CCNA Setting Up a Cloud Solution Environment Questions

gcloud config configurations (also called profiles) let you create and store named sets of properties including project, account, and region, then switch between them instantly with 'gcloud config configurations activate PROFILE'. Each profile can have its own authenticated credentials because 'gcloud auth login' can be run while a profile is active, so you can maintain distinct identities and project scopes simultaneously — this is the built-in, designed mechanism for multi-project management.

The Owner basic role is the highest-level predefined role in Cloud IAM, encompassing all Editor permissions plus the ability to manage IAM policies, set billing accounts, and configure organization-level settings when applied at the project or organization level. An Owner can grant any role to any principal, including making another user an Owner, and can view or change the project's billing account and payment details. This role is typically reserved for a small number of administrators because it provides unrestricted management of the project and its entire resource hierarchy.

Folders in the Google Cloud resource hierarchy allow you to organize projects under the organization node, and you can apply IAM policies and organization policies at the folder level, which are inherited by all projects within. This gives you a natural separation between dev, staging, and prod while enabling consistent controls, e.g., different approval workflows or network configurations. Placing projects in environment-specific folders is the standard best practice for multi-environment governance.

Organization policies allow hierarchical enforcement of constraints like allowed machine types.

This is the canonical command for creating a new Google Cloud project via the CLI. It calls the Cloud Resource Manager projects.create API method, and requires the resourcemanager.projects.create permission (provided by the Project Creator IAM role). The command returns a project ID and number, and initially places the project in the 'ACTIVE' lifecycle state unless an organization policy restricts it. Use `--organization` or `--folder` flags to specify the parent resource.

Applying a folder-level IAM deny policy that denies compute.instances.create with a condition on resource.location is the correct approach because IAM conditions are evaluated at access time against the requested resource's attributes. You can specify that the request is denied unless resource.location is one of the allowed regions, and this applies to all projects in the folder. Deny policies override any allow bindings chain-wide, providing deterministic enforcement that works for Console, CLI, and API calls.

gcloud projects list is correct: it calls the Cloud Resource Manager API (projects.list) and returns all projects that your authenticated account has permission to view, including those from your organization if you have the appropriate IAM roles. It supports flags like --filter, --limit, and --format to narrow and shape the output. This is the standard, documented command for enumerating projects.

Creating a BigQuery dataset is the necessary container that receives the exported billing tables. When you configure billing export, you must specify an already-existing dataset in the selected project; the export then creates and manages the underlying tables (e.g., `gcp_billing_export_v1_*`) within that dataset. Without a dataset, the billing export setup page in the Cloud Console will not allow you to proceed.

Cloud Shell is a web-based terminal that launches directly from the Google Cloud Console, giving you authenticated command-line access to your GCP environment without needing to install the Google Cloud SDK locally. It automatically authenticates you using the same credentials as the console, and it also sets the current project so you can immediately run gcloud commands. This integration makes it the quickest way to test API calls, run kubectl against GKE clusters, or inspect resources while staying in the browser.

Folders allow grouping projects per department.

gcloud auth login is the correct command because it launches an OAuth 2.0 authorization flow, typically opening a browser where the developer signs in with their Google account and grants consent to GCP scopes. Upon successful authentication, it saves the resulting user credentials in the credentials directory and sets them as the active account for subsequent gcloud CLI operations. This is the standard, direct way for a human developer to authenticate the gcloud command-line tool with their personal or Google Workspace user identity from a local machine.

Cloud Build (cloudbuild.googleapis.com) is the managed CI/CD service used to compile source code and build container images. For microservices, each service is typically packaged as a separate container, and Cloud Build provides a reliable, serverless way to automate those builds via triggers and build steps. It integrates with Artifact Registry to store the resulting images, which are then deployed to GKE, making it a common and often essential part of a microservices deployment pipeline.

Correct.

gcloud init is the intended bootstrap command for a new user because it performs the entire initial setup in one interactive flow: authenticating your Google account via the browser, then prompting you to choose or create a default project and set a default compute region/zone. It writes the resulting credentials and configuration properties into the active gcloud configuration file, leaving your environment ready for immediate use. This one-command workflow is exactly why it's the recommended starting point on a fresh workstation.

Billing reports in Cloud Console support filtering by resource labels, which can be applied at project or resource level. By assigning a label like 'department=marketing' to resources, you can view cost breakdowns per department directly in the billing reports. This is the intended lightweight method for cost allocation without additional data processing.

Cloud Shell provides each user with a persistent 5 GB home directory stored on a zonal persistent disk that is independent of the underlying compute instance. Because it is not tied to the VM's lifecycle, files you create remain available across all future Cloud Shell sessions, making it a reliable place to keep small scripts or configuration files.

The Cloud Billing Reports page provides a native console view of cost data and includes filtering by labels such as 'department'. Once you select the appropriate time range and filter by the 'department' label, the report dynamically groups costs by that label, giving you the required department-level breakdown instantly and without any additional configuration. This is the correct and most direct tool for this task.

The gcp.resourceLocations organization policy constraint is a list constraint that defines the exact set of Google Cloud locations where new resources, including Compute Engine instances, may be created. Setting it to allow only us-central1 and europe-west1 at the organization or folder level makes non-compliance impossible at creation time, since the API call itself is rejected. This is a preventive, centralized governance mechanism that is inheritable across projects, making it the correct solution for enforcing geographic restrictions.

Correct.

This predefined role contains only read permissions for Compute Engine resources, including instances, disks, images, snapshots, instance templates, and usage metrics, and it allows you to see them in the Cloud Console without any write or administrative actions. It precisely matches the contractor's access need and nothing more, upholding the principle of least privilege. As the correct answer, it is the best fit for granting read-only access to Compute Engine resources only.

gcloud init is the correct command because it performs a complete guided initialization of the local gcloud environment: it authenticates using either a user account or service account, sets a default project, and optionally configures compute/region and compute/zone properties in a new or existing configuration. It also runs an initial diagnostic to verify the installation and, if needed, can re-initialize an existing configuration. This one command provides the foundational project and location context that other gcloud commands depend on.

Before a GCP project can be deleted, its billing account attachment must be removed by disabling billing or unlinking the billing account. GCP will reject the deletion if the project is still linked to an active Cloud Billing account, returning an error such as 'Project is linked to a billing account'. You must disable the project's billing association first, then retry the deletion. This is the typical failure after creating a new project because billing is enabled by default.

Configuring two budget alerts at 80% and 100% satisfies the requirement precisely: the 80% threshold warns you that costs are approaching the limit while there is still time to act, and the 100% threshold notifies you the moment the budget is fully consumed. Google Cloud's budget feature allows multiple alert thresholds on the same budget, each published to your selected notification channels. This approach avoids alert fatigue and covers both proactive and reactive notification needs.

The correct answer is that a linked billing account prevents project deletion. Google Cloud requires you to disable billing for a project before it can be deleted, because deletion finalizes cost responsibility and prevents accidental ongoing charges. The console will display an error such as 'Billing must be disabled' if the project is still linked to a billing account. You must detach the billing account or disable the project's billing, then initiate the deletion process.

This command correctly configures the official Cloud SDK apt repository on a Debian or Ubuntu system by appending a sources.list entry with the signed-by parameter pointing to the imported Google signing key at /usr/share/keyrings/cloud.google.gpg. Using signed-by binds the repository to that specific key instead of trusting the global apt keyring, which is the recommended security practice. After running this, you still need to run sudo apt-get update and sudo apt-get install google-cloud-sdk, but this repository definition is the essential correct foundation for the package-manager installation method.

This is the correct command to enable the Compute Engine API. `gcloud services enable compute.googleapis.com` tells the Service Usage API to enable the service in the current project. It uses the fully-qualified service name and is the standard gcloud method for this operation. After running it, you can create and manage Compute Engine instances via gcloud or the Console.

The correct way to set the default project is `gcloud config set project my-project`, which updates the active configuration's core project property. The zone must be set as `compute/zone` because it belongs to the compute section of the property hierarchy; `gcloud config set compute/zone us-central1-a` is the accepted syntax. Together these commands ensure that subsequent gcloud commands automatically use the intended project and zone, which is essential for quick CLI workflows.

'gcloud services enable compute.googleapis.com' is the correct command to enable the Compute Engine API for the active project. The 'gcloud services' command group interacts with the Service Usage API to manage service availability. This command uses the fully qualified service name 'compute.googleapis.com', which is required for successful enablement. You can also specify a project with the '--project' flag if the API should be enabled for a different project than the current one.

Folders provide logical grouping and policy inheritance.

Correct. The billing.accounts.list permission is the specific IAM permission that allows a principal to enumerate the billing accounts they can access. Including this permission in the custom role is essential and sufficient for the read-only task of listing billing accounts; without it, any API call or console view that attempts to list billing accounts will fail with a permission denied error.

Creating one budget with three threshold rules is the recommended and most efficient approach because Cloud Billing budgets natively support multiple thresholds—each can be a percentage of the budget amount and trigger an alert independently. For example, you can set actual-cost thresholds at 50%, 90%, and 100%, and optionally add forecasted-cost thresholds as well. This gives you the desired notification at each stage without duplicating budget resources.

The command `gcloud auth activate-service-account --key-file=KEY_FILE` is the correct way to authenticate gcloud with a service account using its private key JSON file. It reads the key file, derives the service account email, and establishes that identity as the active authenticated account for gcloud CLI operations. This command both authenticates and activates the service account in one step, enabling subsequent gcloud commands to inherit that identity.

Global external HTTPS load balancing leverages a single anycast IP address and Google's global backbone to forward each user request to the optimal backend based on latency and health. It performs traffic distribution at L7 to the nearest available region, allowing active/active serving across multiple regions without DNS round-robin. This is the standard control plane that unifies multi-region deployments into one global endpoint.

Creating a budget in the Cloud Billing console is the foundational action that enables all budget alerting. You define the total budget amount, optionally scope it to specific projects, folders, or billing accounts, and then attach alert threshold rules. Without an actual budget object, there is nothing to trigger a notification, so this is the non-negotiable first step in the workflow.

gcloud config set project PROJECT_ID is the correct command because it updates the core/project property in the active gcloud configuration. This directly sets the default project used by subsequent gcloud commands when no --project flag or CLOUDSDK_CORE_PROJECT environment variable is provided. It is the standard, non-interactive method to change the current default project within a given configuration.

The organization node is the root of the GCP resource hierarchy, and it is the correct place to attach an organization-wide policy. Any IAM role binding or organization policy constraint set at this level is inherited by every folder, project, and resource in the hierarchy, thereby ensuring the policy is enforced across all projects while also applying automatically to any future projects created under the organization.

Organization policy constraints are centralized guardrails evaluated by Google Cloud Resource Manager before IAM. Applying a boolean constraint such as `constraints/resourcemanager.projectDelete` at the organization or folder level explicitly denies the `resourcemanager.projects.delete` action for every principal, overriding project-level IAM roles. This makes it an authoritative, non-bypassable control that prevents a production project from being deleted from any console or API path.

Cloud Build is Google Cloud's CI/CD service that can compile source code and build Docker container images. If the engineer's containerized application is built from a repository, enabling cloudbuild.googleapis.com is required before Cloud Build can push built images to Container Registry or Artifact Registry. Thus, for a project that automates image creation for GKE, this API is a correct and necessary dependency.

Running `gcloud config list` displays all the active property settings in your current gcloud configuration, such as account, project, and compute region/zone, in a clean key=value format. You can use `gcloud config list --all` to view every settable property, including those with unset defaults. This is the standard, most direct way to inspect your working configuration.

Cloud Shell provides a temporary, ephemeral VM, but your home directory is backed by a persistent 5 GB disk in Google-managed storage. That 5 GB is the permanent part of the environment — it survives session restarts, VM recycling, and timeouts. This means any files you save under $HOME, including SSH keys, configuration files, and scripts, remain available across all future Cloud Shell sessions, while the compute instance itself is recreated as needed.

Enabling billing export to BigQuery in the Cloud Billing console is the native, fully managed integration for this use case. It automatically creates a set of BigQuery tables (e.g., gcp_billing_export_resource_v1) that contain detailed line items including cost, usage, labels, and resource hierarchy, updated on an ongoing basis. This export requires no custom code and provides the historical, labelled data needed to track and forecast GCP spending across departments using standard SQL and BI tools.

This is the correct command: `gcloud iam roles create` creates a custom role scoped to the specified project, and the `--permissions` flag explicitly lists the two required read-only permissions. Using specific permission names without wildcards enforces least privilege and aligns with IAM's requirement for fully qualified permission identifiers. The resulting role can then be bound to users or groups with `gcloud projects add-iam-policy-binding`.

Correct. Cloud Shell provisions a 5 GB persistent home directory, mounted at $HOME, that survives between sessions. This is the documented, fixed quota for free Cloud Shell usage, regardless of session time or usage patterns.

This is the correct setup sequence for local development. First, `gcloud auth login` authenticates your user account and stores credentials for gcloud CLI commands in the user's config directory. Then, `gcloud auth application-default login` creates the `application_default_credentials.json` file, which allows Google Cloud client libraries to discover credentials via Application Default Credentials. Having both ensures gcloud and code-based SDKs use the same identity.

The correct method is to first run gcloud config configurations create prod, which generates a new empty named configuration and automatically activates it. With the prod configuration active, gcloud config set project prod-project then sets the project property for that configuration, providing a clean, isolated environment for managing the prod project.

gcloud auth application-default login is the correct command because it explicitly generates Application Default Credentials, storing them in the standard location (typically ~/.config/gcloud/application_default_credentials.json). These credentials are then picked up automatically by Google Cloud client libraries when no explicit service account key is supplied, enabling local development to use your user account's permissions as ADC.

Cloud Shell automatically mounts a persistent home directory at ~ on a small but durable disk that is attached to your user profile across sessions. Any files, Bash scripts, or gcloud configuration files you place in ~ remain available even when the underlying VM is replaced. This is the intended and simplest way to preserve your work in Cloud Shell, and it also houses the .config directories used by gcloud.

Exporting detailed billing data to BigQuery is the correct approach because it automatically creates and maintains tables like `gcp_billing_export_v1` within your project's BigQuery dataset. Every project that shares the billing account is included, and you can immediately run SQL queries to analyze costs by project, service, SKU, or label, as well as build dashboards and scheduled queries. This export is the official Google-recommended method for centrally managing and analyzing billing information across an organization.

This command explicitly associates a specified project with a specified billing account. It is the standard gcloud operation for setting up the billing relationship after project creation, enabling the project to consume paid services. The command requires both the project ID and the billing account ID as arguments, and it performs an API call to the Cloud Billing API. Once run, the project's billing is active and can be used for resource consumption.

Organization policies — The Organization Policy service is the correct mechanism for centrally governing multiple projects. It applies constraints like `compute.vmExternalIpAccess` or `iam.disableServiceAccountKeyCreation` at the organization, folder, or project level, and these constraints are inherited by all descendant resources. This provides a hierarchy-wide, enforceable governance layer that either permits or denies certain API calls before they execute. It directly meets the requirement to manage and enforce rules across all projects in the organization.

Creating one budget per project and setting the 'Scoped to' field to that project is the correct, efficient approach. In the Google Cloud console, budgets are created at the billing account level but can be scoped to a specific project, which allows the budget amount and alert thresholds to apply exclusively to that project's costs. This directly enables per-department tracking if each department maps to a project, and it provides native budget alert notifications, exactly as required.

Enabling the Compute Engine API requires the project to have a billing account associated with it, because even though Compute Engine offers a free tier, the service's resource management, quotas, and metering are tied to billing to prevent abuse and allow for usage tracking. When a project has no billing account, the Service Usage API returns an error like "Billing account must be linked to project" or "Billing is required for usage", and this occurs regardless of the user's IAM role or authentication state. Associating a billing account at the project level—through the Cloud Console or the gcloud billing projects link command—is the prerequisite that resolves this error.

Applying organization policies at the folder level is correct because constraints are inherited by all projects and subfolders under that folder. For example, the compute.skipDefaultNetworkCreation constraint can be set at a folder to prevent any project inside it from creating the default VPC network at project creation time. This ensures consistent, centrally managed governance across an entire team or environment without needing to configure each project individually.

gcloud projects create PROJECT_ID is the correct command because it sends a create request to the Cloud Resource Manager API, which provisions a new project with the specified ID. This command requires the resourcemanager.projects.create permission and the PROJECT_ID must be globally unique across all Google Cloud projects. Once created, the project can be used for development and managed via gcloud.

This role is scoped specifically to compute instances. It allows creating, deleting, starting, stopping, and modifying instances, but not managing networks, subnets, firewalls, or other global Compute Engine resources. This is the correct least-privilege choice because it covers all instance lifecycle operations without granting access to the broader infrastructure.

gcloud services enable compute.googleapis.com is the correct command to enable the Compute Engine API in the current project. It interacts with the Service Usage API to set the service's enabled state for the active project. After running this command, you can start using Compute Engine features, assuming a billing account is linked and the IAM permission serviceusage.services.enable is granted. The full service name compute.googleapis.com uniquely identifies the API.

Cloud Shell provisions an ephemeral VM but attaches a persistent 5 GB home directory for each user. gcloud configurations are stored as files under ~/.config/gcloud, so whenever the developer runs `gcloud config set project`, the value is written to disk and remains available in future sessions. When the session ends, any new VM in a future session mounts the same home directory, preserving the settings automatically.

An organization policy with the constraints/gcp-resource-locations constraint defines an explicit allowlist of regions where resources can be created. When set at the organization, folder, or project level, it is enforced synchronously at resource creation time, and any API request targeting a location outside the allowlist is rejected with an error. This is the intended, preventative control for enforcing data residency or regulatory location requirements across Google Cloud.

The primary purpose of gcloud init is to bootstrap the gcloud command-line tool by creating a new configuration, authenticating with your Google account or service account, and setting properties like the default project, region, and zone. It is the standard first step when installing or reinstalling the gcloud SDK on a new machine or for setting up an isolated environment.

Creating multiple named configurations with gcloud config configurations create and activating them via gcloud config configurations activate is the officially recommended pattern for frequent context switching. Each configuration stores its own project, account, region, and other properties, so you can define a distinct environment for every GCP project or workflow. Activation is instantaneous and deterministic, and you can even use the --configuration flag to run a single command in a non-default configuration without changing your active context, enabling safe automation and parallel work.

Activates an existing configuration.

This is the correct sequence: adding the user to Cloud Identity provisions a managed user account in your organization's directory, which then can be used as a principal in IAM. After the user exists, you grant the appropriate IAM role on the project, and the user can authenticate via their new Cloud Identity account and receive the role's permissions. Without that initial provisioning, the IAM role cannot be assigned to the user at all.

gcloud services enable compute.googleapis.com is the correct command to enable the Compute Engine API for a project. The gcloud services enable command accepts the fully qualified service name (compute.googleapis.com) and provisions access for the project, making it available for use with gcloud compute commands, API calls, and console operations. This is the standard, documented way to turn on a Google API in a project.

The correct command to enable the Kubernetes Engine API is `gcloud services enable container.googleapis.com`. This calls the Service Usage API to activate the service in the current Google Cloud project, making it possible to later create and manage GKE clusters. Enabling the API is a prerequisite that also links the service to the project's billing account; until this is done, any GKE resource creation will fail with an error indicating the API is disabled.

roles/bigquery.dataEditor is the correct choice because it provides the necessary permissions for a data analyst to run queries, including bigquery.jobs.create to execute query jobs and bigquery.tables.getData to read table contents. It also allows creating and updating tables within datasets, striking the right balance between access and control. Unlike broader roles, it does not grant dataset-level deletion or permission management, aligning with the principle of least privilege for a typical analyst use case.

Folders are correct because they serve as intermediate grouping nodes within the resource hierarchy, sitting directly below an Organization and above Projects. They allow you to group teams, products, or departments and apply IAM policies and organization policies at that group level, which are inherited by all contained projects. Folders can also nest other folders, enabling multi-level administrative boundaries that align with corporate structure.

Use an organization policy with the constraints/serviceusage.services constraint on the organization, folder, or project to define an allowlist of Google API service names, such as compute.googleapis.com and storage.googleapis.com. This policy is enforced at access time and inherited hierarchically, so no project-level IAM change can bypass the allowed set. It is the proper guardrail to ensure that only approved APIs can be enabled across a new project, regardless of who holds IAM permissions.

Folders are hierarchical containers that sit between the organization node and projects, allowing you to group projects based on business units, teams, or deployment stages (e.g., development, staging, production). As nodes in the resource hierarchy, folders inherit policies from the organization node and propagate their own IAM policies and resource constraints to all projects and folders underneath them, making them a correct and essential component for organizing GCP resources.

An organization policy custom constraint (e.g., a CEL-based constraint on the resource's `labels` field) is evaluated synchronously when a create or update request is made, and the request is rejected if the labels do not satisfy the rule. This is the only option that provides native, proactive enforcement at the API layer, preventing unlabeled resources from being created across supported GCP services. You can define it in the Resource Manager and attach it at the organization, folder, or project level.

The home directory ($HOME) in Cloud Shell is the designated persistent storage area, backed by a 5GB disk that survives across sessions and idle timeouts. Files saved there, including Terraform state files, are retained for later use and are protected from session cleanup. This makes $HOME the simplest and correct choice for persisting state in a personal Cloud Shell environment.

Cloud Identity requires proof that you own the custom domain (e.g., @yourdomain.com) before it can create user accounts and manage access for that domain. You must add a unique verification code as a DNS TXT record, or follow the alternate HTML file method, to prove control of the domain. Without this step, Google cannot legally or technically assign identity administration to your domain.

Organization policies are the correct tool because they directly enforce restrictions on resource configurations across the entire hierarchy (folders and projects). For example, the compute.vmExternalIpAccess constraint can be set to only allow certain VMs to have external IPs, or require a dedicated VPC peering. They act as guardian rules that cannot be overridden by users without the necessary admin permissions.

The correct command is `gcloud services enable compute.googleapis.com`. The `gcloud services` group is the standard interface for enabling and disabling Google Cloud APIs, and `compute.googleapis.com` is the unique service name for Compute Engine. This command works asynchronously, so you can verify the operation with `gcloud services list --enabled` or the console. It requires the `serviceusage.services.enable` IAM permission on the project.