PCDOE Practice Question: Bootstrapping a Google Cloud organization for DevOps
During the bootstrapping of a Google Cloud organization, the DevOps team wants to implement a policy that prevents the deletion of certain resources, such as Cloud Storage buckets or Cloud SQL instances, unless a specific approval process is followed. Which approach best achieves this goal?
⚠ Common exam trap
Many candidates confuse Binary Authorization (which handles container deployment approvals) with a general-purpose approval system, or assume VPC Service Controls can block deletion when they are actually focused on data exfiltration prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Resource Manager locks on projects and set up a Cloud Function that triggers on audit logs to require approval before removing the lock.
Resource Manager locks prevent accidental deletion of critical resources by placing a deletion prevention lock on the project or resource hierarchy. By combining this with a Cloud Function that monitors audit logs for lock removal attempts and requires an approval workflow before the lock is removed, the team enforces a controlled approval process for any deletion, meeting the policy requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Cloud Source Repositories to require code review for any changes to Terraform configurations that delete resources.
Why it's wrong here
This only controls infrastructure-as-code changes, not direct API calls.
- ✗
Implement Binary Authorization to require approvals for any delete commands.
Why it's wrong here
Binary Authorization is for container deployment, not resource deletion.
- ✓
Use Resource Manager locks on projects and set up a Cloud Function that triggers on audit logs to require approval before removing the lock.
Why this is correct
Locks prevent deletion; Cloud Functions can automate approval workflows.
- ✗
Use VPC Service Controls to block delete operations on specific services.
Why it's wrong here
VPC Service Controls control data exfiltration, not deletion.
Go deeper
Related to this question
About these practice questions
This PCDOE question is part of Courseiva's 486-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.