PCDOE Practice Question: Bootstrapping a Google Cloud organization for DevOps
A company is setting up a new Google Cloud organization for DevOps. They want to enforce that all projects have a specific set of VPC Service Controls perimeters. Which approach should they use to ensure these perimeters are automatically applied to all new projects?
⚠ Common exam trap
Watch out — candidates often confuse VPC Service Controls perimeter membership (which is a resource-level attribute) with organization policy enforcement (which is a hierarchical governance mechanism), leading them to choose Option D or A instead of the correct policy-based approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define an organization policy with a constraint that requires all projects to be within a perimeter.
Google Cloud Organization Policies allow you to define and enforce constraints at the organization, folder, or project level. The `constraints/compute.restrictVpcServiceControls` constraint can be set to require all new projects to be within a specific VPC Service Controls perimeter, ensuring automatic enforcement without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Cloud Shell to run a script that creates a perimeter when a new project is created.
Why it's wrong here
Cloud Shell is not designed for automated enforcement triggers.
- ✓
Define an organization policy with a constraint that requires all projects to be within a perimeter.
Why this is correct
Organization policies can enforce constraints like 'vpcServiceControls' across projects.
- ✗
Use Deployment Manager to deploy a configuration that creates a perimeter for each new project.
Why it's wrong here
This is reactive and not automatic; requires manual trigger or script.
- ✗
Create a VPC Service Controls perimeter and add the organization node as a member.
Why it's wrong here
Perimeters cannot be applied to the organization node directly; they apply to projects.
Go deeper
Related to this question
About these practice questions
One of 486 original PCDOE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.