Objective 1.4

PCDE

Managing multiple environments

Objective 1.4 sits in Bootstrapping and maintaining a Google Cloud organization, which carries 20% of the Cloud DevOps Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.

Objective title verbatim from the official objectives. Google Cloud exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

1-4Bootstrapping and maintaining a Google Cloud organization

A platform team wants a new constraint's breaches recorded in audit logs while the offending actions still succeed. Which setting delivers that?

Active mode with a tag-based exemption ruleTag conditions decide which resources a constraint reaches; enforcement still denies the ones it reaches.
Simulation mode set on the custom constraintSimulation is a separate analysis tool, and no such mode exists on the policy object itself.
Boolean rule left in the not enforced stateLeaving a boolean rule unenforced means the constraint is never checked, so nothing appears in logs.
Dry-run mode on the organization policyCorrect · your answerCorrect: it observes without refusing anything.

Correct.

Concept

A guardrail can be observed before it is imposed. Recording what would have been refused, without refusing it, turns a risky cutover into a measurement.

Why D

The policy is created and evaluated as usual and each breach is written to the audit log, yet nothing is denied. That is how the blast radius of a change gets sized first.

Source

An organization policy in dry-run mode is created and enforced similarly to other organization policies, and violations of the policy are audit-logged, but the violating actions aren't denied. You can use organization policies in dry-run mode to monitor how policy changes would impact your workflows

Google Cloud: Organization Policy overview, checked August 2026
#organization-policy#guardrails#audit-logs

Now you: objective 1.4 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

1-4Bootstrapping and maintaining a Google Cloud organization

An engineer asks how Organization Policy differs from IAM inside a Google Cloud organization. Which distinction separates the two?

Sample question 2 of 3

1-4Bootstrapping and maintaining a Google Cloud organization

A team must allow a folder and every resource beneath it in the allowed values of a list constraint. Which prefix does that?

Sample question 3 of 3

1-4Bootstrapping and maintaining a Google Cloud organization

After a new constraint is enforced at the organization, an engineer finds resources that already breach it are still running normally. Why?

Full Cloud DevOps Engineer question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Bootstrapping and maintaining a Google Cloud organization