Bootstrapping and maintaining a Google Cloud organization — PCDE Practice Quiz

Question 1

Your platform team runs an automated project factory using Terraform. A new business unit requests projects, and finance requires that every newly provisioned project is automatically linked to a specific billing account and cannot be moved to a different billing account by project-level users. Which approach best enforces this requirement while keeping the factory fully automated?

Accepted Answer

Have the factory's service account hold roles/billing.user on the billing account, set the billing_account in the google_project resource, and grant project users only roles/viewer so they cannot change billing linkage.

Answer

Grant each project owner the roles/billing.admin role so they can attach the correct billing account during onboarding.

Answer

Manually link billing in the Cloud Console after each Terraform apply and rely on documentation to prevent changes.

Answer

Assign the factory service account roles/billing.creator and let project teams self-manage billing linkage through org policies.

Question 2

Your platform team is designing a CI/CD architecture for a company with separate Google Cloud projects for dev, staging, and production. The security team mandates that a container image which is deployed to production must be the exact same artifact that was tested in staging, and that no image should be rebuilt between environments. You are using Cloud Build and Artifact Registry. Which approach best satisfies these requirements?

Accepted Answer

Build the image once, tag it with the immutable digest, and promote the same image by digest through dev, staging, and production Artifact Registry repositories using a controlled pipeline with Binary Authorization attestations.

Answer

Configure a separate Cloud Build trigger in each environment's project that rebuilds the image from the same Git commit before deploying to that environment.

Answer

Store a single mutable 'latest' tag in one shared Artifact Registry repository and have every environment pull the 'latest' tag at deploy time.

Answer

Build the image in dev, then export the container filesystem as a tarball and re-import it into staging and production registries to guarantee consistency.

Question 3

Your platform team must bootstrap a new Google Cloud organization and standardize how infrastructure resources (projects, GKE clusters, networking) are provisioned declaratively using Kubernetes-style config. Leadership requires a Google-managed solution that runs Config Sync and Policy Controller out of the box, uses Config Connector to reconcile Google Cloud resources via KRM manifests stored in Git, and requires minimal operational maintenance of the underlying control plane. Which approach best meets these requirements?

Accepted Answer

Provision a Config Controller instance in Anthos Config Management, then store KRM manifests in a Git repo that Config Sync applies to reconcile Google Cloud resources.

Answer

Deploy a self-managed GKE cluster, manually install Config Connector, Config Sync, and Policy Controller, and maintain the control plane yourself.

Answer

Use Terraform Cloud with a remote backend to store state and apply all Google Cloud resource changes without any Kubernetes tooling.

Answer

Enable Deployment Manager templates and trigger them from Cloud Build to reconcile resources declaratively.

Question 4

Your organization runs a legacy on-premises batch application that cannot use Workload Identity Federation. It authenticates to Google Cloud APIs using a downloaded service account key. Security has flagged that the key has not been rotated in over a year, and they require a repeatable, automated process that minimizes the window during which any single key is valid while avoiding application downtime. Which approach should you implement?

Accepted Answer

Build an automated pipeline that creates a new service account key, distributes it to the application, verifies successful authentication, and then deletes the previous key on a scheduled cadence.

Answer

Enable an organization policy constraint to disable service account key creation, forcing the application to migrate to Workload Identity Federation immediately.

Answer

Grant the on-premises application's service account the Owner role so the key never needs rotation, and enable audit logging to detect misuse.

Answer

Store the single long-lived key in Secret Manager and rely on Secret Manager versioning, keeping the same underlying service account key indefinitely.

Question 5

Your organization is bootstrapping its Google Cloud environment. The security operations team must automatically receive Google's security-related notifications (such as vulnerability alerts and platform security bulletins) for every project in the organization, while a separate finance team should receive billing notifications. Leadership wants this routing to apply to all current and future projects without manually configuring each project. What is the most effective way to configure this?

Accepted Answer

Set Essential Contacts at the organization node, assigning the security team's email to the 'Security' notification category and the finance team's email to the 'Billing' category, so contacts are inherited by all folders and projects.

Answer

Add both teams as IAM members with the Viewer role at the organization level so they can view all notifications in the Cloud Console.

Answer

Create a Cloud Monitoring notification channel for each team and add alerting policies in every project to forward security and billing events.

Answer

Configure Essential Contacts individually on each project, subscribing the appropriate team to each notification category, and repeat the setup whenever a new project is created.

Question 6

Your organization is bootstrapping its Google Cloud resource hierarchy. Leadership requires that all production workloads for the finance department enforce a policy denying the creation of external IP addresses, while a separate sandbox environment used by developers must allow external IPs for experimentation. You want to design the folder structure and apply organization policies with the least administrative overhead and no risk of the sandbox setting affecting production. How should you structure the hierarchy and apply the constraint?

Accepted Answer

Create a 'finance-prod' folder and a 'sandbox' folder under the organization node; apply the constraints/compute.vmExternalIpAccess deny policy at the 'finance-prod' folder and leave the 'sandbox' folder to inherit the org default.

Answer

Apply the constraints/compute.vmExternalIpAccess deny policy at the organization node, then set an override policy allowing external IPs on every individual project in the sandbox environment.

Answer

Create a single shared folder for both environments and apply the deny policy at the project level only for finance production projects, leaving sandbox projects without any policy.

Answer

Apply the deny policy at the organization node and use IAM Conditions on the sandbox service accounts to grant an exception for creating external IPs.

Question 7

Your organization runs a mix of GKE clusters in Google Cloud and self-managed Kubernetes clusters in an on-premises data center. The platform team wants centralized, secure access to all clusters through a single control point so that developers can run kubectl commands against any cluster without opening inbound firewall ports to the on-premises environment or distributing static kubeconfig credentials. Which approach best meets these requirements?

Accepted Answer

Register all clusters to a fleet and use the Connect gateway with Google Cloud IAM to authenticate and route kubectl traffic outbound from each cluster.

Answer

Expose each on-premises cluster's API server through a public load balancer secured with a firewall allowlist of developer IP ranges.

Answer

Generate long-lived kubeconfig files with cluster admin certificates and distribute them to developers through a shared secret manager.

Answer

Set up a site-to-site VPN and give every developer direct network access to each on-premises cluster's private API endpoint.

Question 8

Your platform team is bootstrapping a new Google Cloud environment for several application teams. Each team will receive its own GKE Autopilot cluster, and the platform team must ensure that every new cluster is automatically enrolled with a baseline set of tooling (namespaces, RBAC roles, resource quotas, and network policies) that stays consistent across all clusters over time. Manual kubectl steps must be eliminated, and the baseline must be enforced continuously so that any drift on a cluster is reverted. Which approach best meets these requirements?

Accepted Answer

Register all clusters into a GKE fleet and use Config Sync (part of Config Management) to continuously reconcile the baseline manifests stored in a Git repository across every fleet member.

Answer

Create a shell script that runs kubectl apply for the baseline manifests and schedule it as a Cloud Scheduler job that targets each cluster's endpoint.

Answer

Add the baseline resources as a Helm chart and have each application team run helm install manually after their cluster is created.

Answer

Store the baseline manifests in Cloud Storage and configure a startup script on each node pool to download and apply them at node boot.

Question 9

Your organization runs an on-premises data center and a Google Cloud environment. The platform team must bootstrap a CI/CD architecture where Cloud Build pipelines deploy artifacts to both GKE clusters on Google Cloud and Kubernetes clusters running in the on-premises data center. The on-premises clusters are not reachable over the public internet, and security policy forbids exposing them with public endpoints. Which approach lets the same Cloud Build pipeline reliably deploy to both environments?

Accepted Answer

Use Cloud Build private pools connected to your VPC, and reach the on-premises clusters over an existing Cloud VPN or Cloud Interconnect through that VPC.

Answer

Grant the Cloud Build default service account the Owner role and let the default worker pool call the on-premises cluster API over the public internet.

Answer

Deploy to GKE from Cloud Build, then manually copy the manifests to a USB drive and apply them on-premises to satisfy the no-public-endpoint policy.

Answer

Expose the on-premises Kubernetes API server through a public load balancer protected only by an IP allowlist of Google's published egress ranges.

Question 10

Your platform team manages infrastructure across Google Cloud and AWS using a single Terraform codebase. You want to bootstrap the tooling so that GCP and AWS resources can be provisioned and destroyed independently, while sharing common module definitions and enabling parallel CI/CD runs without one cloud's failures blocking the other. What is the recommended approach to structure the Terraform configuration?

Accepted Answer

Create separate root configurations (each with its own backend/state) per cloud, referencing shared reusable modules from a versioned module source.

Answer

Place both providers in a single root module with one shared state file, and use provider aliases to distinguish GCP and AWS resources.

Answer

Use a single root configuration but rely on the -target flag in CI to apply only GCP or AWS resources on each run.

Answer

Store all resources in one workspace and use conditional count expressions to toggle which cloud's resources are created per apply.

Question 11

Your platform team is bootstrapping a new Google Cloud organization. Compliance requires that all audit logs from every current and future project be exported centrally to a BigQuery dataset in a dedicated security project, with the guarantee that individual project owners cannot delete or bypass this export. What is the most effective way to configure this during organization bootstrap?

Accepted Answer

Create an aggregated log sink at the organization level with the includeChildren option enabled, routing logs to the BigQuery dataset in the security project, and grant the sink's writer identity permission on that dataset.

Answer

Instruct each project team to create a project-level log sink pointing to the shared BigQuery dataset, and enforce this with a documented onboarding checklist.

Answer

Enable a folder-level log sink on the top folder only, since projects created outside that folder will inherit the export automatically through IAM.

Answer

Configure a Pub/Sub topic in each project and use a Cloud Function to forward logs to BigQuery, granting project owners edit access to manage the pipeline.

Question 12

Your platform team must let application teams self-serve new Google Cloud projects. Every new project must land under the correct business-unit folder, have billing linked, enable a mandated baseline of APIs, apply standard IAM bindings, and be reproducible and auditable. Development teams should not receive Organization-level or billing IAM roles. What approach best satisfies these requirements?

Accepted Answer

Build a Terraform-based project factory module executed by a CI/CD pipeline using a privileged service account, where teams submit pull requests specifying project parameters that the pipeline validates and applies.

Answer

Grant each application team the Project Creator and Billing Account User roles at the organization level and share a documented setup checklist they must follow manually.

Answer

Have a central admin manually create each project in the Cloud Console when requested, then hand ownership to the requesting team.

Answer

Give application teams a shell script that calls gcloud commands to create projects, and let them run it locally with their own user credentials.

Question 13

Your company has just created its first Google Cloud organization resource that was automatically provisioned when a Cloud Identity super admin logged in. The platform team needs to bootstrap organization-level administration so that a dedicated group (gcp-org-admins@yourco.com) can manage IAM, create folders, and set org policies — without relying on the Cloud Identity super admin for day-to-day operations. What is the recommended first step to establish this delegated administration securely?

Accepted Answer

Have the Cloud Identity super admin grant the Organization Administrator (roles/resourcemanager.organizationAdmin) role at the organization node to the gcp-org-admins group, then use that group to assign further granular roles.

Answer

Grant the gcp-org-admins group the Owner (roles/owner) role on every existing project so they inherit organization-wide control.

Answer

Add each member of the platform team to the Cloud Identity super admin role so they can administer the organization directly.

Answer

Create a service account with the Organization Administrator role and share its exported key with the platform team for org-level changes.

Question 14

Your company is bootstrapping a new Google Cloud organization. Leadership wants three environment tiers (dev, staging, prod) that each contain multiple product teams. Security requires that production-specific org policy constraints (e.g., restricting external IP addresses) apply automatically to all production projects, while dev teams should have looser constraints. Product teams should be able to create their own projects without waiting on the platform team, but only within their assigned space. Which resource hierarchy design best meets these requirements?

Accepted Answer

Create top-level folders for each environment (dev, staging, prod), nest a folder per product team under each environment folder, attach environment-specific org policies at the environment folders, and grant teams Project Creator on their team folders.

Answer

Create a single flat structure with all projects directly under the organization node, and apply org policies individually to each production project as it is created.

Answer

Create top-level folders per product team, nest environment folders under each team, and apply the production org policies at the organization node so they cover everything.

Answer

Grant every product team Owner at the organization level so they can self-manage projects and org policies for their environments.

Question 15

Your company acquired a smaller firm that runs workloads in a separate Google Cloud organization. Leadership wants to consolidate the acquired workloads under your existing organization's resource hierarchy while minimizing downtime. Several projects in the acquired org contain running Compute Engine and Cloud SQL resources with dependent IAM bindings. What is the recommended approach to bring these projects into your organization?

Accepted Answer

Use the project migration process to move each project from the source organization to a target folder in your organization, after ensuring org policies and IAM prerequisites are satisfied in both organizations.

Answer

Recreate each project from scratch in your organization, redeploy the resources with Terraform, and delete the old projects once traffic is cut over.

Answer

Merge the two organizations by contacting Google Cloud support to combine the two Cloud Identity accounts into a single organization node.

Answer

Move the projects to the 'No organization' state first, then attach them individually to your organization's root node using gcloud projects create.

Question 16

Your platform team runs a CI/CD pipeline in a dedicated 'ci-tools' project. The pipeline must deploy resources into multiple environment projects (dev, staging, prod), each in different folders. Security policy forbids downloading or storing service account JSON key files anywhere, and each environment must have distinct permissions that can be audited. How should you configure the service accounts so the CI/CD workload can deploy across the environment projects?

Accepted Answer

Grant the CI/CD workload's identity the Service Account Token Creator role on a per-environment deployer service account in each project, and use short-lived impersonation tokens to deploy.

Answer

Create one service account per environment project and generate long-lived JSON keys, storing them as encrypted secrets in the CI/CD system for each deployment target.

Answer

Add the single ci-tools service account as an Owner at the organization level so it inherits deploy permissions on all environment projects.

Answer

Create a shared service account in the ci-tools project and grant it Editor across all three environment projects using a group binding at the folder level.

Question 17

Your platform team manages a Google Cloud organization with hundreds of service accounts created over several years. Security has raised concerns that many service accounts may be unused or over-privileged, creating attack surface. You need a repeatable, low-effort approach to identify service accounts that have not authenticated recently and detect roles granted but never used, so you can safely disable or right-size them. Which approach should you implement?

Accepted Answer

Enable IAM Service Account usage insights and IAM Recommender (role recommendations), then review activity metrics and lateral-movement/least-privilege findings in Active Assist before disabling or trimming permissions.

Answer

Write a scheduled Cloud Function that parses Cloud Billing exports to infer which service accounts consumed resources and delete any that have no associated cost.

Answer

Rotate all service account keys monthly and assume any account whose key rotation fails is unused, then delete those accounts.

Answer

Grant every service account the Viewer role at the organization level so their access is uniform, then manually audit the audit logs each quarter.

Question 18

Your organization is designing its resource hierarchy on Google Cloud. The networking team must centrally own and manage all VPC networks, subnets, firewall rules, and IP address ranges. Multiple application teams, each working in their own projects, need to deploy Compute Engine instances into these shared networks without being able to modify the network configuration. You want to follow Google-recommended practices while giving application teams the least privilege necessary to launch workloads. What should you do?

Accepted Answer

Configure a Shared VPC by designating the networking team's project as the host project and attaching each application project as a service project, then grant application teams the Compute Network User role on the specific shared subnets.

Answer

Grant each application team the Compute Network Admin role on the networking team's project so they can attach their instances to the shared networks.

Answer

Use VPC Network Peering between each application project's VPC and the networking team's VPC, and grant application teams Owner on their own projects.

Answer

Create the VPC in each application project and use organization policies to prevent the application teams from editing firewall rules.

Question 19

Your organization is adopting Infrastructure as Code and you must create the very first Terraform bootstrap configuration that will provision the foundational resource hierarchy (folders, shared VPC host project, and org-level policies) for a brand-new Google Cloud organization. No projects, service accounts, or remote state backends exist yet. Following Google's recommended bootstrapping approach, how should you initially execute this first Terraform run and set up ongoing automation?

Accepted Answer

Run the first apply locally using a highly privileged human identity with Organization Administrator, then have Terraform create a dedicated seed project, a bootstrap service account, and a GCS remote state bucket, and migrate state and future runs to CI/CD using that service account.

Answer

Create a seed project manually in the console and grant the Compute Engine default service account org-level Owner, then configure Terraform Cloud to run all applies as that default service account from the start.

Answer

Store the initial Terraform state on the local workstation permanently and continue running all org-level applies from an engineer's laptop to avoid the complexity of a remote backend.

Answer

Enable Config Controller first at the organization node and let it provision the seed project and hierarchy automatically, since Terraform cannot create org-level resources before any project exists.

Question 20

Your platform team runs all infrastructure changes through a Terraform pipeline in Cloud Build. Auditors require that no human can directly apply changes to production, that every production apply is preceded by a reviewed plan, and that the credentials used to apply have only the permissions needed for the target resources. Developers currently trigger builds by pushing to a shared branch, and the Cloud Build service account holds Owner on the production project. Which change best satisfies all three requirements?

Accepted Answer

Split the pipeline into a plan stage triggered on pull requests and an apply stage gated by a manual approval, and have the apply stage impersonate a dedicated service account granted only the specific roles required for the production resources.

Answer

Keep the single build trigger but add a Terraform 'prevent_destroy' lifecycle rule to all production resources and leave the Cloud Build service account as Owner.

Answer

Grant each developer the roles/owner on the production project so they can review and apply their own changes, and enable Cloud Build audit logging.

Answer

Store the Terraform state in a bucket with object versioning and require developers to run 'terraform apply' from their laptops after peer review in the pull request.

More PCDE practice