootstrapping a Google Cloud organization? (Choose 3)

Accepted Answer

Use service accounts for automated processes and grant them the minimum required roles.. Option A is correct because service accounts are the recommended identity type for automated processes, and granting them only the minimum required roles directly enforces least privilege by avoiding broad, human-oriented permissions. Option B is correct because custom roles let you define an exact permission set, so identities receive only the specific permissions they need rather than the broader set bundled into predefined roles. Option C is correct because granting roles at the project level (or lower, such as folder or resource level) scopes permissions to the smallest necessary blast radius instead of granting organization-wide access. Option D is not correct because assigning the Owner role at the organization level grants extensive, broad permissions that violate least privilege, even if limited to a small group. Option E is not correct because primitive roles (Owner, Editor, Viewer) are coarse-grained and include far more permissions than most identities require, contradicting least privilege.

Answer

Assign the Owner role at the organization level to a small group of administrators.

Answer

Use primitive roles (Owner, Editor, Viewer) to simplify management.

Question 3

Which TWO are benefits of using a shared VPC in a Google Cloud organization? (Choose 2)

Accepted Answer

Centralized management of network resources.. Option A is correct because a shared VPC lets the host project's network administrators manage subnets, firewall rules, routes, and other network resources centrally, so all attached service projects consume a single, consistently governed network instead of each maintaining its own VPC. Option D is correct because shared VPC cleanly separates duties: network admins operate in the host project with roles like Compute Network Admin, while project admins in service projects use roles such as Compute Instance Admin to deploy resources without controlling the underlying network. Option B is wrong because service project users still require IAM roles (for example, Compute Instance Admin or predefined Shared VPC roles) to create and use resources in the shared network. Option C is wrong because shared VPC does not by itself guarantee compliance with organizational policies; that is the role of Organization Policy Service constraints and related controls. Option E is wrong because enabling APIs in service projects is not automatic — required APIs such as compute.googleapis.com must be enabled explicitly in each project.

Answer

Eliminates the need for project administrators to have any IAM roles.

Answer

Ensures compliance with organizational policies.

Answer

Automatically enables required APIs in all service projects.

Question 4

You are a DevOps engineer tasked with bootstrapping a Google Cloud organization for a company that develops a SaaS product. The company has three teams: Platform, Application, and Data. Each team needs to manage their own projects, but the network should be centrally managed. You decide to use a shared VPC. You create a host project 'shared-vpc-host' and attach three service projects: 'platform-service', 'app-service', and 'data-service'. You grant the Network Admin role to the Platform team for the host project. The Application team needs to deploy Compute Engine instances in their service project, but they should not be able to modify network resources. You grant them the Compute Instance Admin role at the service project level. However, the Application team reports that they cannot create instances because they don't have permission to use the subnets in the shared VPC. What is the most likely missing step?

Accepted Answer

Grant the Application team the Compute Network User role on the host project or the specific subnets.. The Application team needs the Compute Network User role (roles/compute.networkUser) on the host project or the specific subnets to use the shared VPC subnets. This role allows them to attach instances to existing subnets without granting permission to modify network resources. Granting it at the service project level (Option B) is insufficient because the subnet permissions are inherited from the host project in a shared VPC setup.

Answer

Grant the Application team the Compute Network Admin role on the host project.

Answer

Grant the Application team the Compute Network User role on the service project.

Answer

Grant the Application team the roles/compute.subnetUser on the subnet.

Question 5

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Option C is correct because hosting shared CI/CD tooling and artifacts (e.g., Cloud Build, Artifact Registry, or Jenkins) in a dedicated project isolates build infrastructure from workload projects, enabling centralized access control, quota management, and auditing while keeping pipelines reusable across the organization. Option D is correct because Organization Policies (e.g., constraints like constraints/iam.disableServiceAccountKeyCreation or constraints/compute.requireShieldedVm) provide guardrails that enforce compliance and security baselines consistently across all projects, which is essential for a scalable DevOps foundation. Option A is wrong because sharing a single service account key across projects violates least privilege, prevents per-project auditability, and creates a single point of compromise; keys should be scoped per workload and preferably replaced with workload identity federation. Option B is wrong because disabling Organization Policies removes the guardrails that prevent insecure or non-compliant configurations, increasing risk rather than enabling safe DevOps. Option E is wrong because a single broadly-permissioned service account used by all projects violates least privilege and blast-radius containment, and Google recommends distinct, narrowly scoped service accounts per project or workload.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 6

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Accepted Answer

Enable audit logging and set up log sinks to a centralized logging project.. Option B is correct because enabling Cloud Audit Logs (Admin Activity, Data Access, and System Event logs) and configuring aggregated log sinks to a centralized logging project gives the organization a tamper-resistant, single pane for security monitoring, compliance, and incident response across all projects. Option C is correct because a Shared VPC lets a host project export subnets to service projects, providing centralized network administration, consistent firewall and routing policies, and private connectivity between DevOps projects without complex VPC peering meshes. Option D is correct because a folder hierarchy that mirrors the organizational structure (for example, folders per department, environment, or team) enables inheritance of IAM policies, org policies, and billing controls, which is fundamental to scalable DevOps governance. Option A is not recommended because sharing one project across development, staging, and production removes environment isolation, causing IAM, quota, and blast-radius problems; separate projects per environment are the Google-recommended pattern. Option E is wrong because storing secrets in code repositories exposes credentials to anyone with repo access and to history leaks; secrets should be kept in Secret Manager (or similar) and injected at runtime.

Answer

Use a single project for development, staging, and production to reduce overhead.

Answer

Store secrets directly in code repositories for easy access by CI/CD pipelines.

Question 7

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

Accepted Answer

Cloud Asset Inventory can be used to discover all resources in the organization.. Option B is correct because Cloud Asset Inventory provides a centralized, organization-wide view of all Google Cloud resources and their metadata, making it the right tool to discover and inventory resources across every project in the organization during bootstrapping. Option E is correct because organization policies are hierarchical constraints that can be set at the organization, folder, or project level, with child nodes inheriting and able to further restrict (but not loosen) the parent policy, which is essential for enforcing governance as the org scales. Option A is wrong because enabling the cloudresourcemanager.googleapis.com API does not automatically apply any organization policies; policies must be explicitly defined and attached. Option C is wrong because projects do not automatically share a default VPC network — each project gets its own default network (or none), and shared VPC must be configured deliberately. Option D is wrong because Admin Activity audit logs are enabled by default and always on, while Data Access logs are the ones disabled by default and must be explicitly enabled per service.

Answer

After enabling the cloudresourcemanager.googleapis.com API, organization policies are automatically applied.

Answer

All projects in an organization automatically share a default VPC network.

Answer

Cloud Audit Logs are disabled by default and must be enabled for each service.

Question 8

A startup wants to implement infrastructure as code for their Google Cloud environment to ensure reproducibility. They are using Terraform and want to manage state securely. What is the recommended approach?

Accepted Answer

Store Terraform state in a Cloud Storage bucket with object versioning enabled.. Storing Terraform state in a Cloud Storage bucket with object versioning enabled is the recommended approach because it provides a centralized, remote backend that supports state locking (via Cloud Storage's object lease mechanism) and version history for rollback. This ensures consistency across team members and protects against state corruption or accidental deletion, aligning with infrastructure as code best practices for reproducibility.

Answer

Store Terraform state in a file in Cloud Shell home directory.

Answer

Store Terraform state in Cloud Source Repositories as a YAML file.

Answer

Store Terraform state locally on each developer's machine and use git to sync.

Question 9

A DevOps team wants to automate the deployment of a microservice application to Google Kubernetes Engine (GKE) using Cloud Build. They have a Cloud Build configuration file that builds a container image and deploys it to GKE. However, the deployment step fails with an authorization error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Kubernetes Engine Developer IAM role.. Cloud Build uses a default service account (the Cloud Build service account) to execute build steps, including deploying to GKE. The Kubernetes Engine Developer IAM role (roles/container.developer) grants the necessary permissions to deploy and manage workloads on GKE clusters. Without this role, the Cloud Build service account cannot authenticate to the GKE cluster's Kubernetes API, resulting in an authorization error during the deployment step.

Answer

The user triggering the build does not have IAM permissions to deploy to GKE.

Answer

Cloud Build does not have permission to access the source code repository.

Answer

The Docker image build step failed due to missing dependencies.

Question 10

Arrange the steps to set up a Google Cloud Monitoring alerting policy for a Compute Engine instance.

Accepted Answer

Create notification channel, then define condition, set evaluation parameters, attach the channel, then save.. First create a notification channel, then define the condition, set evaluation parameters, attach the channel, and save.

Answer

Save, then attach the channel, set evaluation parameters, define condition, then create notification channel.

Answer

Define condition, then create notification channel, attach the channel, set evaluation parameters, then save.

Answer

Create notification channel, set evaluation parameters, define condition, attach the channel, then save.

Question 11

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Accepted Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Define delivery pipeline → Step 4: Push code → Step 5: Promote. The correct order for setting up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service begins with creating a build configuration file (cloudbuild.yaml) that specifies how to build and test the application. Next, you set a trigger (e.g., on push to a branch) in Cloud Build to automatically start builds. Then, you define a delivery pipeline in Cloud Deploy with targets (e.g., staging, production) and approval gates. After that, you push code to the repository, which triggers the build and, if successful, creates a release in the delivery pipeline. Finally, you promote the release through the stages (e.g., from staging to production) either automatically or after manual approval. This order ensures each prerequisite is in place before the next step, enabling a seamless automated workflow.

Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Push code → Step 4: Define delivery pipeline → Step 5: Promote

Answer

Step 1: Define delivery pipeline → Step 2: Create build config → Step 3: Set trigger → Step 4: Push code → Step 5: Promote

Answer

Step 1: Push code → Step 2: Create build config → Step 3: Set trigger → Step 4: Define delivery pipeline → Step 5: Promote

Question 12

Order the steps to set up a log-based metric in Cloud Logging for error tracking.

Accepted Answer

Filter logs -> Create metric -> Set alert -> Test -> Verify. The correct sequence to set up a log-based metric in Cloud Logging for error tracking is: first, filter logs to isolate relevant entries; second, create a metric based on that filter; third, set an alert to trigger on metric conditions; fourth, test the alert to ensure it works; and finally, verify the setup. This order ensures each step builds logically on the previous one.

Answer

Create metric -> Filter logs -> Set alert -> Test -> Verify

Answer

Filter logs -> Set alert -> Create metric -> Test -> Verify

Answer

Filter logs -> Create metric -> Test -> Set alert -> Verify

Question 13

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud Build: Continuous integration/continuous delivery platform. The correct matches are: Cloud Build for CI/CD, Cloud Source Repositories for Git hosting, Cloud Functions for event-driven serverless functions, and Cloud Run for serverless containers. Common confusions include swapping the purposes of Cloud Build and Cloud Source Repositories.

Answer

Cloud Build: Private Git repository hosting

Answer

Cloud Source Repositories: Continuous integration/continuous delivery platform

Question 14

Match each Cloud Monitoring metric type to its description.

Accepted Answer

Gauge: A metric that measures a value at a specific point in time.. The correct matches are: Gauge measures a point-in-time value, Cumulative measures accumulated value over time, and Delta measures rate of change. Common confusions include swapping definitions between gauge and cumulative, or misunderstanding delta as cumulative.

Answer

Gauge: A metric that measures an accumulated value over time.

Answer

Cumulative: A metric that measures a value at a specific point in time.

Answer

Delta: A metric that measures an accumulated value over time.

Question 15

A company is bootstrapping a Google Cloud organization. They have created a Shared VPC host project. They want to allow a service project's default compute service account to launch instances that use the Shared VPC's subnets. Which IAM role should be granted to that service account at the host project level?

Accepted Answer

roles/compute.networkUser. The `roles/compute.networkUser` role grants a service account the necessary permissions to use the subnets of a Shared VPC host project. Specifically, this role includes the `compute.subnetworks.use` permission, which allows the service account to launch instances in the host project's subnets without granting broader network management rights.

Answer

roles/compute.xpnAdmin

Answer

roles/compute.securityAdmin

Answer

roles/compute.networkAdmin