Google Cloud DevOps Engineer Professional Practice Exam

1. 1.An organization must apply the same set of guardrails to every project a business unit creates, including projects created next year. Where should the policies be defined?

   • AAt the folder representing the business unitCorrect answer
   • BIn a shared Terraform module teams may reuse
   • CIn an internal standards wiki page
   • DIndividually in each project as it is created

   Why

   Organization policies and IAM bindings applied at the folder representing the business unit are inherited by every project underneath, including ones created later. Applying settings project by project misses future projects, defining them in a Terraform module still requires someone to apply it consistently, and documenting them in a wiki enforces nothing.

2. 2.A platform team must provision hundreds of projects with identical naming, labels, billing association, and baseline IAM. Which approach is recommended?

   • AEach team defining its own project conventions
   • BOne shared project for all workloads
   • CManual project creation following a checklist
   • DA project factory implemented as infrastructure as codeCorrect answer

   Why

   A project factory implemented as infrastructure as code applies the same structure every time and is reviewable in version control. Creating projects manually in the console produces drift, letting each team define conventions guarantees inconsistency, and a single shared project abandons the isolation projects provide.

3. 3.A DevOps team wants Kubernetes manifests in a Git repository to be the single source of truth, with an agent continuously reconciling cluster state to match. Which approach describes this?

   • AEditing resources directly in the Google Cloud console
   • BA nightly script that reapplies the manifests
   • CGitOps continuous reconciliation with an in-cluster agentCorrect answer
   • DRunning kubectl apply from the CI pipeline on each merge

   Why

   GitOps continuous reconciliation, implemented with a tool such as Config Sync or Argo CD, watches the repository and converges cluster state toward the declared configuration, reverting manual drift. Running kubectl apply from a pipeline is push-based and does not continuously reconcile, editing resources in the console is exactly the drift being prevented, and a nightly script is neither continuous nor drift-aware.

4. 4.A team wants to manage Google Cloud resources such as Cloud SQL instances declaratively using Kubernetes custom resources in the same cluster as their applications. Which tool applies?

   • AConfig ConnectorCorrect answer
   • BHelm charts
   • CSkaffold
   • DTerraform with the Google provider

   Why

   Config Connector exposes Google Cloud resources as Kubernetes custom resources so they can be managed by the same declarative tooling and reconciliation loop as workloads. Terraform manages cloud resources outside the Kubernetes API, Helm packages Kubernetes manifests, and Skaffold orchestrates build and deploy loops for development.

5. 5.An organization must ensure that a set of production workloads and their data remain within a specific geography for regulatory reasons. Which control enforces this at the platform level?

   • AA monthly audit of resource regions
   • BA naming convention identifying regional resources
   • CIAM roles limited to regional administrators
   • DA resource locations organization policy constraint on the folderCorrect answer

   Why

   The resource locations organization policy constraint, applied at the folder containing those workloads, rejects creation of resources in disallowed regions and is inherited by future projects. A naming convention identifies but does not enforce, auditing after the fact detects violations too late, and IAM restricts who acts rather than where resources are created.

Practice all 65 questions

Frequently asked questions