I85PREP
⌘ K
GCP DevOps Engineer study materials
GCP DevOps Engineer study resources

GCP DevOps Engineer practice questions

One question at a time. Build your GCP DevOps Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Bootstrap and maintain a Google Cloud organization

Which node is the root of the Google Cloud resource hierarchy for an enterprise?

  1. The default folder
  2. The first project created
  3. The organization resource Correct answer.
  4. The billing account

Explanation

The organization resource is the root node of the Google Cloud resource hierarchy and is tied to a Cloud Identity or Google Workspace domain. Folders and projects are created beneath it, and IAM and organization policies inherit downward from this root.

Question 2Bootstrap and maintain a Google Cloud organization

Which predefined IAM role lets a principal create new projects inside a specific folder?

  1. roles/editor
  2. roles/resourcemanager.projectDeleter
  3. roles/resourcemanager.projectCreator Correct answer.
  4. roles/resourcemanager.folderViewer

Explanation

The Project Creator role (roles/resourcemanager.projectCreator) grants permission to create projects within the folder or organization where it is granted. It is commonly assigned at a folder to let teams self-service new projects without granting broader administrative rights.

Question 3Bootstrap and maintain a Google Cloud organization

What is the main reason to group projects under folders?

  1. To apply IAM and organization policies once and inherit them Correct answer.
  2. To reduce the number of billing accounts required
  3. To enable Cloud Identity synchronization
  4. To share VPC networks automatically between projects

Explanation

Folders let administrators apply IAM bindings and organization policies at a grouping level so that all contained projects inherit them. This reduces repetitive configuration and enforces consistent governance across related projects.

Question 4Bootstrap and maintain a Google Cloud organization

An organization policy boolean constraint is enforced at the organization node. What is the default effect on resources in child folders and projects?

  1. It applies only to projects created after the policy
  2. It applies only to the organization node itself
  3. It is inherited by child folders and projects Correct answer.
  4. It is ignored until each project sets it explicitly

Explanation

Organization policies are hierarchical: a policy set at the organization node is inherited by descendant folders and projects unless a lower-level policy overrides it. This inheritance is what lets administrators enforce baselines centrally.

Question 5Bootstrap and maintain a Google Cloud organization

Before a project can use paid Google Cloud services, what must it have?

  1. At least one Shared VPC host
  2. A Cloud Identity group
  3. An association with an open billing account Correct answer.
  4. A dedicated organization resource

Explanation

A project must be linked to an active billing account to use billable Google Cloud services. The billing account is the payment instrument, while the project is the resource container that consumes services.

Question 6Bootstrap and maintain a Google Cloud organization

What is the purpose of Essential Contacts?

  1. To define who can approve Access Transparency requests
  2. To synchronize users from Active Directory
  3. To manage organization policy constraints
  4. To designate who receives Google Cloud notifications by category Correct answer.

Explanation

Essential Contacts lets you specify individuals or groups to receive important Google Cloud notifications, such as security, billing, and technical notices, for an organization, folder, or project. Notifications are routed by category to the configured contacts.

Question 7Bootstrap and maintain a Google Cloud organization

Which service must manage the domain before you can create a Google Cloud organization resource?

  1. Firebase
  2. Identity Platform
  3. Cloud Identity or Google Workspace Correct answer.
  4. Cloud DNS

Explanation

A Google Cloud organization resource is created for a domain that is managed by Cloud Identity or Google Workspace. Verifying domain ownership alone is not sufficient; the domain must be associated with one of those identity services.

Question 8Bootstrap and maintain a Google Cloud organization

Which organization policy constraint prevents creating new service account keys?

  1. constraints/iam.restrictServiceAccountUsage
  2. constraints/iam.enforceServiceAccountKeyRotation
  3. constraints/iam.disableServiceAccountCreation
  4. constraints/iam.disableServiceAccountKeyCreation Correct answer.

Explanation

The constraint constraints/iam.disableServiceAccountKeyCreation blocks the creation of new service account keys when enforced. It is used to reduce the risk associated with long-lived credentials.

Question 9Bootstrap and maintain a Google Cloud organization

A user needs to attach a service project to a Shared VPC host project. Which role should be granted on the host project or its parent?

  1. roles/container.admin
  2. roles/compute.xpnAdmin Correct answer.
  3. roles/compute.networkViewer
  4. roles/compute.instanceAdmin.v1

Explanation

The Shared VPC Admin role (roles/compute.xpnAdmin) allows a principal to manage Shared VPC configuration, including attaching service projects to a host project. It is typically granted at the organization or folder level for centralized administration.

Question 10Bootstrap and maintain a Google Cloud organization

Which Google Cloud service provides a searchable inventory of resources and IAM policies across an entire organization?

  1. Security Command Center
  2. Cloud Monitoring
  3. Cloud Logging
  4. Cloud Asset Inventory Correct answer.

Explanation

Cloud Asset Inventory maintains a history and searchable inventory of Google Cloud resources, IAM policies, and organization policies across projects, folders, and organizations. It supports organization-wide queries and exports.

Question 11Bootstrap and maintain a Google Cloud organization

What does an IAM deny policy do when attached at the organization node?

  1. It requires every principal to use multi-factor authentication
  2. It converts all primitive roles into predefined roles
  3. It removes all allow policies from child projects
  4. It blocks specified principals from using specified permissions even if an allow policy grants them Correct answer.

Explanation

IAM deny policies explicitly deny selected permissions to selected principals, and deny takes precedence over allow. Attaching a deny policy at the organization node applies it across descendant resources.

Question 12Bootstrap and maintain a Google Cloud organization

In an IAM allow policy, what is a principal set?

  1. A billing account linked to multiple projects
  2. A collection of identities such as a workforce pool or Google group Correct answer.
  3. A folder that contains only service accounts
  4. A list of permissions grouped by service

Explanation

A principal set is a collection of identities, such as members of a workforce identity pool, workload identity pool, or Google group, that can be referenced in an IAM allow policy. It lets administrators grant roles to a managed group of principals rather than to individual users.

Question 13Bootstrap and maintain a Google Cloud organization

When a user calls a Google Cloud API with user credentials, what does the quota project determine?

  1. The project billed and quota-limited for the request Correct answer.
  2. The VPC network used for Private Google Access
  3. The organization node that owns the request
  4. The folder that stores audit logs

Explanation

For requests made with user credentials, the quota project identifies which project is charged and which project's quotas apply. Client libraries and gcloud often use a configured quota project for this purpose.

Question 14Bootstrap and maintain a Google Cloud organization

Which statement describes Security Command Center at the organization level?

  1. It replaces Cloud Audit Logs for all projects
  2. It aggregates security findings from projects across the organization Correct answer.
  3. It is enabled automatically only for billing accounts
  4. It can only scan one project at a time with no aggregation

Explanation

Security Command Center can be activated at the organization level, where it aggregates and displays security findings from projects throughout the organization. This gives security teams a centralized view of risks.

Question 15Bootstrap and maintain a Google Cloud organization

Which language is used to define the condition in a custom organization policy constraint?

  1. JMESPath
  2. Rego
  3. Common Expression Language (CEL) Correct answer.
  4. YAMLPath

Explanation

Custom organization policy constraints use Common Expression Language (CEL) expressions to evaluate resource fields against custom rules. The CEL condition determines whether a resource is compliant or denied.

Question 16Bootstrap and maintain a Google Cloud organization

A project is moved from Folder A to Folder B. What happens to IAM roles inherited from Folder A?

  1. They are converted into project-level allow policies
  2. They are removed; the project inherits Folder B's policies instead Correct answer.
  3. They remain until the project is deleted
  4. They remain inherited because IAM bindings are copied to the project

Explanation

IAM inheritance follows the resource hierarchy. When a project is moved, bindings inherited from its previous parent no longer apply, and the project inherits bindings from its new parent folder or organization.

Question 17Bootstrap and maintain a Google Cloud organization

Which gcloud command creates a project directly under an organization with a specified billing account?

  1. gcloud projects create my-proj --organization=ORG_ID --billing-account=BILLING_ID Correct answer.
  2. gcloud organizations create my-proj --billing-account=BILLING_ID
  3. gcloud resource-manager projects create my-proj --org=ORG_ID --billing=BILLING_ID
  4. gcloud projects create my-proj --folder=ORG_ID --billing-account=BILLING_ID

Explanation

The gcloud projects create command accepts either --organization or --folder to choose the parent, and --billing-account to link billing at creation time. Supplying the organization ID creates the project directly under the organization.

Question 18Bootstrap and maintain a Google Cloud organization

Why might a team prefer google_project_iam_member over google_project_iam_policy in Terraform?

  1. It automatically creates custom roles
  2. It grants roles only to service accounts
  3. It disables IAM inheritance from folders
  4. It adds a single binding without overwriting existing IAM bindings Correct answer.

Explanation

The google_project_iam_member resource manages one additive IAM binding and does not replace the project's entire IAM policy. This avoids accidentally removing bindings managed elsewhere.

Question 19Bootstrap and maintain a Google Cloud organization

Which organization policy constraint restricts sharing resources with identities outside allowed domains?

  1. constraints/storage.uniformBucketLevelAccess
  2. constraints/iam.allowedPolicyMemberDomains Correct answer.
  3. constraints/compute.requireOsLogin
  4. constraints/iam.disableServiceAccountKeyCreation

Explanation

The constraint constraints/iam.allowedPolicyMemberDomains limits IAM policy members to identities from specified allowed domains. It is commonly used to prevent accidental sharing with external accounts.

Question 20Bootstrap and maintain a Google Cloud organization

To use VPC Service Controls to protect projects, where must the access policy be created?

  1. In a Cloud Identity group
  2. In each project separately
  3. At the organization level Correct answer.
  4. In each VPC network

Explanation

VPC Service Controls uses an access policy that is created at the organization level through Access Context Manager. Service perimeters are then defined within that access policy to protect projects and services.

Question 21Bootstrap and maintain a Google Cloud organization

What is the effect of a dry-run organization policy spec?

  1. It applies only to newly created projects
  2. It evaluates resources against the policy without blocking changes Correct answer.
  3. It enforces the policy immediately but logs violations
  4. It replaces the enforced policy after 30 days

Explanation

A dry-run specification lets you test an organization policy by evaluating resources and logging violations without enforcing the restriction. This helps administrators understand impact before rolling out enforcement.

Question 22Bootstrap and maintain a Google Cloud organization

Which two services work together so that Google support access to customer data requires customer approval?

  1. Binary Authorization and Security Command Center
  2. VPC Service Controls and Cloud NAT
  3. Cloud Audit Logs and Cloud Trace
  4. Access Transparency and Access Approval Correct answer.

Explanation

Access Transparency provides logs of Google personnel access, and Access Approval lets customers approve or deny that access before it occurs. Together they provide oversight and control over support access to data.

Question 23Bootstrap and maintain a Google Cloud organization

Which role must a user have on the destination organization to migrate a project into it?

  1. roles/billing.admin
  2. roles/compute.networkAdmin
  3. roles/resourcemanager.organizationAdmin Correct answer.
  4. roles/iam.securityReviewer

Explanation

Migrating a project to another organization requires administrative control over the destination organization, typically through roles/resourcemanager.organizationAdmin, along with project-level move permissions. This ensures the user is authorized to place resources under that organization.

Question 24Bootstrap and maintain a Google Cloud organization

An organization policy constraint is set at the organization node, and a different value for the same constraint is set at a project. Which policy applies to resources in that project?

  1. Both policies are merged into a union
  2. The organization policy always wins
  3. The project policy overrides the inherited organization policy Correct answer.
  4. The constraint is disabled for the project

Explanation

Organization policies are inherited down the hierarchy, but a policy set at a lower-level node overrides the inherited policy for that scope. Therefore the project-level value applies to resources in that project where override is permitted.

Question 25Bootstrap and maintain a Google Cloud organization

Which organization policy constraint controls the geographic locations where resources can be created across all projects?

  1. constraints/storage.uniformBucketLevelAccess
  2. constraints/iam.allowedPolicyMemberDomains
  3. constraints/gcp.resourceLocations Correct answer.
  4. constraints/compute.vmExternalIpAccess

Explanation

The constraint constraints/gcp.resourceLocations restricts resources to specified geographic locations when enforced. It is commonly set at the organization or folder level to support data residency requirements.

Question 26Bootstrap and maintain a Google Cloud organization

Which resource sits at the root of the Google Cloud resource hierarchy?

  1. Organization Correct answer.
  2. Project
  3. Folder
  4. Billing account

Explanation

The organization resource is the root node of the hierarchy; folders and projects are created beneath it, and IAM bindings plus organization policies set there are inherited downward. A billing account is a payment instrument that is linked to projects but is not part of the hierarchy.

Question 27Bootstrap and maintain a Google Cloud organization

Which gcloud command lists the organization resources that the authenticated user is permitted to view?

  1. gcloud organizations describe
  2. gcloud resource-manager folders list
  3. gcloud projects list
  4. gcloud organizations list Correct answer.

Explanation

The organizations list command returns every organization the caller has permission to see, together with its numeric ID and display name. Project and folder listings operate on their own resource types, and describe requires a single organization ID as an argument.

Question 28Bootstrap and maintain a Google Cloud organization

Which audit log category is recorded by default for all resources in an organization and cannot be disabled?

  1. Data Access logs
  2. Admin Activity logs Correct answer.
  3. System Event logs
  4. Policy Denied logs

Explanation

Admin Activity logs capture configuration and metadata changes such as resource creation, deletion, and IAM updates, and they are always on for every resource. Data Access logs, which record reads and writes of user data, must be enabled explicitly because of their volume and cost.

Question 29Bootstrap and maintain a Google Cloud organization

Which predefined organization policy constraint can prevent Compute Engine instances from being created with external IP addresses?

  1. constraints/compute.disableSerialPortAccess
  2. constraints/compute.requireShieldedVm
  3. constraints/compute.vmExternalIpAccess Correct answer.
  4. constraints/compute.skipDefaultNetworkCreation

Explanation

The compute.vmExternalIpAccess constraint, enforced with an empty allowed list, blocks any VM from receiving an external IP address. The other constraints govern serial console access, Shielded VM requirements, and whether the default network is created automatically.

Question 30Bootstrap and maintain a Google Cloud organization

A platform team must route log entries from every project in the organization, including projects created later, into one BigQuery dataset owned by a central project. What should they configure?

  1. A folder-level log sink that leaves includeChildren at its default
  2. An organization-level log sink with includeChildren set to true Correct answer.
  3. An organization policy constraint that permits only BigQuery exports
  4. A log sink in each existing project that targets the dataset

Explanation

A sink created at the organization node with includeChildren set to true aggregates entries from all folders and projects beneath it and automatically covers projects added later. The sink's writer identity must also be granted permission on the destination dataset.

Question 31Bootstrap and maintain a Google Cloud organization

An administrator wants IAM conditions to evaluate the "environment" value attached to resources when granting access. Which resource metadata should the condition match on?

  1. Tags Correct answer.
  2. Service account annotations
  3. Network tags
  4. Labels

Explanation

Resource Manager tags can be matched in IAM conditions, for example with resource.matchTag, so a binding applies only to resources carrying a given tag value. Labels serve search, billing export, and reporting and are not evaluated by IAM.

Question 32Bootstrap and maintain a Google Cloud organization

A team manages organization policy with Terraform and wants to enforce a managed constraint at the organization node using the current Organization Policy API. Which resource should they use?

  1. google_folder_iam_policy
  2. google_org_policy_policy Correct answer.
  3. google_project_organization_policy
  4. google_organization_policy

Explanation

google_org_policy_policy targets the current Organization Policy API and can be scoped to an organization, folder, or project through its parent attribute. The older organization policy resources model the legacy API and cannot express the current spec with rules.

Question 33Bootstrap and maintain a Google Cloud organization

A developer holding an inherited role receives PERMISSION_DENIED on a resource. Which tool reports the effective policy, including inherited bindings and deny policies, and explains the denial?

  1. Policy Troubleshooter Correct answer.
  2. Cloud Asset Inventory
  3. Policy Analyzer
  4. IAM Recommender

Explanation

Policy Troubleshooter evaluates the effective IAM policy for a specific principal and resource, folding in inherited bindings, deny policies, and conditions, then states which permission is missing and why. Policy Analyzer instead answers who has access to what across many resources.

Question 34Bootstrap and maintain a Google Cloud organization

A company must give 400 engineers the same set of roles across 60 projects while keeping access easy to review. What is the recommended approach?

  1. Enforce the roles with an organization policy constraint
  2. Grant the roles to a Google Group and manage its membership Correct answer.
  3. Grant the roles to each engineer in every project
  4. Create one service account per engineer and share its keys

Explanation

Binding roles to a Google Group means access is granted or revoked by changing group membership, which keeps IAM policies small and auditable. Per-project bindings multiply quickly and drift, and organization policy cannot grant access.

Question 35Bootstrap and maintain a Google Cloud organization

Finance wants an automated notification published to a Pub/Sub topic when total spend on the organization's billing account crosses a threshold. Which feature provides this?

  1. A quota limit set on the Cloud Billing API
  2. An organization policy constraint applied to billing accounts
  3. A Cloud Billing budget with programmatic notifications Correct answer.
  4. A log-based alert on a billing export table

Explanation

Cloud Billing budgets are scoped to a billing account and can send notifications to Pub/Sub when actual or forecast spend crosses configured thresholds. Quotas cap API request rates, and organization policy governs resource configuration rather than spend.

Question 36Bootstrap and maintain a Google Cloud organization

A regulated customer needs a controlled environment that enforces data residency, personnel access, and support controls over a group of projects. Which product should be used?

  1. Assured Workloads Correct answer.
  2. Access Transparency
  3. VPC Service Controls
  4. Access Approval

Explanation

Assured Workloads applies a compliance regime to a folder, enforcing controls such as data residency and restricted support personnel for the projects inside it. The other products are individual controls that can complement, but do not by themselves constitute, such a regime.

Question 37Bootstrap and maintain a Google Cloud organization

A platform team must protect a critical shared project from accidental deletion. Which mechanism should be used?

  1. Deletion protection on the project's default VPC network
  2. Detaching the billing account from the project
  3. An organization policy constraint that blocks project creation
  4. A Resource Manager lien on the project Correct answer.

Explanation

A lien causes any deletion attempt on the project to fail and must be explicitly removed before deletion can proceed, which is exactly the guardrail wanted for a shared project. Billing links and network settings have no effect on project deletion.

Question 38Bootstrap and maintain a Google Cloud organization

An organization-level log sink points to a Cloud Logging bucket in a central project, but no entries arrive there. Which is the most likely cause?

  1. The sink was created with includeChildren set to false
  2. The sink's writer identity lacks write access on the destination Correct answer.
  3. The Logging API is disabled in the central project
  4. The destination must sit in the same project as the sink's parent

Explanation

Each log sink has an auto-generated writer identity, a service account, that must be granted a role such as Logs Bucket Writer on the destination resource. Without that grant the sink fails silently and nothing is delivered.

Question 39Bootstrap and maintain a Google Cloud organization

Which statement correctly describes custom organization policy constraints?

  1. They can only restrict behavior, never permit what is otherwise blocked Correct answer.
  2. They apply only to the project in which they are defined
  3. They automatically replace managed constraints on the same resource
  4. They can grant permissions that managed constraints deny

Explanation

Custom constraints are additional restrictions expressed in CEL and are evaluated alongside managed constraints, so they can only narrow what is allowed. They are defined at the organization and can be enforced at organization, folder, or project level.

Question 40Bootstrap and maintain a Google Cloud organization

A platform team must be able to create folders under the organization but must not manage IAM or create projects. Which single role should be granted at the organization node?

  1. roles/resourcemanager.projectCreator
  2. roles/resourcemanager.folderAdmin
  3. roles/resourcemanager.organizationAdmin
  4. roles/resourcemanager.folderCreator Correct answer.

Explanation

Folder Creator allows a principal to create folders under a parent while granting no ability to read or modify IAM policies or to create projects. Folder Admin adds full control over folders including their IAM policies, and Organization Administrator controls the entire organization.

Question 41Apply site reliability engineering practices

In site reliability engineering, what is a service level indicator (SLI)?

  1. A measured value of service quality, such as request latency or error rate Correct answer.
  2. A target range of values for a service level, tracked over a compliance window
  3. The share of the error budget consumed in the current compliance window
  4. A contractual commitment to customers that carries financial penalties when it is not met

Explanation

An SLI is the quantitative measurement of some aspect of the service, such as the fraction of requests served below a latency threshold. The target applied to that measurement is the SLO, and the customer-facing contract is the SLA.

Question 42Apply site reliability engineering practices

Which statement best distinguishes an SLO from an SLA?

  1. An SLO covers only latency, while an SLA covers only availability
  2. An SLO is an internal target, while an SLA is a customer contract Correct answer.
  3. An SLO drives capacity planning, while an SLA drives incident response
  4. An SLA is measured only internally, while an SLO is reported to customers

Explanation

An SLO is an internal reliability target that teams use to make engineering decisions. An SLA is an external agreement with customers that typically includes remedies such as service credits.

Question 43Apply site reliability engineering practices

A service has a 99.9% availability SLO measured over a 30-day window. Approximately how large is its error budget in downtime?

  1. 4.3 minutes
  2. 0.1 minutes
  3. 43.2 minutes Correct answer.
  4. 7.2 hours

Explanation

An error budget is 100% minus the SLO target, so 0.1% of the window. In a 30-day window of 43,200 minutes, 0.1% is 43.2 minutes of allowed unavailability.

Question 44Apply site reliability engineering practices

Which set of signals corresponds to the four golden signals described in Google's SRE literature?

  1. Throughput, uptime, MTTR, MTBF
  2. Requests, errors, saturation, queue depth
  3. CPU, memory, disk, network
  4. Latency, traffic, errors, saturation Correct answer.

Explanation

The four golden signals are latency, traffic, errors, and saturation. They are chosen because they describe user-visible behavior and the pressure on the system serving it.

Question 45Apply site reliability engineering practices

What is the primary purpose of a blameless postmortem?

  1. To find contributing causes and systemic fixes without punishing people Correct answer.
  2. To satisfy the SLA credit claim process with the affected customers
  3. To document which engineer caused the outage for use in performance review
  4. To replace the need for monitoring alerts on the affected service

Explanation

Blameless postmortems assume people act rationally given the information they had, so the analysis focuses on systems, tooling, and process. The output is a set of corrective actions that reduce the chance or impact of recurrence.

Question 46Apply site reliability engineering practices

Which activity is the clearest example of toil as SRE defines it?

  1. Designing a new SLO for a service that currently has none
  2. Writing a postmortem after a customer-visible incident
  3. Manually restarting the same stuck job several times each day Correct answer.
  4. Running a scheduled game day to test how the system fails under stress

Explanation

Toil is manual, repetitive, automatable work that provides no enduring value and scales with service growth. Repeatedly restarting the same job fits every part of that definition.

Question 47Apply site reliability engineering practices

For a 30-day SLO, what fraction of the error budget is consumed in one day at a burn rate of 1.0?

  1. About 50%
  2. About 3.3% Correct answer.
  3. About 30%
  4. About 1%

Explanation

A burn rate of 1.0 means the budget is consumed at exactly the pace that exhausts it at the end of the SLO window. Over a 30-day window, that steady pace consumes about one thirtieth, or 3.3%, each day.

Question 48Apply site reliability engineering practices

In a formal incident management model, what is the Incident Commander primarily responsible for?

  1. Writing the postmortem while the incident is still ongoing
  2. Communicating exclusively with the customer's legal team
  3. Coordinating the response and assigning roles and ownership Correct answer.
  4. Debugging the root cause of the outage personally

Explanation

The Incident Commander maintains the big picture, sets priorities, and delegates work so that responders are not all heads-down on the same problem. Hands-on diagnosis is deliberately left to other assigned roles.

Question 49Apply site reliability engineering practices

A team wants pages only for severe, fast error-budget consumption while still catching slow degradation. Which alerting approach best follows SRE practice?

  1. An alert whenever any single instance reports a failed health check
  2. Multi-window, multi-burn-rate alerts combining a 1h and a 6h window Correct answer.
  3. A weekly report emailed to the team summarizing the error budget remaining
  4. A single alert on the raw error count exceeding a fixed threshold of 100 per minute

Explanation

Combining a short window with a longer window filters out transient blips while still detecting sustained budget consumption. Different burn-rate multipliers let a fast severe burn page while a slower burn only opens a ticket.

Question 50Apply site reliability engineering practices

A service exhausts its quarterly error budget halfway through the quarter. Under a typical error budget policy, what should happen?

  1. Releases are restricted and effort shifts to reliability work Correct answer.
  2. The SLO target is lowered until the error budget becomes positive again
  3. The on-call rotation is suspended until the next quarter begins
  4. Alerting for the service is disabled so responders get fewer pages

Explanation

An error budget policy is a pre-agreed consequence that makes reliability trade-offs explicit rather than political. Exhausting the budget typically pauses risky launches and redirects effort toward fixing the sources of budget consumption.