PCDOE Bootstrapping a Google Cloud organization for DevOps — Timed 20 Questions

Question 1

A DevOps engineer is troubleshooting a Cloud Build failure. The build log shows the error: 'Permission denied for resource projects/my-project/locations/us-central1/repositories/my-repo'. The Cloud Build service account (PROJECT_NUMBER@cloudbuild.gserviceaccount.com) is used. What is the most likely missing role?

20 minute time limit — choose an answer to begin.

Accepted Answer

roles/artifactregistry.writer. The error 'Permission denied for resource projects/my-project/locations/us-central1/repositories/my-repo' indicates that the Cloud Build service account lacks permission to write artifacts to Artifact Registry. The Cloud Build service account needs the `roles/artifactregistry.writer` role to upload build artifacts (e.g., container images) to the repository. Without this role, the build fails at the step that attempts to push artifacts.

Answer

roles/artifactregistry.reader

Answer

roles/artifactregistry.admin

Answer

roles/cloudbuild.builds.builder

Question 2

A company is setting up a new Google Cloud organization for DevOps. They want to enforce that all projects have a specific set of VPC Service Controls perimeters. Which approach should they use to ensure these perimeters are automatically applied to all new projects?

Accepted Answer

Define an organization policy with a constraint that requires all projects to be within a perimeter.. Google Cloud Organization Policies allow you to define and enforce constraints at the organization, folder, or project level. The `constraints/compute.restrictVpcServiceControls` constraint can be set to require all new projects to be within a specific VPC Service Controls perimeter, ensuring automatic enforcement without manual intervention.

Answer

Configure Cloud Shell to run a script that creates a perimeter when a new project is created.

Answer

Use Deployment Manager to deploy a configuration that creates a perimeter for each new project.

Answer

Create a VPC Service Controls perimeter and add the organization node as a member.

Question 3

You are bootstrapping a Google Cloud organization for a DevOps team. You need to set up a shared VPC host project that will be used by multiple service projects. What is the minimal set of roles required for the DevOps team to create and manage service projects in the host project?

Accepted Answer

Compute Network Admin and Service Project Admin. The minimal set of roles required for a DevOps team to create and manage service projects in a shared VPC host project is Compute Network Admin (roles/compute.networkAdmin) on the host project and Service Project Admin (roles/compute.xpnAdmin) at the organization or folder level. Compute Network Admin grants permissions to manage networking resources, while Service Project Admin allows attaching service projects to the host project. Without both, the team cannot configure shared VPC networking or associate service projects.

Answer

Project Creator and Service Project Admin

Answer

Compute Shared VPC Admin

Answer

Owner and Service Project Admin

Question 4

During the bootstrapping of a Google Cloud organization, the DevOps team wants to implement a policy that prevents the deletion of certain resources, such as Cloud Storage buckets or Cloud SQL instances, unless a specific approval process is followed. Which approach best achieves this goal?

Accepted Answer

Use Resource Manager locks on projects and set up a Cloud Function that triggers on audit logs to require approval before removing the lock.. Resource Manager locks prevent accidental deletion of critical resources by placing a deletion prevention lock on the project or resource hierarchy. By combining this with a Cloud Function that monitors audit logs for lock removal attempts and requires an approval workflow before the lock is removed, the team enforces a controlled approval process for any deletion, meeting the policy requirement precisely.

Answer

Configure Cloud Source Repositories to require code review for any changes to Terraform configurations that delete resources.

Answer

Implement Binary Authorization to require approvals for any delete commands.

Answer

Use VPC Service Controls to block delete operations on specific services.

Question 5

A DevOps team is bootstrapping a new organization. They want to ensure that all projects created within the organization have a specific set of APIs enabled, such as Compute Engine, Cloud Storage, and Cloud Resource Manager. What is the most efficient way to achieve this?

Accepted Answer

Define an organization policy with a constraint that requires the APIs to be enabled.. Organization Policies with constraints (like `constraints/compute.requireOsLogin` or custom constraints using the Resource Manager API) allow you to enforce API enablement across all projects in the organization. This is the most efficient approach as it is declarative, centrally managed, and automatically applies to new projects without any additional infrastructure or manual intervention.

Answer

Create a Cloud Function that triggers on project creation events and enables the required APIs.

Answer

Use Cloud Foundation Toolkit to deploy a project template that includes API enablement.

Answer

Create a shared VPC and enable the APIs in the host project only.

Question 6

You are bootstrapping a Google Cloud organization. You need to set up a hierarchical structure that allows you to apply policies to groups of projects based on their environment (e.g., development, staging, production). What is the recommended way to organize resources?

Accepted Answer

Create folders under the organization for each environment and place projects in the appropriate folder.. Google Cloud's resource hierarchy (Organization -> Folders -> Projects) is specifically designed to group projects by environment and apply consistent policies (e.g., IAM, organization policies) at the folder level. By creating folders for development, staging, and production, you can enforce environment-specific controls (like VPC Service Controls or resource location restrictions) without duplicating policies per project.

Answer

Use resource tags to label projects by environment and apply policies via tag-based conditions.

Answer

Create separate organizations for each environment.

Answer

Use labels on projects to identify environments and then use Cloud Asset Inventory to enforce policies.

Question 7

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.. Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.

Answer

Use a user account for the CI/CD pipeline and assign it the necessary roles.

Answer

Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.

Answer

Generate a single service account key and securely distribute it to the CI/CD system.

Question 8

During the bootstrapping of a Google Cloud organization, you need to ensure that all resources in a specific folder are subject to a particular VPC Service Controls perimeter. Which step is necessary to achieve this?

Accepted Answer

Add the projects within the folder as members of the existing service perimeter.. VPC Service Controls perimeters are applied at the project level, not directly to folders. To enforce a perimeter on all resources within a folder, you must add each project in that folder as a member of the existing service perimeter. This ensures that all resources in those projects are subject to the perimeter's access restrictions.

Answer

Use resource tags to label the projects and then create a tag-based perimeter.

Answer

Apply the perimeter to the folder directly.

Answer

Create an organization policy that forces all projects in the folder to be in a perimeter.

Question 9

A DevOps team is setting up a Google Cloud organization. They want to centralize logging and monitoring across all projects. What is the recommended approach?

Accepted Answer

Create a dedicated project for logging and monitoring, and configure all other projects to send logs and metrics to that project.. The recommended approach for centralizing logging and monitoring in a Google Cloud organization is to create a dedicated project that acts as a log sink and metric aggregator. By configuring aggregated sinks at the organization or folder level, all projects automatically forward logs to the dedicated project's Cloud Logging bucket, and metrics can be collected via the Monitoring API. This ensures a single pane of glass for operations without manual per-project setup.

Answer

Enable logging and monitoring in each project individually and use the Cloud Console to view them.

Answer

Enable Cloud Audit Logs in the organization and view them from the Organization level.

Answer

Use Stackdriver (now Operations) to aggregate logs from all projects automatically.

Question 10

Which TWO options are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose 2)

Accepted Answer

Use folders to separate environments (e.g., dev, staging, prod) and apply policies at the folder level.. Using folders to separate environments (e.g., dev, staging, prod) allows you to apply IAM policies and organization policies at the folder level, which are inherited by all projects within that folder. This enforces consistent security controls and resource governance across each environment, a key DevOps practice for managing lifecycle and access boundaries.

Answer

Grant the Owner role to a group of DevOps engineers to manage all projects.

Answer

Store service account keys in the source code repository for ease of use.

Answer

Create a single VPC network for all environments to simplify management.

Question 11

Which THREE actions should be taken to ensure compliance with the principle of least privilege when bootstrapping a Google Cloud organization? (Choose 3)

Accepted Answer

Use service accounts for automated processes and grant them the minimum required roles.. Service accounts are the recommended identity for automated processes in Google Cloud, and granting them only the minimum required roles directly implements the principle of least privilege. This prevents over-permissioning and reduces the attack surface for automated workflows.

Answer

Assign the Owner role at the organization level to a small group of administrators.

Answer

Use primitive roles (Owner, Editor, Viewer) to simplify management.

Question 12

Which TWO are benefits of using a shared VPC in a Google Cloud organization? (Choose 2)

Accepted Answer

Centralized management of network resources.. A shared VPC allows network resources (subnets, routes, firewalls) to be defined in a host project and consumed by multiple service projects, enabling centralized management. This reduces administrative overhead by having a single network team control the VPC configuration rather than each project managing its own.

Answer

Eliminates the need for project administrators to have any IAM roles.

Answer

Ensures compliance with organizational policies.

Answer

Automatically enables required APIs in all service projects.

Question 13

Your organization is bootstrapping a new Google Cloud environment for a DevOps team. The team consists of 15 engineers who will be working on multiple microservices deployed across several projects. You have created a folder called 'devops' under the organization node. Within this folder, you plan to create three projects: 'devops-dev', 'devops-staging', and 'devops-prod'. You want to enforce that all resources in these projects are created in a specific region (us-central1) and that no external IP addresses can be assigned to Compute Engine instances. Additionally, you want to ensure that all service accounts used by the applications have minimal permissions. After setting up the organization policies, you notice that a developer was able to create a Compute Engine instance with an external IP in the 'devops-dev' project. You check the organization policy constraints and find that the constraint 'compute.vmExternalIpAccess' is set to 'Deny' at the organization level, but the developer bypassed it. What is the most likely reason?

Accepted Answer

The project 'devops-dev' has a policy that overrides the organization-level deny.. Organization policies can be overridden at a lower level in the resource hierarchy. Even though the constraint 'compute.vmExternalIpAccess' is set to 'Deny' at the organization level, a policy at the project level (or folder level) with a higher priority or a different binding can allow external IPs. In Google Cloud, organization policies are inherited by default, but a child policy can override the parent if it is explicitly set to 'Allow' or if the deny list is not enforced. The developer likely had a project-level policy that allowed external IPs, bypassing the organization-level deny.

Answer

The organization policy has not propagated to all projects yet.

Answer

The developer used the wrong constraint name; the correct constraint is 'compute.restrictExternalIp'.

Answer

The developer tagged the instance with a tag that exempts it from the organization policy.

Question 14

You are a DevOps engineer tasked with bootstrapping a Google Cloud organization for a company that develops a SaaS product. The company has three teams: Platform, Application, and Data. Each team needs to manage their own projects, but the network should be centrally managed. You decide to use a shared VPC. You create a host project 'shared-vpc-host' and attach three service projects: 'platform-service', 'app-service', and 'data-service'. You grant the Network Admin role to the Platform team for the host project. The Application team needs to deploy Compute Engine instances in their service project, but they should not be able to modify network resources. You grant them the Compute Instance Admin role at the service project level. However, the Application team reports that they cannot create instances because they don't have permission to use the subnets in the shared VPC. What is the most likely missing step?

Accepted Answer

Grant the Application team the Compute Network User role on the host project or the specific subnets.. The Application team needs the Compute Network User role (roles/compute.networkUser) on the host project or the specific subnets to use the shared VPC subnets. This role allows them to attach instances to existing subnets without granting permission to modify network resources. Granting it at the service project level (Option B) is insufficient because the subnet permissions are inherited from the host project in a shared VPC setup.

Answer

Grant the Application team the Compute Network Admin role on the host project.

Answer

Grant the Application team the Compute Network User role on the service project.

Answer

Grant the Application team the roles/compute.subnetUser on the subnet.

Question 15

Your organization requires that all new Google Cloud projects are automatically configured with a common set of VPC networks and subnets, and that these networks must be created before any resources are deployed. What is the best approach to enforce this requirement across the organization?

Accepted Answer

Use Organization Policies with a custom constraint to enforce that all projects must have a specific VPC network configuration.. Organization Policies with custom constraints allow you to enforce that all new projects automatically include specific VPC networks and subnets before any resources are deployed. This is the only approach that provides mandatory, organization-wide enforcement at the project creation level, ensuring compliance without relying on manual templates or post-creation configuration.

Answer

Create a Cloud Deployment Manager template and share it with all project owners.

Answer

Set up VPC Network Peering between all projects to enforce network connectivity.

Answer

Configure a shared VPC host project and attach all new service projects to it.

Question 16

An organization is bootstrapping its Google Cloud environment and needs to establish a secure CI/CD pipeline that deploys infrastructure using Terraform. The pipeline must run in a dedicated project, and Terraform state must be stored in a Cloud Storage bucket. What is the most secure way to grant the CI/CD service account the minimal permissions required to manage the state bucket?

Accepted Answer

Grant the service account the Storage Object Admin role on the specific Cloud Storage bucket.. Granting the Storage Object Admin role (roles/storage.objectAdmin) on the specific Cloud Storage bucket follows the principle of least privilege. This allows the CI/CD service account to manage objects (including Terraform state files) within that bucket without granting broader permissions to other buckets or project-level storage operations. The pipeline runs in a dedicated project, but the state bucket itself is the resource that needs access control, making a resource-level role assignment the most secure approach.

Answer

Grant the service account the Storage Object Admin role on the service account itself.

Answer

Grant the service account the Storage Object Admin role at the project level.

Answer

Grant the service account the Storage Admin role at the project level.

Question 17

A DevOps team is setting up a new Google Cloud organization. They want to enforce that all projects have a specific set of labels, and that Cloud Logging is enabled. They have written a custom Organization Policy constraint to enforce the labels. However, they are unsure how to enforce Cloud Logging. Which of the following approaches should they use?

Accepted Answer

Create a custom Organization Policy constraint that checks if Cloud Logging is enabled.. There is no built-in Organization Policy constraint that enforces Cloud Logging for all projects. The constraint `constraints/gcp.resourceAuditLoggingExemption` only prevents exemptions from audit logging, not all Cloud Logging. Therefore, the team must create a custom Organization Policy constraint to check whether Cloud Logging is enabled, as this is the only way to meet their requirement using Organization Policies.

Answer

Disable the ability to turn off Cloud Logging by using the Organization Policy 'compute.disableCloudLogging'.

Answer

Use the built-in Organization Policy constraint 'constraints/gcp.resourceAuditLoggingExemption' to enforce audit logging.

Answer

Set a project-level default for Cloud Logging using Organization Policies.

Question 18

During the bootstrapping of a Google Cloud organization, you need to create a shared CI/CD pipeline that can deploy resources to multiple projects. The pipeline must use a service account with minimal permissions. What is the recommended way to grant the pipeline service account permissions to deploy resources across projects?

Accepted Answer

Grant the service account the necessary roles on each target project individually.. Granting the service account the necessary roles (e.g., roles/container.developer, roles/storage.admin) on each target project directly provides the least-privilege access needed for cross-project deployments. Option A is incorrect because impersonation adds unnecessary complexity and does not inherently reduce permissions. Option C is incorrect because the Project Editor role at the organization level grants broad permissions across all projects, violating the principle of minimal permissions. Option D is incorrect because the Cloud Build service account is designed for Cloud Build itself, not for a custom CI/CD pipeline; using it would require additional configuration and may not align with the pipeline's service account requirements.

Answer

Configure the pipeline to impersonate a project-level service account in each project.

Answer

Grant the service account the Project Editor role at the organization level.

Answer

Use the Cloud Build service account and grant it permissions on each project.

Question 19

Your organization has multiple teams that need to deploy infrastructure using Terraform. You want to enforce that all Terraform state files are stored in a central Cloud Storage bucket with versioning enabled. You also need to ensure that only the CI/CD pipeline can write to the bucket. What is the best way to enforce this?

Accepted Answer

Use IAM conditions to restrict access to the bucket only when the requester is the CI/CD service account.. IAM conditions allow you to bind a role to a principal (the CI/CD service account) and then restrict access based on attributes of the request, such as the requester's identity. By using a condition that checks `iam.googleapis.com/principal` equals the CI/CD service account email, you ensure that only that specific service account can write to the bucket, even if other principals have the role. This enforces the policy without relying on network constructs or overly broad role assignments.

Answer

Use VPC Service Controls to restrict access to the bucket from only the CI/CD pipeline's VPC.

Answer

Create a custom IAM role with permissions to write to the bucket and assign it to the CI/CD service account.

Answer

Grant the Storage Object Admin role to the CI/CD service account at the bucket level.

Question 20

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Hosting shared CI/CD tools and artifacts in a dedicated project follows the principle of resource isolation and centralized management. This approach simplifies access control, cost tracking, and lifecycle management for DevOps pipelines, as the project acts as a single source of truth for build outputs and deployment tools.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.