Cloud Digital Leader Practice Test 1 — 10 Questions

Question 1

A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create a service perimeter that restricts access to Google Cloud APIs (including Cloud Storage) so that requests originating outside the perimeter are denied even if the bucket is public or IAM grants access. This is the only feature that enforces a network-origin boundary around managed services like Cloud Storage.

Answer

VPC firewall rules

Answer

Cloud Armor

Answer

IAM conditions

Question 2

An organization wants to use Google Cloud for processing healthcare data subject to HIPAA regulations in the United States. Which contractual document must the organization obtain from Google before storing Protected Health Information (PHI) in Google Cloud?

Accepted Answer

A Business Associate Agreement (BAA), which is legally required by HIPAA before any covered entity can process Protected Health Information with a cloud provider. Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Answer

A Non-Disclosure Agreement (NDA) to prevent Google from disclosing the existence of the healthcare application

Answer

A Data Processing Agreement (DPA) as required under GDPR for European data subjects

Answer

An ISO 27001 certificate issued by Google Cloud demonstrating information security compliance

Question 3

An operations team tracks the following metrics for their customer portal: request latency p99, error rate, and requests per second. In Site Reliability Engineering terminology, what are these metrics called, and what do they collectively define?

Accepted Answer

Service Level Indicators (SLIs), which measure specific dimensions of service behavior from the user's perspective and collectively define how reliability is quantified. In Site Reliability Engineering (SRE), the metrics p99 latency, error rate, and requests per second are classified as Service Level Indicators (SLIs). SLIs are carefully chosen quantitative measures of specific aspects of the service's behavior, such as availability, latency, or throughput, as experienced by the end user. Collectively, these SLIs define how reliability is quantified and are used to set and monitor Service Level Objectives (SLOs).

Answer

Key Performance Indicators (KPIs) that define the overall health of the business

Answer

Service Level Agreements (SLAs), defining the contractual commitments made to customers

Answer

Operational metrics that are only relevant to the infrastructure team and not to business stakeholders

Question 4

A company is moving a regulated workload to Google Cloud and must ensure that their encryption keys are stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3 validation. Which Google Cloud key management option satisfies this requirement?

Accepted Answer

Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules. Cloud HSM is the correct choice because it provides a dedicated HSM service that stores and manages encryption keys in FIPS 140-2 Level 3 validated hardware security modules. This directly meets the regulatory requirement for a hardware security module with that specific validation level, as opposed to software-backed or customer-supplied key options.

Answer

Cloud KMS software-backed keys, which are managed by Google and stored in Google's secure key management infrastructure

Answer

Customer-supplied encryption keys (CSEK), where the customer provides the key with each API request

Answer

Secret Manager, which stores API keys and credentials with automatic rotation

Question 5

A company's security architect wants to implement 'privacy by design' principles when building a new customer data platform on Google Cloud. What does privacy by design mean in this context?

Accepted Answer

Privacy by design means privacy protections (encryption, data minimization, access controls, retention policies) are architected into the system from the start, not added after deployment.. Privacy by design is a foundational principle that requires embedding privacy controls—such as encryption, data minimization, access controls, and retention policies—into the architecture of a system from the initial design phase, rather than retrofitting them after deployment. In the context of Google Cloud, this means using services like Cloud KMS for encryption, IAM for fine-grained access control, and data lifecycle policies to minimize data collection and enforce retention limits from the start. Option B correctly captures this proactive, integrated approach.

Answer

Privacy by design means the platform must refuse to collect any personal data from customers.

Answer

Privacy by design is a legal requirement that mandates using only on-premises systems for customer data.

Answer

Privacy by design means storing all data in an encrypted format and using a VPN for all access.

Question 6

A developer needs to store application secrets (database passwords, API keys, OAuth tokens) securely so that they are not hardcoded in source code or environment variables. The secrets should be automatically versioned and rotatable. Which Google Cloud product is designed for this secure secrets management requirement?

Accepted Answer

Secret Manager, which stores secrets encrypted at rest with automatic versioning, rotation support, and fine-grained IAM access control. Secret Manager is Google Cloud's dedicated service for storing application secrets such as database passwords, API keys, and OAuth tokens. It provides encryption at rest using AES-256, automatic versioning (each new secret version is immutable and timestamped), and built-in rotation support via scheduled rotation policies. Fine-grained IAM roles (e.g., roles/secretmanager.secretAccessor) ensure least-privilege access without exposing secrets in source code or environment variables.

Answer

Cloud Storage, by storing secrets in an encrypted bucket with restricted IAM access

Answer

Cloud KMS, which generates encryption keys for encrypting application data

Answer

Cloud SQL, by storing secrets in an encrypted database table with restricted access

Question 7

An architect is evaluating whether to use a relational database or a NoSQL database for a new application that must store product catalog data. Products have highly variable attributes — a book has ISBN, author, and genre; a bicycle has frame size, wheel diameter, and material. Which database characteristic makes NoSQL document databases advantageous for this use case?

Accepted Answer

NoSQL document databases support flexible schemas where each document can have different fields — making them well-suited for product catalogs where different product types have different attributes. NoSQL document databases, such as MongoDB, store data in flexible, schema-less documents (often JSON or BSON). This allows each document to have a different set of fields, making them ideal for product catalogs where a book and a bicycle have entirely different attributes (e.g., ISBN vs. frame size). Relational databases require a predefined schema with fixed columns, forcing you to either create many sparse columns or use complex join tables to handle variable attributes.

Answer

NoSQL databases always provide faster query performance than relational databases for all use cases

Answer

NoSQL databases support ACID transactions better than relational databases, making them safer for product catalog updates

Answer

NoSQL databases are simpler to query because they don't require learning SQL

Question 8

A cloud operations team wants to ensure that all cloud resources created in their Google Cloud organization comply with company naming standards and required cost allocation labels. Which Google Cloud capability can automatically enforce these standards on resource creation?

Accepted Answer

Organization Policy Service with custom constraints or required label policies that prevent resource creation if naming and label standards are not met. Organization Policy Service with custom constraints or required label policies is correct because it provides a preventive control that blocks resource creation if the resource does not meet defined naming and label standards. This is enforced at the Google Cloud resource hierarchy level before any resource is provisioned, ensuring compliance automatically without relying on post-creation detection or manual processes.

Answer

Cloud Billing reports, which flag resources missing required labels after they are created

Answer

Cloud Monitoring alerts that notify the team when non-compliant resources are detected

Answer

Cloud IAM roles that only grant resource creation permissions to employees who have passed a naming standards training

Question 9

A company's DevOps team wants to orchestrate a complex workflow that involves calling multiple Google Cloud APIs in sequence — first running a Cloud Build job, then checking the results, then either deploying to Cloud Run or sending a notification. Which Google Cloud product is designed for orchestrating multi-step workflow logic?

Accepted Answer

Google Cloud Workflows, which orchestrates multi-step processes by calling APIs in sequence with conditional logic, error handling, and state management. Google Cloud Workflows is the correct choice because it is a fully managed orchestration platform specifically designed to define multi-step workflows that call Google Cloud APIs and external services in sequence. It supports conditional logic (e.g., if-then-else), error handling (e.g., retries with exponential backoff), and state management, making it ideal for the described scenario of running a Cloud Build job, checking results, and conditionally deploying to Cloud Run or sending a notification.

Answer

Cloud Scheduler, which triggers a series of jobs at specified cron intervals

Answer

Cloud Pub/Sub, by publishing messages between pipeline stages to trigger each subsequent step

Answer

Cloud Run, by writing the orchestration logic as a container application that calls other services sequentially

Question 10

A data engineering team needs to build a pipeline that reads event data from Pub/Sub in real time, applies transformations and aggregations, and writes results to BigQuery — all without managing any infrastructure. Which Google Cloud product is designed for this serverless stream and batch data processing use case?

Accepted Answer

Cloud Dataflow, Google Cloud's serverless stream and batch data processing service built on Apache Beam. Cloud Dataflow is Google Cloud's fully managed, serverless service for both stream and batch data processing, built on Apache Beam. It directly reads from Pub/Sub, applies transformations and aggregations using the Beam SDK, and writes the results to BigQuery without requiring any infrastructure management, making it the correct choice for this use case.

Answer

Cloud Composer, Google Cloud's managed Apache Airflow service for workflow orchestration

Answer

Cloud Dataproc, Google Cloud's managed Spark and Hadoop service

Answer

BigQuery directly, using streaming inserts to load Pub/Sub data in real time