Google Professional Cloud DevOps Engineer
QUESTIONS AND ANSWERS | VERIFIED AND WELL
DETAILED ANSWERS | PLUS RATIONALES |
GUARANTEED PASS | LATEST EXAM UPDATE EXAM
PREP | STUDY GUIDE | PRACTICE TEST
, Section 1: Bootstrapping a Google Cloud Organization for DevOps (20 Questions)
1. Your organization is adopting Infrastructure as Code (IaC) and wants to ensure that all Google Cloud
resources are created and managed exclusively through Terraform. You need to enforce this policy across all
projects. What should you do?
A) Create a custom IAM role that only allows Terraform service accounts to create resources.
B) Use an Organization Policy constraint to restrict resource creation to specific principals.
C) Implement a CI/CD pipeline that runs `terraform plan` and requires manual approval.
D) Use Forseti Security to scan for and delete resources not created by Terraform.
Answer: B
Rationale: Organization Policy constraints (like `constraints/iam.allowedPolicyMemberDomains` or custom
constraints) are the most effective way to enforce broad, organization-wide guardrails. While IAM is crucial, an
Org Policy can specifically deny actions unless a certain condition is met, providing a strong enforcement
mechanism. Option A is too complex and brittle. Option C is a good practice but doesn't *enforce* the policy, as
someone could still create resources manually. Option D is a reactive, not preventive, control.
, 2. You are setting up a new project for a development team. The team needs to be able to create and manage
Compute Engine instances but should not be able to modify the project's IAM policy. Which IAM role should you
grant them?
A) roles/compute.admin
B) roles/editor
C) roles/compute.instanceAdmin.v1
D) roles/resourcemanager.projectIamAdmin
Answer: C
Rationale: `roles/compute.instanceAdmin.v1` grants full control over Compute Engine instances but not over
the project's IAM policy. `roles/compute.admin` includes permissions to manage IAM policies for Compute
Engine resources, which is more than required. `roles/editor` is too broad and would allow them to modify IAM
policies (if they have the `setIamPolicy` permission on the project, which Editor does not, but it's still too broad
for the principle of least privilege). `roles/resourcemanager.projectIamAdmin` is the opposite of what they need.
3. Your company has a strict security policy that requires all network traffic between on-premises and Google
Cloud to be encrypted and traverse a dedicated private connection. Which Google Cloud service should you
use?
A) Cloud VPN
, B) Cloud Interconnect
C) VPC Peering
D) Cloud NAT
Answer: B
Rationale: Cloud Interconnect provides a dedicated, private connection between on-premises and Google
Cloud. Cloud VPN uses the public internet (though encrypted). VPC Peering connects two VPC networks within
Google Cloud. Cloud NAT provides outbound internet access for resources without external IPs.
4. You need to grant a CI/CD pipeline in Project A the ability to deploy resources into Project B. What is the
most secure and manageable way to grant this access?
A) Create a service account in Project A, grant it the necessary roles in Project B, and give the service account
key to the CI/CD pipeline.
B) Create a service account in Project B, grant it the necessary roles in Project B, and allow the CI/CD pipeline
in Project A to impersonate it.
C) Grant the CI/CD pipeline's service account the `roles/editor` role on Project B.
D) Use a single, shared service account with a key that is accessible to all projects.
Answer: B
QUESTIONS AND ANSWERS | VERIFIED AND WELL
DETAILED ANSWERS | PLUS RATIONALES |
GUARANTEED PASS | LATEST EXAM UPDATE EXAM
PREP | STUDY GUIDE | PRACTICE TEST
, Section 1: Bootstrapping a Google Cloud Organization for DevOps (20 Questions)
1. Your organization is adopting Infrastructure as Code (IaC) and wants to ensure that all Google Cloud
resources are created and managed exclusively through Terraform. You need to enforce this policy across all
projects. What should you do?
A) Create a custom IAM role that only allows Terraform service accounts to create resources.
B) Use an Organization Policy constraint to restrict resource creation to specific principals.
C) Implement a CI/CD pipeline that runs `terraform plan` and requires manual approval.
D) Use Forseti Security to scan for and delete resources not created by Terraform.
Answer: B
Rationale: Organization Policy constraints (like `constraints/iam.allowedPolicyMemberDomains` or custom
constraints) are the most effective way to enforce broad, organization-wide guardrails. While IAM is crucial, an
Org Policy can specifically deny actions unless a certain condition is met, providing a strong enforcement
mechanism. Option A is too complex and brittle. Option C is a good practice but doesn't *enforce* the policy, as
someone could still create resources manually. Option D is a reactive, not preventive, control.
, 2. You are setting up a new project for a development team. The team needs to be able to create and manage
Compute Engine instances but should not be able to modify the project's IAM policy. Which IAM role should you
grant them?
A) roles/compute.admin
B) roles/editor
C) roles/compute.instanceAdmin.v1
D) roles/resourcemanager.projectIamAdmin
Answer: C
Rationale: `roles/compute.instanceAdmin.v1` grants full control over Compute Engine instances but not over
the project's IAM policy. `roles/compute.admin` includes permissions to manage IAM policies for Compute
Engine resources, which is more than required. `roles/editor` is too broad and would allow them to modify IAM
policies (if they have the `setIamPolicy` permission on the project, which Editor does not, but it's still too broad
for the principle of least privilege). `roles/resourcemanager.projectIamAdmin` is the opposite of what they need.
3. Your company has a strict security policy that requires all network traffic between on-premises and Google
Cloud to be encrypted and traverse a dedicated private connection. Which Google Cloud service should you
use?
A) Cloud VPN
, B) Cloud Interconnect
C) VPC Peering
D) Cloud NAT
Answer: B
Rationale: Cloud Interconnect provides a dedicated, private connection between on-premises and Google
Cloud. Cloud VPN uses the public internet (though encrypted). VPC Peering connects two VPC networks within
Google Cloud. Cloud NAT provides outbound internet access for resources without external IPs.
4. You need to grant a CI/CD pipeline in Project A the ability to deploy resources into Project B. What is the
most secure and manageable way to grant this access?
A) Create a service account in Project A, grant it the necessary roles in Project B, and give the service account
key to the CI/CD pipeline.
B) Create a service account in Project B, grant it the necessary roles in Project B, and allow the CI/CD pipeline
in Project A to impersonate it.
C) Grant the CI/CD pipeline's service account the `roles/editor` role on Project B.
D) Use a single, shared service account with a key that is accessible to all projects.
Answer: B
