Task 1.1: Setting up cloud projects and accounts.

• AGrant each platform team its roles on the organization resource so all projects inherit them

  Incorrect

  A grant on the organization is inherited by every project in it, so each team would also administer the other departments' projects.

• BPut each department's projects in its own folder and grant the team's roles on that folder

  Correct

  Allow policies set on a folder are inherited by every project in it, including projects created there later, so each team needs one grant per department.

• CCreate a separate organization for each department and grant the platform team's roles on its organization

  Incorrect

  Separate organizations split identity, policy and billing control that the company wants central; folders give per-department boundaries inside one organization.

• DKeep every project directly under the organization and grant the platform team's roles on each project

  Incorrect

  This works today but needs about forty separate grants and a new one for every future project, which is the overhead folders remove.

Folders group projects that share access needs. Roles granted on a folder flow down to the projects and subfolders beneath it, so one binding per department covers today's projects and tomorrow's.

• AA Cloud Asset Inventory feed that reports every resource created outside the EU to the security team

  Incorrect

  A feed detects the violation after the resource exists; it does not prevent the resource from being created.

• BAn organization policy on the organization node that allows only in:eu-locations for resource locations

  Correct

  The gcp.resourceLocations constraint stops supported services from creating resources outside the allowed locations, and a policy set at the organization applies to every project below it.

• CA default region and zone in each developer's gcloud configuration, set to a European region

  Incorrect

  A default only fills in a value the user leaves out; any user can still pass another region on the command line or in the console.

• DA custom IAM role for developers that leaves out the permissions needed to create resources outside the EU

  Incorrect

  IAM permissions are not scoped by location, so a role cannot allow creating a VM in one region and deny it in another.

Organization policies set guardrails that IAM roles cannot: they constrain how resources may be configured, whoever creates them. The resource locations constraint applies to newly created resources only, so existing resources outside the allowed list keep running.

• AHave each user set a Google password at first sign-in and enforce 2-Step Verification on it

  Incorrect

  A Google password is a credential stored by Google, which the company forbids; with SAML single sign-on only Active Directory handles passwords.

• BConfigure single sign-on so Cloud Identity delegates authentication to AD FS over SAML

  Correct

  With SAML single sign-on, users authenticate against AD FS, so their passwords stay in Active Directory.

• CCreate a workforce identity pool with an AD FS provider and grant IAM roles to the pool's groups

  Incorrect

  Workforce Identity Federation is sync-less: it does not create Cloud Identity user accounts or groups, which this company requires.

• DExport the AD users to a CSV file each week and upload it in the Admin console

  Incorrect

  A bulk upload creates accounts, but it is manual and does not suspend leavers or keep groups in step with AD.

• ERun Google Cloud Directory Sync to provision users and groups from Active Directory into Cloud Identity on a schedule

  Correct

  GCDS reads AD over LDAP and creates, updates and suspends Cloud Identity users and groups to match it, which automates the lifecycle.

Provisioning and authentication are separate jobs. GCDS keeps Cloud Identity's users and groups in step with Active Directory, and SAML single sign-on makes AD FS the place where users prove who they are.

• Agcloud components update

  Incorrect

  Updating the CLI changes the tools on the developer's machine; it does not change which APIs the project has enabled.

• Bgcloud auth application-default login

  Incorrect

  This stores Application Default Credentials for client libraries; the error is about the project's API, not about credentials.

• Cgcloud services enable compute.googleapis.com

  Correct

  A project must enable an API before it can use the service, and this command enables the Compute Engine API in the current project.

• Dgcloud projects add-iam-policy-binding PROJECT_ID --member=user:dev@example.com --role=roles/compute.admin

  Incorrect

  A missing permission produces a permission-denied error; this error says the API itself is disabled, which no role grant fixes.

Google Cloud APIs are enabled per project through Service Usage, and a service's API must be enabled before the project can use it. gcloud services list --enabled shows which APIs a project already has on.

• ARaise the project's budget amount so that more resources can be created in the region

  Incorrect

  Budgets track spend and send alerts; they have no effect on how many resources a quota allows.

• BMove the workload to Spot VMs, because Spot capacity does not count against the regional quota

  Incorrect

  Spot VMs consume quota too, either the regular CPU quota or a separate preemptible quota, so this does not lift the limit.

• CSubmit a quota increase request for that regional CPUs quota in Cloud Quotas, with a justification

  Correct

  Quota increases are requested per quota and location; Google reviews the request, so it should be made before the capacity is needed.

• DCreate a second project in us-east1 and split the batch evenly between the two projects' quotas

  Incorrect

  Splitting work across projects to dodge a quota adds billing, network and IAM overhead, and each new project starts with its own default quotas.

Quotas cap how much of a resource a project can use in a location. When a plan needs more, check the current value and request an increase ahead of time for that specific quota and region.

• AA workforce identity pool with an Okta provider, with IAM roles granted to the pool's principals

  Correct

  Workforce Identity Federation lets users from an external IdP sign in to Google Cloud without synchronized accounts; the IdP stays the source of truth.

• BA workload identity pool with an Okta OIDC provider, and IAM roles granted to the pool on the two projects

  Incorrect

  Workload identity pools are for applications and services; human console sign-in uses workforce identity pools.

• CA service account per contractor, with a key that the partner hands to each person

  Incorrect

  Sharing service account keys with people bypasses their identity provider entirely and creates long-lived credentials to manage.

• DGoogle Cloud Directory Sync from Okta into Cloud Identity, with the contractors in a dedicated organizational unit

  Incorrect

  GCDS synchronizes from LDAP directories into Cloud Identity accounts, which is exactly the account creation the company wants to avoid.

Workforce Identity Federation is sync-less: users authenticate with their own IdP, attributes are mapped to Google Cloud, and IAM grants go to the pool's principals. Once a contractor is disabled in Okta, new sign-ins fail, and existing sessions end within the pool's session duration, or at once if you revoke them.

• AThe Compute Engine VM instances page in the console, with the organization chosen in the project picker

  Incorrect

  The VM instances page shows the instances of the selected project, not of every project in the organization.

• Bgcloud compute instances list with a --filter expression that matches the organization ID

  Incorrect

  gcloud compute instances list works in one project at a time; its filter cannot widen the scope to an organization.

• CA BigQuery query on the Cloud Billing export that groups Compute Engine usage by resource name

  Incorrect

  Billing data shows what generated cost, not an inventory of resources with their configuration and location; idle or free resources may be missing.

• Dgcloud asset search-all-resources scoped to the organization, filtered to Compute Engine instances

  Correct

  Cloud Asset Inventory searches resource metadata across a project, folder or organization in a single call and can filter by asset type.

Cloud Asset Inventory keeps a searchable history of resource metadata for the whole hierarchy. Searching at organization scope needs the Cloud Asset API and the right Cloud Asset role on the organization.

• AMove the three applications into a single project so that one project's monitoring covers them all

  Incorrect

  Merging projects to get one view throws away the separation the team chose; metrics scopes give the combined view without it.

• BAdd all three projects to the metrics scope of one scoping project and build the dashboards there

  Correct

  A metrics scope lets the scoping project read the metrics of every project added to it, so its dashboards can chart all three.

• CGrant the team Monitoring Viewer on each project and switch between the projects in the console

  Incorrect

  The team could see each project, but only one at a time; no single dashboard would chart all three.

• DCreate a log sink in each project that routes its logs to a shared log bucket in a central project

  Incorrect

  Routing logs centralizes log entries, not Cloud Monitoring metrics, and it copies data rather than reading it in place.

Every project has a metrics scope that starts with only itself. Adding other projects to it lets that scoping project chart and alert on their metrics while the data stays where it was written.

• AA separate laptop user account for each client with its own gcloud installation

  Incorrect

  This works but is heavier than the configurations gcloud already provides for this purpose.

• BA named gcloud configuration per client, switched with configurations activate

  Correct

  Each named configuration stores its own account, project and other properties, and activating one switches all of them together.

• CA single configuration whose properties are edited before each client's work

  Incorrect

  Editing properties by hand each time is the error-prone step the consultant wants to remove.

• DEnvironment variables exported in the shell before each command

  Incorrect

  Variables have to be set every session and are easy to forget, much like the flags.

gcloud configurations are named sets of properties. Create one per context and activate the one you need.

• Agcloud compute firewall-rules describe allow-web --project=PROJECT_ID --format=json

  Incorrect

  describe returns the rule's configuration as it is now, not earlier versions.

• Bgcloud asset feeds create web-feed --project=PROJECT_ID --asset-names=ASSET_NAME --pubsub-topic=TOPIC

  Incorrect

  A feed publishes updates from the moment it is created; it cannot return changes made before it existed.

• Cgcloud asset get-history --project=PROJECT_ID --asset-names=ASSET_NAME --content-type=resource --start-time=START_TIME

  Correct

  get-history returns the update history of an asset within a time window that starts no more than 35 days ago, with the resource metadata of each version.

• Dgcloud compute operations list --project=PROJECT_ID --filter="targetLink~allow-web"

  Incorrect

  This lists the Compute Engine operations that touched the rule, not the rule's configuration after each one.

Cloud Asset Inventory keeps a history of each asset for 35 days. Asking for an asset's history with the resource content type shows how its configuration changed over that window.

• AIn the Google Admin console of the Cloud Identity account

  Correct

  Cloud Identity users and groups are managed in the Admin console, which suits a small team with no other directory.

• BBy installing Google Cloud Directory Sync on a laptop

  Incorrect

  There is no directory here for it to synchronize from.

• CIn the IAM page of each project, by typing their new email addresses

  Incorrect

  IAM grants roles to existing identities; it does not create user accounts or groups.

• DIn a workforce identity pool, by adding each person's email address

  Incorrect

  A pool does not create Cloud Identity users or groups.

Without an external directory, Cloud Identity itself is the source of users and groups. Larger organizations automate this from their IdP.

• AAt the organization level, for use across its projects

  Correct

  Pools are configured at the Google Cloud organization level, which makes them usable across the organization.

• BIn the project linked to the organization's billing account

  Incorrect

  Billing accounts are not where pools are created, and pools are not project resources.

• CIn a folder, so that the folder's projects inherit the pool

  Incorrect

  Pools are configured on the organization, not on folders.

• DIn each project that will use it, one pool per project

  Incorrect

  Pools are not project resources; one pool serves the whole organization.

Workforce identity pools belong to the organization. Access within projects is then granted to the pool's principals with IAM.

• AA label protected=true on the project

  Incorrect

  Labels are metadata; they do not prevent deletion.

• BDeletion protection on every VM in the project

  Incorrect

  This protects VMs, not the project itself.

• CA budget alert on the project at 1% of its spend

  Incorrect

  Budgets watch costs; they do not block deletion.

• DA lien on the project that blocks deletion

  Correct

  A lien blocks the project's deletion until the lien is removed.

Liens add a deliberate extra step before a project can be shut down, which protects shared foundations from accidents.