Google Cloud DevOps Engineer Professional

1. 1.An organization must apply the same set of guardrails to every project a business unit creates, including projects created next year. Where should the policies be defined?

   • AAt the folder representing the business unitCorrect answer
   • BIndividually in each project as it is created
   • CIn a shared Terraform module teams may reuse
   • DIn an internal standards wiki page

   Why

   Organization policies and IAM bindings applied at the folder representing the business unit are inherited by every project underneath, including ones created later. Applying settings project by project misses future projects, defining them in a Terraform module still requires someone to apply it consistently, and documenting them in a wiki enforces nothing.

2. 2.A platform team must provision hundreds of projects with identical naming, labels, billing association, and baseline IAM. Which approach is recommended?

   • AA project factory implemented as infrastructure as codeCorrect answer
   • BManual project creation following a checklist
   • CEach team defining its own project conventions
   • DOne shared project for all workloads

   Why

   A project factory implemented as infrastructure as code applies the same structure every time and is reviewable in version control. Creating projects manually in the console produces drift, letting each team define conventions guarantees inconsistency, and a single shared project abandons the isolation projects provide.

3. 3.A DevOps team wants Kubernetes manifests in a Git repository to be the single source of truth, with an agent continuously reconciling cluster state to match. Which approach describes this?

   • AGitOps continuous reconciliation with an in-cluster agentCorrect answer
   • BRunning kubectl apply from the CI pipeline on each merge
   • CEditing resources directly in the Google Cloud console
   • DA nightly script that reapplies the manifests

   Why

   GitOps continuous reconciliation, implemented with a tool such as Config Sync or Argo CD, watches the repository and converges cluster state toward the declared configuration, reverting manual drift. Running kubectl apply from a pipeline is push-based and does not continuously reconcile, editing resources in the console is exactly the drift being prevented, and a nightly script is neither continuous nor drift-aware.

4. 4.A team wants to manage Google Cloud resources such as Cloud SQL instances declaratively using Kubernetes custom resources in the same cluster as their applications. Which tool applies?

   • AConfig ConnectorCorrect answer
   • BTerraform with the Google provider
   • CHelm charts
   • DSkaffold

   Why

   Config Connector exposes Google Cloud resources as Kubernetes custom resources so they can be managed by the same declarative tooling and reconciliation loop as workloads. Terraform manages cloud resources outside the Kubernetes API, Helm packages Kubernetes manifests, and Skaffold orchestrates build and deploy loops for development.

5. 5.An organization must ensure that a set of production workloads and their data remain within a specific geography for regulatory reasons. Which control enforces this at the platform level?

   • AA resource locations organization policy constraint on the folderCorrect answer
   • BA naming convention identifying regional resources
   • CA monthly audit of resource regions
   • DIAM roles limited to regional administrators

   Why

   The resource locations organization policy constraint, applied at the folder containing those workloads, rejects creation of resources in disallowed regions and is inherited by future projects. A naming convention identifies but does not enforce, auditing after the fact detects violations too late, and IAM restricts who acts rather than where resources are created.

Practice all 65 questions

Frequently asked questions