PCDOE Bootstrapping a Google Cloud organization for DevOps Practice Test 9 — 15 Questions

Question 1

A company uses Cloud Build and wants to trigger builds only from the master branch. Which configuration is required?

Accepted Answer

Set the branch filter to 'master' in the trigger.. Cloud Build triggers allow you to specify a branch filter using a regex pattern. Setting the filter to 'master' ensures that only pushes or pull requests targeting the master branch initiate the build. This is the native, supported method for branch-based triggering without additional overhead.

Answer

Create separate triggers for each branch.

Answer

Use a custom Cloud Build step to check the branch name.

Answer

Use a Cloud Function to call Cloud Build for master only.

Question 2

An organization wants to enforce that all Compute Engine VMs use only specific machine families (e.g., N2, C2). Which mechanism should they use?

Accepted Answer

Organization policy with compute.restrictComputeEngineMachineTypes. Organization policies in Google Cloud allow administrators to enforce constraints on resources across the entire hierarchy. The `compute.restrictComputeEngineMachineTypes` constraint specifically limits which machine families (e.g., N2, C2) can be used when creating Compute Engine VMs, making it the correct mechanism for this requirement.

Answer

IAM deny policies

Answer

Quota management

Answer

Folders with different owners

Question 3

A team is bootstrapping a new Google Cloud organization. Which TWO practices are recommended for managing project creation and resource hierarchy? (Choose two.)

Accepted Answer

Create a folder for each department to isolate resources.. Option B is correct because folders provide a grouping layer between the organization and projects, letting you isolate each department's resources and apply IAM policies and organization policies at the department level, which is a core recommended practice for a well-structured resource hierarchy. Option E is correct because organization policies are the mechanism to enforce constraints such as project naming conventions (for example, a custom constraint on resource name patterns) across the entire organization, ensuring consistent governance as new projects are created. Option A is not recommended as stated: while automation service accounts are useful, a single centralized service account with broad project-creation rights is not the recommended pattern versus scoped, least-privilege automation. Option C is wrong because consolidating all development environments into one project defeats isolation, IAM separation, and quota management. Option D is wrong because granting the project creator role to all users by default violates least privilege and can lead to uncontrolled project sprawl.

Answer

Use a centralized service account to create projects via API.

Answer

Use a single project for all development environments.

Answer

Assign project creator role to all users by default.

Question 4

A DevOps engineer is designing a CI/CD pipeline using Cloud Build. Which TWO configurations are necessary to ensure secure and reliable deployments? (Choose two.)

Accepted Answer

Use manual approval steps for production deployments.. Option A is correct because adding manual approval steps for production deployments (e.g., via Cloud Build approval gates or a release pipeline) prevents unreviewed or accidental changes from reaching production, which is a core control for reliable and secure releases. Option B is correct because storing secrets in Cloud Secret Manager and referencing them in Cloud Build (for example, using the availableSecrets field with secretEnv) avoids hardcoding credentials in build configs or source, keeping sensitive data encrypted and access-controlled. Option C is not necessary for security or reliability; branch filters on triggers only control which commits start a build and do not by themselves enforce secure or dependable deployments. Option D is wrong because pushing artifacts to a public Container Registry exposes images and is a security risk, not a best practice. Option E is wrong because granting the Cloud Build service account the broad Editor role violates least privilege; a narrower set of IAM roles should be used instead.

Answer

Use Cloud Build triggers with branch filters.

Answer

Push all artifacts to a public Container Registry.

Answer

Enable Cloud Build service account with Editor role.

Question 5

A company wants to implement a DevOps culture in their new Google Cloud organization. Which THREE practices align with Google's DevOps principles? (Choose three.)

Accepted Answer

Monitor systems with telemetry and logs.. Option A is correct because Google's DevOps principles emphasize observability: collecting telemetry (metrics, traces) and logs lets teams detect issues, measure service health, and make data-driven decisions, which is foundational to SRE and DevOps practices. Option B is correct because continuous integration and continuous delivery (CI/CD) automate build, test, and release pipelines, enabling small, frequent, low-risk changes that align with Google's DORA-based DevOps guidance. Option E is correct because blameless post-mortems are a core Google SRE practice: they focus on systemic causes and learning rather than punishing individuals, which fosters psychological safety and continuous improvement. Option C does not belong because a monolithic architecture is not a DevOps practice and can hinder independent deployability and scaling, whereas Google favors loosely coupled, service-oriented designs. Option D does not belong because centralizing all operations in a single team contradicts DevOps's shared responsibility and collaboration between development and operations, which Google promotes through practices like SRE and error budgets.

Answer

Use a monolithic architecture to simplify deployments.

Answer

Centralize all operations in a single team.

Question 6

You are a DevOps engineer for a startup bootstrapping their Google Cloud organization. They have a single project for all environments (dev, test, prod) and a flat resource hierarchy. Recently, a developer accidentally deleted a production Cloud Storage bucket, causing data loss. The team wants to prevent this in the future with minimal disruption. They also want to enforce that all new projects follow a naming convention like 'company-environment-xxx'. The CTO wants a solution using native Google Cloud services without third-party tools. What should you do?

Accepted Answer

Create folders for each environment, move existing resources into folders, and apply an organization policy to enforce the naming convention on project creation.. Creating folders for each environment (dev, test, prod) and moving existing resources into them establishes a hierarchical resource structure that allows organization policies to be applied at the folder level. The organization policy constraint `constraints/resourcemanager.allowedProjectCreation` can enforce the naming convention on project creation, and IAM roles can be scoped to folders to restrict bucket deletion (e.g., using `roles/storage.objectAdmin` instead of `roles/storage.admin`). This solution uses native Google Cloud services (Resource Manager, Organization Policies, IAM) with minimal disruption by not requiring code changes or third-party tools.

Answer

Implement a Cloud Function that renames projects not following the convention and deletes buckets not in a folder.

Answer

Grant all users the Project Creator role but restrict bucket deletion with IAM.

Answer

Use Google Cloud Deployment Manager to create projects with predefined templates.

Question 7

A multinational corporation is bootstrapping their Google Cloud organization. They have multiple business units in different countries, each with its own compliance requirements (e.g., data residency, encryption keys). The organization structure must support: (1) each business unit as a separate folder with its own admin; (2) projects within each folder must have a label 'bu-<businessunit>'; (3) all resources must be created in regions allowed by the business unit; (4) audit logging must be centralized. They have 200 existing projects and 10,000 VMs. The team wants to use Google Cloud's native tools to enforce these policies without third-party software. What is the most effective first step?

Accepted Answer

Create folders for each business unit, move all projects into corresponding folders using a script, and apply organization policies for allowed regions and labeling.. It establishes a folder hierarchy that mirrors the business units, enabling hierarchical inheritance of organization policies. By moving existing projects into the correct folders and applying organization policies for allowed regions and labeling at the folder level, each business unit's compliance requirements are enforced natively without third-party tools. This approach also supports centralized audit logging by enabling audit logs at the organization level, which aggregate logs from all folders and projects.

Answer

Apply organization policies at the root level to restrict regions and labeling, and ignore folders.

Answer

Use a single folder for all projects and rely on IAM roles to enforce compliance per business unit.

Answer

Create a separate Cloud Function for each business unit to monitor resources and enforce compliance.

Question 8

A company is bootstrapping a Google Cloud organization for DevOps. Which TWO practices should be implemented to ensure secure and efficient management of infrastructure as code (IaC) pipelines?

Accepted Answer

Use a dedicated project for CI/CD pipelines that houses Cloud Build triggers and Cloud Source Repositories.. Option B is correct because a dedicated CI/CD project isolates build infrastructure, Cloud Build triggers, and Cloud Source Repositories from workload projects, limiting the blast radius of compromised pipeline credentials and enabling centralized audit logging and IAM control over the deployment toolchain. Option D is correct because least-privilege service accounts scoped per environment (for example, distinct Terraform service accounts for dev, staging, and prod) enforce separation of duties and prevent human users from bypassing IaC by making direct production changes, which is a core Google Cloud security best practice. Option A is wrong because storing API keys in Terraform configuration files exposes secrets in version control and state files; secrets should be kept in Secret Manager and referenced dynamically. Option C is wrong because a single project collapses IAM, quota, and billing boundaries across environments, so a misconfiguration or compromised credential can affect production. Option E is wrong because requiring security-team approval for every change creates a bottleneck that undermines DevOps efficiency; approval gates should be risk-based and automated where possible.

Answer

Store infrastructure secrets (e.g., API keys) directly in Terraform configuration files for simplicity.

Answer

Use a single project to host all development, staging, and production environments to reduce complexity.

Answer

Require manual approval from a security team for every infrastructure change.

Question 9

Your organization has 40 projects, and each project's DevOps team has its own Cloud Build triggers. You need to grant every CI/CD service account in the organization the ability to deploy to a shared GKE cluster in the shared-services project, but you want to avoid adding 40 individual IAM bindings. Which approach should you use?

Accepted Answer

Create a Google group containing all CI/CD service accounts, then grant roles/container.developer to that group on the shared-services project.. Google Groups are the canonical way to manage IAM at scale in Google Cloud. Because service accounts can be group members, one IAM binding on the shared-services project grants cluster access to every current and future CI/CD identity. This keeps the number of policy bindings constant as the organization grows, unlike per-service-account bindings.

Answer

Create a single shared service account in the shared-services project and distribute its JSON key to all 40 CI/CD pipelines.

Answer

Grant the roles/container.developer role to each CI/CD service account directly on the GKE cluster resource.

Answer

Grant roles/container.developer to allAuthenticatedUsers on the shared-services project.

Question 10

A DevOps team needs to ensure that all service accounts in the organization cannot be used to create external IP addresses on VM instances. They want to enforce this across all projects, including future ones. What should they do?

Accepted Answer

Create an organization policy constraint for compute.vmExternalIpAccess and set it to deny all.. The compute.vmExternalIpAccess organization policy constraint is designed to control whether external IPs can be assigned to VM instances. Setting it to deny all at the organization level ensures that no service account or user can create VMs with external IPs, regardless of their IAM permissions, and it applies to all current and future projects.

Answer

Grant the roles/compute.networkAdmin role only to trusted users, and remove it from service accounts.

Answer

Enable VPC Service Controls and create a perimeter around all projects to block external IPs.

Answer

Use a custom IAM role that excludes the compute.instances.create permission for all service accounts.

Question 11

A platform team is bootstrapping a new Google Cloud organization. Security requires that no service account key can ever be created in any project, including future projects, and that the restriction cannot be removed by project-level administrators. Which configuration meets these requirements?

Accepted Answer

Set an organization policy with the constraints/iam.disableServiceAccountKeyCreation constraint enforced at the organization node.. Organization policies are preventive controls applied across the resource hierarchy. Enforcing constraints/iam.disableServiceAccountKeyCreation at the organization node blocks key creation in all current and future projects, and project administrators cannot weaken an inherited constraint. This is the standard approach for enforcing keyless authentication across an enterprise.

Answer

Enable the Cloud Asset Inventory API and schedule a recurring export to detect newly created service account keys.

Answer

Create an IAM deny policy on each project that denies iam.serviceAccountKeys.create for all principals.

Answer

Remove the roles/iam.serviceAccountKeyAdmin role from all principals in the organization.

Question 12

Your organization just enabled Google Cloud and you need to bootstrap identity for DevOps engineers. The security team requires that all human access to production projects be tied to the corporate identity provider and that engineers receive no standing IAM permissions. Which Google Cloud capability should you configure first?

Accepted Answer

Federate Cloud Identity or Google Workspace with the corporate IdP using SAML, then grant IAM roles to Google Groups synchronized from the IdP.. Bootstrapping identity means establishing one authoritative directory and expressing access through groups rather than individuals. Federating Cloud Identity or Google Workspace with the corporate IdP makes the IdP the source of truth, and binding IAM roles to synchronized groups means access is granted and revoked by directory membership. That design removes standing per-user permissions and gives the DevOps team a scalable, auditable access model from day one.

Answer

Create individual Google Accounts for each engineer and bind roles directly to each user at the project level.

Answer

Issue long-lived service account keys to each engineer and store them in a shared password vault.

Answer

Enable Identity-Aware Proxy on all Compute Engine instances and rely on IAP TCP forwarding for engineer authentication.

Question 13

A DevOps team is setting up a new Google Cloud organization. They want to ensure that all projects created under the 'production' folder automatically inherit a set of IAM policies that grant the security team the Security Reviewer role. What is the most efficient way to achieve this?

Accepted Answer

Grant the Security Reviewer role to the security team on the 'production' folder.. IAM policies are inherited down the resource hierarchy. Granting a role at the folder level ensures all current and future projects within that folder inherit the role. This is the most efficient and least error-prone method, and it adheres to least privilege by scoping to the production folder only.

Answer

Use an organization policy to enforce that all projects in 'production' have the Security Reviewer role.

Answer

Create a script that runs periodically to grant the role on each new project in the 'production' folder.

Answer

Grant the Security Reviewer role to the security team at the organization level.

Question 14

Your organization is bootstrapping a new Google Cloud environment for DevOps. The security team requires that all CI/CD pipelines authenticate to Google Cloud APIs without long-lived credentials, and that each pipeline's identity be scoped to only the projects it deploys to. You need to configure workload identity federation so that GitLab CI jobs can impersonate a dedicated service account per environment. Which configuration correctly establishes this trust?

Accepted Answer

Create a workload identity pool, add a GitLab OIDC provider with the issuer URI, then grant roles/iam.workloadIdentityUser on the target service account to the principalSet matching the GitLab project path.. Workload identity federation lets external workloads exchange their native OIDC token for a short-lived Google Cloud access token, eliminating exported keys. Binding roles/iam.workloadIdentityUser on a service account to a principalSet filtered by the GitLab project attribute ensures each pipeline can impersonate only its own environment's identity, satisfying both the no-keys and least-privilege requirements.

Answer

Create a service account in each project, export a JSON key, store it as a masked CI variable, and have the pipeline call gcloud auth activate-service-account with the key file.

Answer

Configure an OAuth consent screen, register GitLab as an internal application, and have each pipeline use an OAuth client ID and secret to obtain an access token for the Cloud Resource Manager API.

Answer

Enable the IAM Credentials API, create one service account in the organization's bootstrap project, and grant all CI jobs roles/iam.serviceAccountTokenCreator on that shared account.

Question 15

A DevOps platform team is bootstrapping a new Google Cloud organization. They want a single, repeatable definition of folders, projects, IAM bindings, and APIs that they can store in Git and re-apply whenever the org baseline changes. Which approach best meets this requirement?

Accepted Answer

Write Terraform configurations using the google_folder, google_project, google_project_iam_member, and google_project_service resources, and commit them to Git.. The requirement is a declarative, version-controlled definition that can be re-applied to reconcile drift. Terraform resources for folders, projects, IAM members, and service enablement give exactly that: state-backed plan/apply semantics, idempotency, and a Git-stored source of truth. Imperative scripts and inventory exports document or mutate resources but cannot safely reconcile the baseline over time.

Answer

Use the gcloud CLI interactively to create folders and projects, then export the resulting state with gcloud asset export for documentation.

Answer

Define the baseline in a Deployment Manager template and deploy it with gcloud deployment-manager deployments create.

Answer

Create a Cloud Build pipeline that runs gcloud commands from a shell script stored in Cloud Source Repositories.