GCDL Exam Questions and Answers

Folder

Folders are hierarchical containers that live beneath an Organization node and above Projects, specifically designed to group related projects. They also support nested sub-folders, enabling you to mirror your company's structure or deployment environments (e.g., dev, staging, prod). Policies and IAM roles assigned to a folder are inherited by all projects and resources inside it, making them a first-class administrative boundary for access control and isolation. This is exactly the correct mechanism for grouping related projects while preserving policy inheritance.

Apply an organization policy constraint at the folder level

The correct answer is to apply an organization policy constraint such as constraints/compute.vmExternalIpAccess at the folder level. This list constraint denies or permits the assignment of external IP addresses to VM instances, and because organization policies are hierarchical, the folder-level setting is inherited by every project and resource within that folder, enforcing the guardrail centrally.

The BigQuery dataset is in a different location from the billing account's default region

Billing export requires the dataset to be in the same multi-regional location (US or EU) as the billing account.

Sustained use discounts

Sustained use discounts are applied automatically to Compute Engine instances that run more than 25% of a billing month; the discount ramps up from 0% to 30% as utilization increases, requiring no upfront commitment or capacity reservation. Because this is assessed monthly based on actual run time per instance and region, it directly benefits workloads with unpredictable usage patterns, making it the only one of these options that adapts to usage without requiring a forecast or accepting termination risk.

Active Assist Recommendations

Active Assist Recommendations includes the label recommender, which leverages machine learning to analyze resource metadata, usage patterns, and existing label coverage to identify resources missing required label keys or values. It surfaces each suggestion with a rationale and one-click remediation, helping teams enforce tagging conventions without manual audits. This is exactly the kind of proactive, prescriptive guidance the organization needs.

Google Cloud Pricing Calculator

The Google Cloud Pricing Calculator is the authoritative pre-deployment estimation tool, letting users select specific services (e.g., Compute Engine machine types, Cloud Storage classes) and input usage parameters like region, sustained use, and committed use discounts to generate a monthly cost projection. It pulls current, publicly listed rates and supports SKU-level customization, making it the correct choice for forecasting costs before any resource is created or consumed.

Public cloud

Public cloud computing, exemplified by Google Cloud, provides on-demand compute, storage, and networking via shared, multitenant infrastructure owned and operated by the provider. Customers use a pay-as-you-go model, paying only for metered usage, which converts traditionally capital expenditures (servers, racks, power) into operating expenses. This eliminates upfront hardware procurement, maintenance, and capacity planning, allowing a startup to scale globally with no capital investment. It directly fulfills the requirement to reduce CapEx on hardware.

Managed instance groups with autoscaling

Managed instance groups with autoscaling directly address sudden spikes by continuously evaluating metrics such as CPU utilization, requests per second, or custom Cloud Monitoring signals and adjusting the number of VM instances within configured minimum and maximum boundaries. When a spike is detected, the autoscaler provisions additional VMs and then scales down after demand subsides, while health checks and instance templates ensure each new VM is immediately ready to serve traffic. This is the standard Google Cloud solution for elastic compute capacity behind a load balancer.

VPC Service Controls and IAM

VPC Service Controls and IAM together provide defense-in-depth for PCI DSS compliance: VPC Service Controls establishes perimeters around GCP services to prevent data exfiltration and limit access to authorized networks, while IAM manages granular user-level permissions on specific resources. This combination gives you both network-level isolation (via service perimeters) and identity-based access control (via roles and policies), directly satisfying PCI DSS requirements for restricting access to cardholder data and protecting it from unauthorized retrieval or copying.

Cloud CDN

Cloud CDN is the correct choice because it leverages Google's globally distributed edge infrastructure to cache media content (such as video segments, images, and other static assets) at points of presence closer to end users. When a user requests a media file, the CDN serves it from the nearest edge cache, dramatically reducing round-trip time and network hops compared to fetching from the origin. It also offloads traffic from origin servers, reducing bandwidth costs and origin load, and it supports flexible cache modes and TTLs for both static and dynamic content—making it the ideal solution for low-latency media streaming.

AutoML Natural Language

AutoML Natural Language is the intended Google Cloud service for training a custom text classification or entity-extraction model through a graphical, low-code workflow. It accepts labeled customer comments and builds a model using transfer learning, allowing the organization to incorporate domain-specific vocabulary and idiomatic expressions without writing code. This directly addresses the need to analyze customer text with a tailored model, making it the correct choice.

Cloud Key Management Service (Cloud KMS)

Cloud Key Management Service (Cloud KMS) is the correct answer because it is Google Cloud's managed service for creating, rotating, and destroying customer-managed encryption keys (CMEK). The service provides a software-based key management tier suitable for HIPAA compliance, and it also integrates with Cloud HSM to offer hardware-backed keys if FIPS 140-2 Level 3 validation is required. Because you retain control over the key material lifecycle and can audit key usage, Cloud KMS meets the security and governance requirements of a HIPAA-compliant application.

On-demand self-service

This is exactly the NIST characteristic in question: a consumer can unilaterally provision computing capabilities, such as server time and network storage, automatically without requiring human interaction with each service provider. This means the user accesses a self-service interface or API, supplies the configuration, and receives the resource immediately — no phone call, ticket, or manual approval needed. It is the defining trait that distinguishes cloud computing from traditional IT procurement and is the answer to the question.

Cloud Run

Cloud Run is a serverless container execution service that automatically scales to zero instances when no requests are in-flight. You are billed only for the exact time your container processes a request, down to 100-millisecond increments, with no cost for idle periods. Its HTTP-triggered, pull-based model makes it ideal for a containerized web application that experiences variable or low traffic.

Cloud Hardware Security Module (Cloud HSM)

Cloud HSM provides a cloud-based hardware security module that holds your encryption keys in tamper-resistant hardware, validated to FIPS 140-2 Level 3. It integrates with Cloud KMS, so you can generate, store, and use keys inside the HSM while retaining customer-managed control. This dedicated HSM meets the strict hardware protection required for sensitive financial services data, making it the correct choice.

Cloud CDN

Cloud CDN uses Google's globally distributed edge points of presence to cache static and dynamic content close to users. It intercepts HTTP(S) requests via the load balancing infrastructure and serves cached responses when possible, which reduces latency and cuts compute engine instance load. For a global e-commerce platform, caching product catalogs and media dramatically accelerates page rendering and improves customer experience.

Data encryption and access control (IAM)

Customers retain responsibility for encrypting their data both at rest and in transit, as well as for defining and enforcing access control through IAM policies. This includes managing encryption keys (via Cloud KMS or customer-supplied keys), configuring identity and role-based access, and applying organizational policies. Since these are direct customer actions within the cloud console and APIs, this is the correct choice.

Compute Engine with preemptible VMs

Preemptible VMs are a cost-effective choice for fault-tolerant batch jobs because they are priced up to 80% lower than standard VMs and can run for up to 24 hours, which fits the job's duration. The key requirement is that the batch job must handle preemption events gracefully—using checkpoints, retries, or restarting from the last saved state—which ensures uninterrupted processing of large files despite possible interruptions. Given the explicit tolerance for interruptions, preemptible VMs reduce cost without compromising completion, making them the optimal compute service for this use case.

BeyondCorp Enterprise

BeyondCorp Enterprise is Google Cloud's complete zero-trust access solution, designed to replace a traditional VPN. It enforces access decisions based on user identity, device security posture, and context, rather than granting broad network-level entry. By combining Identity-Aware Proxy, endpoint verification, and adaptive policies into a single platform, it protects applications without exposing the entire network, which is why it is the correct replacement for VPN-based remote access.

Customer-managed encryption keys (CMEK)

CMEK lets you create and manage your own keys within Cloud KMS, giving you control over the full key lifecycle—rotation schedules, enables/disables, and deletions—while still leveraging Google's infrastructure for storage and encryption operations. You can grant and revoke access to keys via IAM, and audit key use with Cloud Audit Logs. This directly satisfies the need to manage keys as the customer, because you retain administrative authority over the key material that protects the data.

Chronicle

Chronicle is a cloud-native SIEM from Google Cloud designed to ingest, normalize, and analyze security logs from multiple cloud providers, on-premises systems, and SaaS applications. Its architecture leverages BigQuery for scalable log storage and provides advanced threat detection, retroactive analysis, and custom detection rules with low-latency searching. As a Google Cloud product purpose-built for security log analytics, it directly addresses the need to monitor and analyze logs across a multi-cloud environment.

Cloud Armor

Cloud Armor is Google Cloud's DDoS protection and web application firewall (WAF) service. It enforces L7 filtering rules—such as the OWASP ModSecurity Core Rule Set for SQLi and XSS, rate limiting, and custom expressions—at the edge of Google's global load balancing and Cloud CDN infrastructure. In addition, it provides always-on network-layer DDoS mitigation, making it the correct answer for protecting a GKE-hosted web app. It can be configured with preconfigured rules or tailored to block specific attack signatures.

Secret Manager

Secret Manager is the correct choice for storing and managing database passwords because it is a dedicated secrets-management service that provides versioning, fine-grained IAM permissions, and audit logging for each secret access. It encrypts secret values in transit and at rest, and integrates seamlessly with Compute Engine, GKE, Cloud Run, and Cloud Functions so applications can retrieve secrets at runtime via a simple API. This avoids hardcoding credentials and supports easy rotation.

To prevent data exfiltration from Google Cloud services

VPC Service Controls create perimeters around Google Cloud APIs and services, using context such as identity, source IP, and resource metadata to authorize access. This prevents copying or moving data from within the perimeter to external destinations, directly reducing the risk of data theft. By working at the API layer, it complements IAM and network controls with a data-boundary layer.

Cloud Bigtable

Cloud Bigtable is a fully managed, wide-column NoSQL database built specifically for large-scale analytical and operational workloads, including time-series and IoT sensor data. It stores data as sparse rows keyed by a row key (typically device ID and timestamp), enabling single-digit millisecond read/write latency at massive scale. Bigtable scales horizontally by adding nodes to handle millions of queries per second without downtime, and its native integration with Cloud BigQuery, Dataflow, and Pub/Sub makes it the ideal choice for petabyte-scale sensor data ingestion and retrieval.

Cloud Run

Cloud Run is a fully managed serverless container platform that executes your container only when a request arrives. It automatically scales down to zero instances during idle periods, meaning you pay nothing when there is no traffic, and it scales up instantly to handle incoming requests. Because it directly supports container images and abstracts all infrastructure, it is the simplest and most cost-efficient choice for deploying a containerized web application.

Compute Engine with preemptible VMs

Preemptible VMs on Compute Engine are the right choice for a nightly batch process because they are up to 80% cheaper than standard VMs, which directly reduces operational cost for a recurring, interruptible workload. Since batch jobs are inherently fault-tolerant—they can be checkpointed or simply rerun from the start—the risk of preemption is acceptable, and Google Cloud automatically restarts the VM if capacity is available. For a simple scheduled job, a preemptible VM is a low-complexity, high-savings solution.

BigQuery

BigQuery is Google Cloud's serverless, fully managed data warehouse built on a columnar storage format and the Dremel massively parallel query engine, letting you run SQL over petabytes without provisioning. Its compute and storage are decoupled, so it scales elastically and you pay only for queries and stored data; native Looker integration and BI Engine in-memory acceleration directly support analytical workloads. That combination of serverless scalability, ANSI SQL, and built-in BI connectivity is what makes it the correct answer.

AlloyDB

AlloyDB is purpose-built for PostgreSQL workloads and is fully PostgreSQL-compatible, enabling most applications to migrate without changing code or SQL syntax. It delivers enterprise-grade high availability and performance with a columnar engine that speeds up analytical queries, adaptive indexes that learn from access patterns, and AI-driven optimization features that automatically fine-tune database settings—capabilities that Cloud SQL and other managed PostgreSQL services lack, making it the correct answer for this scenario.

Cloud Functions

Cloud Functions is the ideal fit because it is a managed Function-as-a-Service platform that executes code in response to a Pub/Sub event, scaling to zero when idle. It bills only for the actual invocation time, measured in 100ms increments, so a small Python snippet that runs once or twice undergoes no idle cost or container overhead. Its event-driven trigger model and built-in Pub/Sub subscription abstraction remove the need to run a web server or manage infrastructure, making it the most cost-effective and operationally simple choice for this task.

From capital expenditure (CapEx) to operational expenditure (OpEx)

This correctly captures the core cost-model shift of cloud adoption. In an on-premises model, you must buy and capitalize expensive hardware, software licenses, and data-center infrastructure upfront, and then depreciate those assets over their useful life. Cloud providers own the infrastructure and charge variable usage fees, so customers avoid large capital outlays and instead book monthly cloud bills as operating expenses. This improves cash flow and aligns costs with actual business consumption, which is exactly the CapEx-to-OpEx transition.

Speed and agility — cloud resources are provisioned in minutes, enabling faster time-to-market.

Speed and agility are direct results of cloud's on-demand self-service model: compute, storage, and networking resources are provisioned through APIs and templates in minutes, versus six to eight weeks for ordering, shipping, racking, and configuring physical hardware. This capability collapses the startup's lead time, moving it from idea to globally deployed application in days. It also enables iterative DevOps workflows, because resources can be created, scaled, and destroyed on the fly to match changing demand.

Cloud-based AI/ML services and workflow automation that process applications end-to-end without manual steps.

Managed AI services such as Document AI extract key-value pairs from loan applications and financial statements, while auto-scaled workflow systems (e.g., Cloud Workflows or Dataflow) route verified data to risk-scoring models and trigger conditional approvals. This eliminates manual data entry, cross-department handoffs, and human review bottlenecks, shrinking processing time from weeks to hours. Because the entire end-to-end pipeline runs server-free, decisions can be made in near-real-time without human intervention.

Elasticity — the ability to rapidly scale resources up during peak demand and release them when no longer needed.

Elasticity is the ability to rapidly and automatically provision or release cloud resources in response to changing workload demand. In this case, the company scales to 50x capacity for the Black Friday peak, runs for that period, then scales back to the normal 1x baseline, so it only pays for the extra capacity when it is actually used. This avoids the cost of permanently over-provisioning a data center for a short-lived surge, which is exactly the cost optimization described.

Cloud enables faster innovation and time-to-market, reduces total cost of ownership, and provides access to advanced capabilities (AI, analytics) that improve competitive positioning.

This is the correct CEO-level business case because it directly ties cloud adoption to measurable business outcomes: faster innovation cycles shorten time-to-market, which is a competitive advantage. Shifting from capital expenditure to operating expense, plus eliminating overprovisioning and datacenter overhead, reduces total cost of ownership. Access to managed AI/analytics services (e.g., BigQuery, Vertex AI) lets the company build data-driven products without massive upfront ML infrastructure investment. These three pillars—speed, cost, and new capabilities—are what drive board-level decisions, unlike purely tactical IT points.

Digital transformation

Digital transformation is the comprehensive, strategic integration of digital technology into every area of the organization, fundamentally changing operations, culture, and how value is delivered to customers. It encompasses business model reinvention, data-driven decision making, customer experience redesign, and new revenue streams, with cloud as a primary enabler providing scalable infrastructure and advanced services. Unlike narrower initiatives, it requires deep organizational change management, leadership alignment, and continuous innovation.

BigQuery

BigQuery is a serverless, petabyte-scale data warehouse that separates storage from compute, enabling independent scaling and on-demand pricing. Its columnar storage and massively parallel query engine, built on Dremel technology, allow fast SQL analytics on massive datasets with zero infrastructure management. This makes it the obvious choice for ad-hoc analysis and business intelligence, not transactional workloads.

Cloud Run

Cloud Run is the correct choice because it abstracts away all infrastructure and Kubernetes concepts: you deploy a container image, and Cloud Run runs it in a fully managed, autoscaled execution environment. It scales to zero when idle, so you pay for only the exact duration of requests or instances during active traffic. This gives you container portability and common HTTP API support without the operational burden of GKE or the runtime lock-in of App Engine.

Vertex AI

Vertex AI is Google Cloud's unified machine learning platform that delivers exactly what the team needs: managed training on GPU/TPU clusters, AutoML for tabular/image/text, hyperparameter tuning, a centralized Model Registry, and Vertex AI Endpoints for autoscaling predictions. It also integrates with Vertex AI Pipelines for orchestration and Vertex AI Feature Store for consistent features. The team can bring their existing Python/TensorFlow expertise, and Vertex AI abstracts away the infrastructure management, letting them focus on building and iterating on models.

Cloud Storage

Cloud Storage is Google's fully managed, globally distributed object storage service designed for unstructured data such as images, videos, backups, and datasets. It stores objects as immutable blobs in buckets, with a flat namespace and HTTP/S APIs, enabling access from anywhere via standard web protocols. It offers 11 nines of annual durability (99.999999999%) through redundant storage across multiple locations, and its scalability and lifecycle management make it ideal for data lakes, content distribution, and archival storage.

Looker Studio (formerly Data Studio)

Looker Studio (formerly Data Studio) is Google's free business intelligence and data visualization platform with first-class native BigQuery connectors, enabling analysts to build interactive, shareable dashboards without writing web application code. Reports are stored in Google Cloud and can be shared via a simple link with view-only access, so stakeholders do not need a GCP account, a BigQuery project, or any technical skills. The tool supports scheduled data refresh, interactive filters, and drag-and-drop charting, making it the ideal choice for non-technical consumers. This directly matches the requirement for a BI dashboarding tool with integrated BigQuery connectivity.

Dialogflow CX or Vertex AI Conversation

Dialogflow CX is Google Cloud's advanced conversational AI platform for building virtual agents and chatbots. It uses natural language understanding (NLU) to detect user intent, extract entities, and manage multi-turn conversation flows with explicit state machines. It also offers integrations across channels like Google Assistant, web, and telephony, and is the core technology behind Vertex AI Conversation for enterprise-scale conversational apps.

~43.2 minutes

In a 30-day month there are 43,200 minutes (30 × 24 × 60). 99.9% availability permits 0.1% downtime, so the error budget is 0.001 × 43,200 = 43.2 minutes. This is the classic 'three nines' SLO calculation and implies that a service can be unavailable for a total of 43 minutes and 12 seconds per month while still meeting the target.

SLO burn rate alerting — alert when error budget is being consumed faster than the measurement window allows.

SLO burn rate alerting continuously calculates the rate at which errors occur relative to the SLO's error budget and the remaining time in the measurement window. When the current burn rate projects that the budget will be exhausted before the window ends, an alert triggers promptly, enabling teams to respond before the SLO is actually violated. This approach is predictive rather than reactive, and can be tuned with fast and slow burn rates to detect both acute and chronic budget consumption, making it the correct mechanism for SLO compliance monitoring.

Live migration transparently moves VMs to healthy hosts during maintenance with no VM downtime.

During a live migration, the VM's memory pages are continuously copied from the source host to a destination host in a series of iterative passes, while the instance continues running its normal operations. At the final pass, the VM is briefly quiesced for just a few hundred milliseconds to transfer the remaining state, then the instance resumes on the new host with the same MAC address, IP address, and open network connections. This gives the appearance of zero downtime, though technically it's an extremely short pause rather than a full shutdown and boot.

Configure autoscaling on the application's infrastructure to automatically scale up for load and scale down during off-peak hours.

Configuring autoscaling on the application's infrastructure directly addresses the requirement for automatic response to load. An autoscaler continuously monitors metrics such as CPU utilization, request count, or custom application metrics and dynamically adjusts the number of VM instances in a managed instance group. For the predictable 9 AM weekday spike, you can combine scheduled autoscaling (proactively adding capacity before the spike) with reactive autoscaling (handling unexpected bursts in real time). When traffic decreases during off-peak hours, the autoscaler automatically terminates excess instances, ensuring cost efficiency without human involvement.

Enable Cloud CDN to cache video content at Google's global edge PoPs, serving viewers from the nearest location.

Cloud CDN leverages Google's global edge points of presence (PoPs) to cache and serve video content from the location geographically nearest to each viewer. When an Asian viewer requests a video, the request is routed to a nearby edge cache rather than traversing the long-haul network path to us-central1, which dramatically reduces round-trip time and jitter. Additionally, because edge caches absorb the bulk of repeated requests, the origin servers see far fewer direct hits, which reduces origin load and allows the infrastructure to scale cost-effectively for global audiences.

Cloud Monitoring (part of Google Cloud's operations suite)

Cloud Monitoring is the central operational observability component of Google Cloud's operations suite, ingesting metric time series from GCP services, Prometheus, and custom app instrumentation. It offers flexible dashboards, alerting policies based on thresholds or MQL, uptime checks, and native integration with Cloud Logging and Cloud Trace for a unified troubleshooting workflow. For example, you can correlate a spike in HTTP 500 responses with error log entries and trace samples to diagnose root cause — capabilities no other listed service provides.

No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.

Google Cloud automatically encrypts all data at rest using AES-256, and this is enabled by default for every service, including Cloud Storage. No configuration, bucket settings, or key provision steps are needed to activate encryption. If a customer wants more control, they can optionally use Cloud KMS with CMEK or CSEK, but that enhances key management rather than providing encryption, which already exists.

Zero Trust security model

The Zero Trust security model fundamentally eliminates implicit trust based on network location, mandating continuous authentication, authorization, and encryption for every request, regardless of whether the source is inside or outside the corporate boundary. It operationalizes the 'never trust, always verify' principle through identity-centric policies, device posture checks, and microsegmentation, ensuring that even compromised internal hosts cannot move laterally without re-verification.

Google handles physical security, hardware maintenance, and OS and database software patching.

This is the correct description of the shared responsibility model for managed database services like Cloud SQL. Google is responsible for data center physical security (e.g., biometric access controls, armed guards), hardware lifecycle management (failed disk replacement), and patching the underlying operating system and database engine. For example, Cloud SQL automatically applies minor version updates and security patches; customers can schedule maintenance windows for major upgrades. These infrastructure-level tasks are handled entirely by Google, which is what distinguishes a fully managed service from a self-managed Compute Engine VM.

Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.

Google Cloud participates in HIPAA compliance by providing a BAA and offering infrastructure that addresses physical, environmental, and certain technical safeguards. However, the Shared Responsibility Model makes the customer accountable for configuring services correctly, managing access controls, enabling audit logging, encrypting data where required, and implementing contingency plans. Without these customer-side actions, even a signed BAA does not render a workload compliant.

`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries)

The `dataViewer` role grants read-only access to BigQuery datasets and tables, allowing the engineer to inspect schema and data. However, it does not include permission to create query jobs, so to actually run SELECT statements via the console or API, the `jobUser` role is also required. This pairing gives the engineer exactly the read-and-query capability needed, without write, delete, or administrative permissions, adhering to least privilege.

Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.

Cloud Data Loss Prevention (Cloud DLP) is the correct service because it natively integrates with BigQuery to run inspection jobs on tables and columns, using over 150 built-in infoTypes (e.g., credit card numbers, email addresses, government IDs) plus custom infoTypes for organization-specific data. Scheduled inspection jobs enable continuous governance monitoring, ensuring new sensitive data is detected as it is added. DLP also offers de-identification transforms—such as masking, tokenization, and encryption—to protect the identified sensitive data, making it the only option that directly scans and classifies data content at scale.