PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 6 — 15 Questions

Question 1

To securely manage secrets (e.g., API keys) used in Cloud Build pipelines, which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the recommended service for storing and accessing secrets like API keys. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not designed for secrets, and Cloud KMS is not for direct secret storage.

Answer

Cloud KMS

Answer

Cloud Key Management Service (duplicate)

Answer

Cloud Storage

Question 2

A Cloud Build pipeline fails with 'Permission denied' when trying to pull a Docker image from Artifact Registry in the same project. The Cloud Build service account has the Artifact Registry Reader role. What additional configuration is likely missing?

Accepted Answer

The Artifact Registry repository has a VPC-SC perimeter blocking access.. The Cloud Build service account has the Artifact Registry Reader role, which grants permission to read (pull) images. However, if the Artifact Registry repository is inside a VPC Service Controls (VPC-SC) perimeter, the service account must also be explicitly added to the perimeter's allowed identities or the request must originate from within the perimeter. Without this, VPC-SC blocks all API calls from outside the perimeter, resulting in a 'Permission denied' error despite valid IAM roles.

Answer

Cloud Build needs to be enabled in the Artifact Registry region.

Answer

The Docker image tag is incorrect.

Answer

The service account needs the Artifact Registry Writer role as well.

Question 3

When bootstrapping a new Google Cloud organization for DevOps, which set of initial IAM roles should be assigned to the DevOps team to enable them to create and manage projects, folders, and billing accounts?

Accepted Answer

Project Creator, Billing Account User, Organization Policy Administrator. The DevOps team needs the Project Creator role to create new projects, the Billing Account User role to link billing accounts to those projects, and the Organization Policy Administrator role to set organization-wide policies that control resource constraints. These three roles together provide the minimum necessary permissions for bootstrapping a Google Cloud organization without granting excessive administrative privileges.

Answer

Folder Admin, Billing Admin, Security Reviewer

Answer

Org Admin, Project Creator, Billing Admin

Answer

Project Creator, Billing Admin, Folder Admin

Question 4

Which Google Cloud service provides a fully managed, private Git repository that integrates with Cloud Build for continuous integration?

Accepted Answer

Cloud Source Repositories. Cloud Source Repositories is the correct answer because it provides fully managed, private Git repositories hosted on Google Cloud. It integrates natively with Cloud Build, enabling automatic triggers for continuous integration (CI) pipelines whenever code is pushed to a repository branch or tag, without requiring external Git hosting.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Container Registry

Question 5

A DevOps engineer notices that a Cloud Build trigger is not firing when commits are pushed to a Cloud Source Repositories repository. The trigger is configured with an invert regex for the branch filter. What could be the issue?

Accepted Answer

The branch name matches the exclude pattern; the trigger ignores matching branches.. When a Cloud Build trigger is configured with an invert regex for the branch filter, it means the trigger will fire only for branches that do NOT match the specified regex pattern. If the branch name matches the exclude pattern, the trigger ignores commits on that branch, which is why the trigger is not firing. This is the intended behavior of the invert_regex flag in Cloud Build triggers.

Answer

The repository is in a different region.

Answer

The commit was made by a service account.

Answer

The trigger's service account lacks read access to the repository.

Question 6

An organization has a strict compliance requirement that all CI/CD pipelines must use customer-managed encryption keys (CMEK) for any artifacts stored in Cloud Storage. How can this be enforced at the organization level?

Accepted Answer

Create an Organization Policy with constraint `constraints/gcp.storageRequireCmeK`.. The Organization Policy constraint `constraints/gcp.storageRequireCmeK` is specifically designed to enforce that all new Cloud Storage buckets must be created with a customer-managed encryption key (CMEK). This policy is applied at the organization, folder, or project level and prevents the creation of buckets that do not use CMEK, thereby meeting the compliance requirement at the organizational level.

Answer

Use IAM conditions on storage buckets to require CMEK.

Answer

Use Cloud Asset Inventory to scan for non-compliant buckets.

Answer

Configure Cloud Audit Logs to monitor and alert on non-CMEK usage.

Question 7

Which TWO Organization Policy constraints are commonly used to enhance security in a DevOps environment?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint prevents the creation of long-lived service account keys, which are a common security risk in DevOps pipelines. By enforcing this constraint, you force the use of short-lived credentials (e.g., workload identity federation or OAuth 2.0 access tokens) instead of static JSON keys that could be leaked or misused.

Answer

constraints/cloudbuild.enableBuildManager

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/appengine.disableCodeDownload

Question 8

When bootstrapping a Google Cloud organization for DevOps, which THREE steps are essential to set up a secure CI/CD foundation using Cloud Build?

Accepted Answer

Create a Cloud Source Repository for each application's code.. Creating a Cloud Source Repository for each application's code is essential because it provides a dedicated, version-controlled repository that integrates natively with Cloud Build triggers. This ensures that each application has its own isolated codebase, enabling precise CI/CD pipelines without cross-application interference.

Answer

Disable default service accounts in all projects.

Answer

Configure VPC Service Controls for all projects.

Question 9

A Cloud Build pipeline that deploys a container to Cloud Run fails with the error: `Missing required permission run.routes.invoke`. The Cloud Build service account has the 'Cloud Run Invoker' role. Which TWO additional steps should be taken?

Accepted Answer

Ensure the service account has the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account.. The Cloud Build service account needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account (the service account that Cloud Run uses to run the container). Without this permission, Cloud Build cannot impersonate the runtime service account to deploy the container, even if it has the Cloud Run Invoker role. The `run.routes.invoke` error occurs because the deployment process requires the ability to invoke the route, which is tied to the runtime service account's permissions.

Answer

Enable the Cloud Run API in the project.

Answer

Use a different service account for deployment.

Answer

Add the `run.routes.invoke` permission to a custom role.

Question 10

Refer to the exhibit. The output shows three folders created directly under the organization node. Which gcloud command was most likely executed to produce this output?

Accepted Answer

gcloud resource-manager folders list --organization=123456789012. The `gcloud resource-manager folders list --organization=123456789012` command lists all folders directly under the specified organization node. The output shows three folders (e.g., folder1, folder2, folder3) at the top level, which matches the behavior of listing folders with the organization ID as the parent. This command is specifically designed to retrieve immediate child folders of an organization, not nested folders.

Answer

gcloud organizations list

Answer

gcloud projects list --filter='parent.id:123456789012'

Answer

gcloud resource-manager folders list --folder=123456789012

Question 11

Refer to the exhibit. A Cloud Build pipeline using this configuration fails on the third step with a permission error. The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely missing permission?

Accepted Answer

iam.serviceAccounts.actAs on the Cloud Run runtime service account. The Cloud Build pipeline fails on the third step with a permission error because the Cloud Build service account, despite having the 'Cloud Run Admin' role, lacks the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account. This permission is required for Cloud Build to impersonate the runtime service account when deploying to Cloud Run, as the deployment step needs to act on behalf of that service account to create or update the service.

Answer

run.routes.invoke

Answer

storage.objects.list on the artifact bucket

Answer

resourcemanager.projects.get

Question 12

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Accepted Answer

secretmanager.versions.access. The custom role assigned to the Cloud Build service account lacks the `secretmanager.versions.access` permission, which is required to access the payload of a secret version in Secret Manager. Without this permission, any attempt to read the secret value during a build step will fail with a permission denied error, even if the service account has other roles on the project.

Answer

cloudbuild.builds.update

Answer

run.services.get

Answer

iam.serviceAccounts.actAs

Question 13

A company is setting up a new Google Cloud organization. They want to apply a consistent set of IAM roles to all projects within a specific department. What is the most efficient method to achieve this?

Accepted Answer

Create a folder for the department and assign roles at the folder level.. Google Cloud IAM supports hierarchical policy inheritance, where roles assigned at the folder level are automatically inherited by all projects within that folder. This eliminates the need for per-project assignments and ensures consistent permissions across the department's projects without manual overhead or scripting.

Answer

Use a script to apply roles to all projects periodically.

Answer

Assign roles directly to each project using the Google Cloud console.

Answer

Use a custom role and assign it to the organization node.

Question 14

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

Accepted Answer

Use Cloud Build triggers with regular expressions on branch patterns and restrict access via IAM.. Cloud Build triggers natively support regular expressions on branch patterns, and IAM conditions can restrict which service accounts are allowed to invoke specific triggers. This provides a declarative, auditable, and least-privilege approach without custom code or external services.

Answer

Use Cloud Functions to validate branch names before triggering builds.

Answer

Use Cloud Source Repositories with branch protection rules.

Answer

Store the service account keys in Secret Manager and use them in build steps.

Question 15

An organization has multiple projects under a common folder. They want to enforce that all projects use the same VPC network from a central host project. However, one project needs to use a different VPC due to compliance requirements. How can this be achieved?

Accepted Answer

Set an organization policy to enforce shared VPC and create an exception for the specific project using the policy condition.. Google Cloud Organization Policies can enforce constraints like `compute.restrictSharedVpcHostProjects` to mandate shared VPC usage across projects. You can use policy conditions (e.g., `resource.matchTag`) to create an exception for a specific project that needs its own VPC, allowing it to bypass the constraint while all other projects remain bound to the central host project.

Answer

Use VPC Network Peering to connect the project to the host project.

Answer

Create a separate folder for the exception project and apply a different organizational policy.

Answer

Grant the project the necessary permissions to use its own VPC.