Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise manages three separate Google Cloud environments (development, staging, and production) deployed across distinct GCP projects. The security team requires uniform Sensitive Data Protection (Cloud DLP) inspection rules—such as scanning for national identifiers, credentials, and sensitive customer data—across storage repositories in all environments. Currently, individual teams define inline inspection configurations inside their local continuous integration and continuous deployment (CI/CD) pipelines, which has caused severe configuration drift and high operational maintenance.
You need to implement a declarative Infrastructure as Code (IaC) configuration architecture that enforces standardized inspection policies across all environments, isolates deployment states, and allows policy updates without modifying downstream jobs. What should you do?
Declare centralized InspectTemplate resources at the organization level with dedicated state isolation, and configure environment-specific scan jobs to reference the organization template ID.
Create a unified DeidentifyTemplate at the organization level, and configure each environment's pipeline to apply de-identification transformations directly during storage scans.
Deploy project-level InspectTemplate resources across all projects using a single monolithic Terraform state file shared across development, staging, and production.
Define inline InspectConfig payloads inside each environment's Terraform state file and repository, requiring each team to independently update their configurations.
Declare centralized InspectTemplate resources at the organization level with dedicated state isolation, and configure environment-specific scan jobs to reference the organization template ID.
An InspectTemplate in Google Cloud's Sensitive Data Protection (Cloud DLP) service is a reusable configuration object that encapsulates inspection parameters, including built-in infoTypes, custom regex detectors, and likelihood thresholds. When created at the organization level (organizations/{org_id}/inspectTemplates), the template acts as a single, canonical policy definition that is accessible across all projects in the resource hierarchy.
StudyCerts
StudyCertsInspectTemplate ensures that development, staging, and production environments execute the exact same detection logic.Centralized declarative templates combined with isolated state storage represent the Google Cloud recommended architecture for multi-environment governance. It ensures strict policy enforcement, prevents state locks or corruption across environments, and eliminates duplicate configuration maintenance.
Create a unified DeidentifyTemplate at the organization level, and configure each environment's pipeline to apply de-identification transformations directly during storage scans.
Deploy project-level InspectTemplate resources across all projects using a single monolithic Terraform state file shared across development, staging, and production.
Define inline InspectConfig payloads inside each environment's Terraform state file and repository, requiring each team to independently update their configurations.