Cloud Digital Leader Practice Test 10 — 10 Questions

Question 1

An architect proposes using a 'private cloud' deployment model for a company that wants cloud-like capabilities but is prohibited from using public cloud due to data residency regulations. What is a key advantage of private cloud compared to public cloud, and what is a significant trade-off?

Accepted Answer

Advantage: full control over data residency, security posture, and compliance configuration. Trade-off: organization bears full cost of infrastructure, loses public cloud's scale economics, and has limited elasticity compared to public cloud's vast resource pools. Option B is correct because a private cloud gives the organization exclusive control over data residency, security, and compliance, which is essential when regulations prohibit public cloud use. The trade-off is that the organization must bear the full capital and operational costs of the infrastructure, losing the scale economics and near-infinite elasticity of public cloud providers like AWS, Azure, or GCP.

Answer

Advantage: private cloud is always cheaper than public cloud. Trade-off: private cloud provides less storage capacity

Answer

Advantage: private cloud provides automatic scaling to unlimited capacity. Trade-off: private cloud requires purchasing hardware every time capacity is needed

Answer

Advantage: private cloud services are managed by the cloud provider, reducing operational burden. Trade-off: customers cannot customize private cloud configurations

Question 2

A security audit finds that a company's application service accounts have been granted broad IAM roles (e.g., Storage Admin on the entire project) when they only need to read specific Cloud Storage buckets. The auditor recommends following the principle of least privilege. What is the most precise way to implement this for the Cloud Storage use case?

Accepted Answer

Grant Storage Object Viewer (read-only) at the specific bucket level for each service account that needs read access — not at the project level. Option B is correct because it grants the minimal required permission (Storage Object Viewer) at the specific bucket level, adhering to the principle of least privilege. This ensures the service account can only read objects in that bucket and cannot perform any other storage operations, even accidentally. Granting roles at the resource level (bucket) rather than the project level eliminates unnecessary broad access.

Answer

Grant the Storage Admin role at the project level but add a condition that limits it to specific operations

Answer

Create a custom IAM role that combines all permissions from all predefined roles but removes the most dangerous ones

Answer

Use the same broad Storage Admin role but rotate the service account key every 90 days to reduce the window of exposure

Question 3

A product manager asks a cloud engineer: 'What exactly is an API, and why is it important for our cloud-based application?' Which explanation is most accurate and useful for a non-technical product manager?

Accepted Answer

An API is a defined contract that allows software components, services, and applications to communicate and exchange data with each other — enabling integration between cloud services and third-party systems without requiring knowledge of each other's internals. Option B is correct because an API (Application Programming Interface) is a defined contract—typically using HTTP methods (GET, POST, PUT, DELETE) and data formats like JSON or XML—that enables software components to communicate and exchange data without exposing internal implementation details. For a cloud-based application, APIs are crucial because they allow seamless integration between cloud services (e.g., AWS Lambda, Azure Functions) and third-party systems, enabling modularity, scalability, and interoperability. This explanation is most accurate and useful for a non-technical product manager as it focuses on the functional role of APIs rather than misleading technical jargon.

Answer

An API is a programming language used to write cloud applications, similar to Python or Java

Answer

An API is a user interface that allows non-technical staff to access cloud resources through a web browser

Answer

An API is a security certificate that authenticates cloud services to prevent unauthorized access

Question 4

A company's security team wants to be alerted when someone with administrative permissions changes an IAM policy in their Google Cloud organization. Which Google Cloud capability enables this detection?

Accepted Answer

Admin Activity audit logs combined with Cloud Monitoring log-based alerting, which records and alerts on IAM policy modifications by any principal. Admin Activity audit logs record all changes to IAM policies and other configuration changes in Google Cloud. By combining these logs with Cloud Monitoring log-based alerting, the security team can create a specific alert that triggers whenever an IAM policy is modified by a principal with administrative permissions, enabling real-time detection of unauthorized changes.

Answer

Data Access audit logs, which record when data is read from Cloud Storage buckets

Answer

Cloud Armor, which blocks unauthorized IAM policy changes at the network layer

Answer

VPC flow logs, which capture all network traffic including IAM API calls

Question 5

A bank's innovation team proposes building a new digital lending product using cloud services. The risk team objects, citing regulatory concerns about data sovereignty and auditability in cloud environments. What is the most effective way for the innovation team to address these concerns?

Accepted Answer

Demonstrate that Google Cloud provides the specific regulatory controls needed: data residency configuration, comprehensive audit logging, compliance certifications, and contractual frameworks that satisfy the bank's regulatory requirements. Regulatory concerns about cloud are real but addressable. Cloud providers offer compliance certifications (SOC 2, ISO 27001, banking-specific standards), data residency controls, comprehensive audit logging, and contractual frameworks (BAAs, DPAs). The innovation team should demonstrate that the specific controls required by regulators exist and are configurable, rather than treating cloud as incompatible with regulation.

Answer

Avoid cloud entirely for the new product and build on-premises to eliminate regulatory concerns

Answer

Ignore the risk team's concerns and proceed with cloud development, as regulators have approved cloud for all banking applications globally

Answer

Commission a multi-year study to determine whether cloud regulation will change before proceeding

Question 6

A company is comparing the total cost of keeping its data center versus moving to public cloud. An analyst argues that the comparison should include not just hardware costs but also facility costs. What facility costs should be included in the on-premises total cost of ownership calculation?

Accepted Answer

Physical space/rent, electricity (for servers and cooling), cooling system maintenance, physical security, and fire suppression — all of which are real costs borne by the organization for operating its own data center. Option B is correct because a comprehensive on-premises total cost of ownership (TCO) must include all facility-related costs that are directly incurred to operate a data center. These include physical space/rent, electricity for servers and cooling, cooling system maintenance, physical security, and fire suppression. Excluding these costs would understate the true cost of running an on-premises environment, which is a key consideration when comparing to public cloud models like IaaS.

Answer

Only the cost of the servers themselves, since other costs are shared across the organization

Answer

Internet connectivity costs only, since data centers require high-bandwidth connections

Answer

Data center facility costs do not need to be included since they are fixed costs that don't change whether servers are present or not

Question 7

A CISO asks why Google Cloud's security model is described as a 'defense-in-depth' approach. Which explanation best describes this concept in the context of Google Cloud's infrastructure security?

Accepted Answer

Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system. Option B is correct because Google Cloud's defense-in-depth model implements security at multiple independent layers: physical security (e.g., tamper-evident cages), hardware attestation (e.g., Titan chips verifying boot integrity), network encryption (e.g., mTLS between all services), hypervisor isolation (e.g., gVisor or KVM-based sandboxing), and application-level IAM (e.g., Cloud IAM policies). This layered approach ensures that if an attacker bypasses one layer, other layers remain intact to protect the system, aligning with the core principle of defense in depth.

Answer

Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data

Answer

Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary

Answer

Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure

Question 8

A traditional insurance company is facing competition from 'insurtech' startups that use telematics data, AI, and cloud platforms to offer usage-based, real-time personalized insurance products. The traditional company's CTO proposes a cloud-first digital transformation. Which business model change most clearly represents digital transformation rather than digitization?

Accepted Answer

Offering usage-based, dynamically priced insurance products using real-time telematics data and ML-driven individual risk assessment — replacing demographic-table pricing with behavioral data. Usage-based, real-time personalized insurance (pricing based on actual driving behavior, individual risk profiles, or real-time sensor data) represents a fundamental business model transformation. It replaces actuarial tables and demographic-based pricing with individual behavioral data. This is impossible without cloud-scale data processing and ML — it's not just automating existing processes but creating an entirely new product category.

Answer

Converting paper policy documents to digital PDFs stored in cloud document management systems

Answer

Replacing the claims processing fax machine with an online portal

Answer

Moving the company's email system to Google Workspace to improve employee collaboration

Question 9

A company runs a multi-tenant SaaS application on Google Cloud where each customer's data must be strictly isolated from other customers'. A security architect is evaluating approaches: (A) logical isolation using application-level tenant IDs in a shared database, (B) IAM-based separation using separate service accounts per tenant, or (C) infrastructure-level isolation with separate Google Cloud projects per tenant. Which approach provides the strongest isolation guarantee?

Accepted Answer

Separate Google Cloud projects per tenant, which provides the strongest isolation: separate IAM boundaries, separate resource namespaces, separate audit logs, and no shared database instances with other tenants. Option B is correct because separate Google Cloud projects provide the strongest isolation guarantee by creating independent IAM boundaries, resource namespaces, audit logs, and network configurations. This approach ensures that no shared database instances or other resources exist between tenants, eliminating any risk of cross-tenant data leakage through application bugs or misconfigurations. In contrast, logical isolation (A) relies on application-level tenant IDs which can be bypassed by software vulnerabilities, and IAM-based separation (C) still shares the underlying project infrastructure, including the same database and network.

Answer

Logical isolation using application-level tenant IDs, because it is the most cost-efficient and sufficient for regulated workloads

Answer

IAM-based separation using separate service accounts per tenant within a shared project, because IAM provides cryptographically enforced access control

Answer

All three approaches provide equivalent isolation because Google Cloud's hypervisor ensures complete tenant separation at the hardware level

Question 10

A company needs to run containerized workloads but wants to avoid managing Kubernetes cluster infrastructure (node pools, cluster upgrades, node autoscaling) entirely. They want to simply deploy container images and have Google Cloud manage all underlying infrastructure automatically. Which Google Cloud product best fits this fully managed container execution requirement?

Accepted Answer

Cloud Run, which executes container images on fully managed serverless infrastructure with automatic scaling and no cluster or node management. Cloud Run is the correct choice because it provides a fully managed serverless platform that executes container images without any cluster or node management. It automatically handles scaling, infrastructure provisioning, and maintenance, aligning perfectly with the requirement to avoid managing Kubernetes cluster infrastructure entirely.

Answer

Google Kubernetes Engine (GKE) Standard mode, where the team manages node pools and cluster configuration

Answer

Compute Engine with a startup script that pulls and runs the container image from Artifact Registry

Answer

App Engine Flexible, which runs containers on managed virtual machines