PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 8 — 15 Questions

Question 1

Which THREE of the following are valid considerations when using organization policies to enforce compliance in a DevOps environment?

Accepted Answer

Child-level organization policies can only add more restrictions, not remove restrictions set by a parent.. Option A is correct because organization policies are hierarchical and inherited: a policy set at a parent node (organization or folder) is inherited by all descendants, and child-level policies can only further restrict the effective policy, never loosen or remove a parent's restriction. Option B is correct because list constraints (list policies) let you specify allowed or denied values for a resource attribute, effectively implementing an allowlist or blocklist (for example, restricting which services or locations are permitted). Option E is correct because organization policies can be attached at the organization, folder, or project level in the resource hierarchy, with the most specific applicable policy taking effect. Option C is not a valid consideration: organization policies do not require a service agent to be enabled before use; they are enforced by the Organization Policy Service based on constraints and inheritance. Option D is not valid: IAM conditions control access (who can do what under which conditions) and cannot override or exempt resources from an organization policy constraint.

Answer

An organization policy must be enabled by a service agent before it can be used.

Answer

IAM conditions can be used to override an organization policy for specific resources.

Question 2

A DevOps engineer is trying to create a service account key for a CI/CD pipeline, but receives the error: 'Constraint constraints/iam.disableServiceAccountKeyCreation violated'. What is the most likely cause and solution?

Accepted Answer

The Organization Policy prevents key creation; the engineer needs to request an exception from the security team.. The error 'Constraint constraints/iam.disableServiceAccountKeyCreation violated' indicates that an Organization Policy with the constraint `iam.disableServiceAccountKeyCreation` is enforced at the organization, folder, or project level. This policy explicitly blocks the creation of service account keys, which is why the engineer cannot generate a key for the CI/CD pipeline. The correct solution is to request an exception from the security team, who can either remove the policy or add the engineer's project to an exemption list.

Answer

The Cloud Resource Manager API is disabled; enable it.

Answer

The project does not have billing enabled; enable billing.

Answer

The service account has been deleted; the engineer must recreate it.

Question 3

A large enterprise is designing a centralized DevOps platform across multiple business units. They want to use a shared CI/CD pipeline that deploys to projects in different folders. Which approach ensures secure, auditable deployments while minimizing IAM administration?

Accepted Answer

Use a cross-project service account in the CI/CD project with required roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM.. A cross-project service account in the CI/CD project, granted the necessary roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM, allows the shared pipeline to deploy resources across folders without duplicating service accounts. This centralizes IAM administration, ensures auditability through a single identity, and follows the principle of least privilege by granting only required roles on target projects.

Answer

Use Cloud Build triggers directly in each target project with separate code repositories.

Answer

Grant the Cloud Build Editor role to all developers across projects to allow them to create pipelines.

Answer

Create a separate service account in each target project with the Cloud Build service agent role, and use impersonation from the CI/CD project.

Question 4

Which Google Cloud service provides a fully managed, private Git repository that integrates with Cloud Build for continuous integration?

Accepted Answer

Cloud Source Repositories. Cloud Source Repositories is the correct answer because it provides fully managed, private Git repositories hosted on Google Cloud. It integrates natively with Cloud Build, enabling automatic triggers for continuous integration (CI) pipelines whenever code is pushed to a repository branch or tag, without requiring external Git hosting.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Container Registry

Question 5

A DevOps engineer notices that a Cloud Build trigger is not firing when commits are pushed to a Cloud Source Repositories repository. The trigger is configured with an invert regex for the branch filter. What could be the issue?

Accepted Answer

The branch name matches the exclude pattern; the trigger ignores matching branches.. When a Cloud Build trigger is configured with an invert regex for the branch filter, it means the trigger will fire only for branches that do NOT match the specified regex pattern. If the branch name matches the exclude pattern, the trigger ignores commits on that branch, which is why the trigger is not firing. This is the intended behavior of the invert_regex flag in Cloud Build triggers.

Answer

The repository is in a different region.

Answer

The commit was made by a service account.

Answer

The trigger's service account lacks read access to the repository.

Question 6

Refer to the exhibit. The output shows three folders created directly under the organization node. Which gcloud command was most likely executed to produce this output?

Accepted Answer

gcloud resource-manager folders list --organization=123456789012. The `gcloud resource-manager folders list --organization=123456789012` command lists all folders directly under the specified organization node. The output shows three folders (e.g., folder1, folder2, folder3) at the top level, which matches the behavior of listing folders with the organization ID as the parent. This command is specifically designed to retrieve immediate child folders of an organization, not nested folders.

Answer

gcloud organizations list

Answer

gcloud projects list --filter='parent.id:123456789012'

Answer

gcloud resource-manager folders list --folder=123456789012

Question 7

Refer to the exhibit. A Cloud Build pipeline using this configuration fails on the third step with a permission error. The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely missing permission?

Accepted Answer

iam.serviceAccounts.actAs on the Cloud Run runtime service account. The Cloud Build pipeline fails on the third step with a permission error because the Cloud Build service account, despite having the 'Cloud Run Admin' role, lacks the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account. This permission is required for Cloud Build to impersonate the runtime service account when deploying to Cloud Run, as the deployment step needs to act on behalf of that service account to create or update the service.

Answer

run.routes.invoke

Answer

storage.objects.list on the artifact bucket

Answer

resourcemanager.projects.get

Question 8

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Accepted Answer

secretmanager.versions.access. The custom role assigned to the Cloud Build service account lacks the `secretmanager.versions.access` permission, which is required to access the payload of a secret version in Secret Manager. Without this permission, any attempt to read the secret value during a build step will fail with a permission denied error, even if the service account has other roles on the project.

Answer

cloudbuild.builds.update

Answer

run.services.get

Answer

iam.serviceAccounts.actAs

Question 9

A company is setting up a new Google Cloud organization. They want to apply a consistent set of IAM roles to all projects within a specific department. What is the most efficient method to achieve this?

Accepted Answer

Create a folder for the department and assign roles at the folder level.. Google Cloud IAM supports hierarchical policy inheritance, where roles assigned at the folder level are automatically inherited by all projects within that folder. This eliminates the need for per-project assignments and ensures consistent permissions across the department's projects without manual overhead or scripting.

Answer

Use a script to apply roles to all projects periodically.

Answer

Assign roles directly to each project using the Google Cloud console.

Answer

Use a custom role and assign it to the organization node.

Question 10

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

Accepted Answer

Use Cloud Build triggers with regular expressions on branch patterns and restrict access via IAM.. Cloud Build triggers natively support regular expressions on branch patterns, and IAM conditions can restrict which service accounts are allowed to invoke specific triggers. This provides a declarative, auditable, and least-privilege approach without custom code or external services.

Answer

Use Cloud Functions to validate branch names before triggering builds.

Answer

Use Cloud Source Repositories with branch protection rules.

Answer

Store the service account keys in Secret Manager and use them in build steps.

Question 11

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. Option A is correct because a Shared VPC lets a host project centrally manage subnets and firewall rules while service projects from different teams attach to that network, which enforces consistent networking and avoids duplicated VPCs across the organization. Option D is correct because folders let you group projects by team, environment, or business unit and apply IAM policies and Organization Policies hierarchically, so permissions and constraints inherit cleanly to all contained projects. Option B is not a best practice because separate billing accounts per team add administrative overhead and fragment cost visibility; a single billing account with labels and budgets is preferred. Option C is wrong because granting all users the Project Creator role allows anyone to create projects freely, undermining governance and quota control. Option E is not a best practice because APIs should be enabled only where needed to follow least privilege and reduce attack surface, not blanket-enabled in every project.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 12

Which THREE actions should be taken when bootstrapping a CI/CD pipeline on Google Cloud? (Select exactly 3)

Accepted Answer

Use Cloud Build with a Dockerfile.. Option B is correct because Cloud Build is Google Cloud's managed CI/CD service that executes build steps, and using a Dockerfile lets the pipeline build a container image reproducibly for later deployment. Option D is correct because the pipeline needs a dedicated service account (with least-privilege IAM roles such as Cloud Build Builder, Artifact Registry Writer, and Cloud Run Developer) so Cloud Build and deployment steps can authenticate and act without using user credentials. Option E is correct because configuring Cloud Build triggers (for example, a GitHub or Cloud Source Repositories push trigger) automates builds on code changes, which is the core of bootstrapping a CI/CD pipeline. Option A is not appropriate because Cloud Source Repositories is a Git source-code hosting service, not a secrets manager; secrets should be stored in Secret Manager and referenced via Cloud Build's availableSecrets. Option C is not one of the three required bootstrap actions here because enabling the Cloud Run API is a deployment-target prerequisite, not a fundamental CI/CD pipeline bootstrap step, and the question asks specifically for bootstrapping actions.

Answer

Store secrets in Cloud Source Repositories.

Answer

Enable the Cloud Run API.

Question 13

Refer to the exhibit. A DevOps engineer applies this Terraform configuration but gets an error: "Error creating Project: googleapi: Error 403: The caller does not have permission to enable services". What is the most likely cause?

Accepted Answer

The service account used by Terraform lacks the Service Usage Admin role on the project.. The error 'The caller does not have permission to enable services' indicates that the identity (service account) used by Terraform to authenticate with the Google Cloud API lacks the required IAM permission to enable Google APIs on the project. The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) grants the necessary permissions, including serviceusage.services.enable and serviceusage.services.list, which are required to enable services like the Compute Engine API during resource creation. Without this role, the API call to enable services fails with a 403 error.

Answer

The org_id is incorrect.

Answer

The organization requires that the Compute Engine API be enabled before project creation.

Answer

The project ID already exists.

Question 14

A DevOps engineer needs to set up a centralized logging solution for multiple projects. They want to store logs in a BigQuery dataset for analysis. What is the best approach?

Accepted Answer

Create an aggregated sink at the organization or folder level to export logs to BigQuery.. An aggregated sink at the organization or folder level allows you to collect logs from all projects within that hierarchy into a single BigQuery dataset in a centralized project. This approach eliminates the need to configure individual sinks per project, reduces administrative overhead, and ensures consistent log routing across the entire organization.

Answer

Use Cloud Logging's export feature to Pub/Sub and then to BigQuery.

Answer

Use the BigQuery Data Transfer Service for logs.

Answer

Create a sink in each project to export logs to the BigQuery dataset.

Question 15

An organization is using Cloud Source Repositories and wants to enforce that all commits are signed with a verified GPG key. How can they enforce this?

Accepted Answer

Enable the Signed Commits policy in the repository settings.. Cloud Source Repositories provides a built-in 'Signed Commits' policy in the repository settings that, when enabled, rejects any push containing commits that are not signed with a verified GPG key. This policy is enforced server-side at the repository level, ensuring that only signed commits are accepted without requiring external tools or custom scripts.

Answer

Use a branch protection rule in Cloud Source Repositories.

Answer

Use Cloud Functions to validate commits after push.

Answer

Use a pre-receive hook in Cloud Source Repositories.