Cloud Digital Leader Practice Test 11 — 15 Questions

Question 1

An enterprise's security team is implementing a strategy to protect against 'credential stuffing' attacks — where attackers use lists of username/password combinations from previous data breaches to try to log in to the company's applications. Which authentication control most effectively mitigates this threat?

Accepted Answer

Multi-Factor Authentication (MFA/2SV), which requires a second verification factor beyond the password that attackers don't have even when they possess the stolen credentials. Multi-Factor Authentication (MFA/2SV) is the most effective control against credential stuffing because it requires an additional verification factor (e.g., a one-time code from an authenticator app, a hardware token, or a biometric) that the attacker does not possess, even if they have valid username/password pairs from a breach. This renders the stolen credentials useless for authentication, as the attacker cannot complete the second factor challenge. In Google Cloud, this is commonly enforced via Identity Platform or Cloud Identity with security keys or TOTP.

Answer

Requiring longer, more complex passwords to make credentials harder to guess

Answer

Encrypting passwords in the company's database using bcrypt to prevent the stolen passwords from being usable

Answer

Implementing HTTPS on the login page to prevent credentials from being intercepted in transit

Question 2

A developer needs to store application secrets (database passwords, API keys, OAuth tokens) securely so that they are not hardcoded in source code or environment variables. The secrets should be automatically versioned and rotatable. Which Google Cloud product is designed for this secure secrets management requirement?

Accepted Answer

Secret Manager, which stores secrets encrypted at rest with automatic versioning, rotation support, and fine-grained IAM access control. Option B is correct because Secret Manager is Google Cloud's dedicated service for storing application secrets such as database passwords, API keys, and OAuth tokens. It provides encryption at rest using AES-256, automatic versioning (each new secret version is immutable and timestamped), and built-in rotation support via scheduled rotation policies. Fine-grained IAM roles (e.g., roles/secretmanager.secretAccessor) ensure least-privilege access without exposing secrets in source code or environment variables.

Answer

Cloud Storage, by storing secrets in an encrypted bucket with restricted IAM access

Answer

Cloud KMS, which generates encryption keys for encrypting application data

Answer

Cloud SQL, by storing secrets in an encrypted database table with restricted access

Question 3

A CISO is implementing a Zero Trust security architecture for the company's Google Cloud environment. Under Zero Trust, which fundamental assumption about network traffic changes compared to traditional perimeter-based security?

Accepted Answer

Zero Trust assumes no traffic is trusted by default regardless of network origin — every request must be explicitly authenticated and authorized based on identity, device posture, and context. Option B is correct because Zero Trust fundamentally shifts from implicit trust based on network location to explicit verification of every request. In Google Cloud, this means every API call, regardless of whether it originates from within the VPC or the internet, must be authenticated (e.g., using OAuth 2.0 or service account keys) and authorized based on identity, device posture, and context, as enforced by tools like Identity-Aware Proxy (IAP) and VPC Service Controls.

Answer

Zero Trust assumes that internal network traffic is more secure than external traffic because it has passed through the corporate firewall

Answer

Zero Trust assumes all traffic is malicious and blocks all requests by default, requiring explicit allowlisting for each connection

Answer

Zero Trust eliminates the need for encryption since all traffic is assumed to be on secure internal networks

Question 4

A startup needs to build a mobile application backend. They need user authentication, a real-time database that syncs to mobile clients automatically, and serverless functions for business logic — all managed with minimal backend engineering. Which Google Cloud platform provides this integrated mobile/web backend solution?

Accepted Answer

Firebase, which provides integrated authentication, auto-syncing Firestore database, serverless functions, and hosting — designed for mobile and web backends with minimal engineering overhead. Firebase is the correct answer because it is a Google Cloud platform specifically designed to provide an integrated mobile/web backend with minimal engineering overhead. It bundles user authentication, a real-time NoSQL database (Firestore) that automatically syncs data to clients, and serverless Cloud Functions for business logic, all managed without requiring backend infrastructure provisioning.

Answer

Google Kubernetes Engine (GKE), for containerized backend microservices

Answer

BigQuery, for storing and analyzing mobile application user data

Answer

Cloud Spanner, for globally consistent transactional data storage in the mobile backend

Question 5

A machine learning team wants to train, evaluate, deploy, and monitor ML models in a unified platform without managing infrastructure, and with built-in support for experiment tracking, model versioning, and A/B testing between model versions. Which Google Cloud product provides this end-to-end managed ML platform?

Accepted Answer

Vertex AI, Google Cloud's unified ML platform covering training, experiment tracking, model registry, deployment, and monitoring in a single managed service. Vertex AI is Google Cloud's unified ML platform that provides an end-to-end managed service for training, evaluating, deploying, and monitoring ML models without requiring infrastructure management. It includes built-in experiment tracking, a model registry for versioning, and supports A/B testing between model versions, directly matching the question's requirements.

Answer

BigQuery ML, for training and deploying ML models using SQL within BigQuery

Answer

Cloud Dataproc, for running distributed Spark ML jobs on managed Hadoop clusters

Answer

Cloud Functions, for deploying ML inference code as serverless functions

Question 6

A company's compliance team asks what evidence they can provide to regulators to demonstrate that Google Cloud services meet industry security standards. Which type of documentation most directly provides this evidence?

Accepted Answer

Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager, which provide independent verification of security controls. Compliance reports and audit certifications from independent third parties (SOC 2 Type II reports, ISO 27001 certificates, PCI DSS attestation) are the most credible evidence for regulators. These documents represent independent auditors certifying that specific controls were in place and operating effectively during the audit period. Google Cloud makes these reports available to customers through the Compliance Reports Manager.

Answer

Google Cloud's marketing materials and product documentation describing security features

Answer

The company's own internal security policies that reference using Google Cloud

Answer

A Google Cloud support ticket confirming that the company's account is in good standing

Question 7

A traditional taxi company is losing market share to ride-sharing apps built on cloud platforms. A digital transformation consultant explains that the ride-sharing companies have a fundamental advantage rooted in their technology architecture. Which cloud-enabled capability most directly explains the ride-sharing companies' competitive advantage?

Accepted Answer

Cloud-enabled real-time matching, dynamic ML-driven pricing, and elastic mobile platforms create an operating model that taxi companies' legacy systems cannot replicate. Option B is correct because ride-sharing companies leverage cloud-native architectures—specifically real-time matching algorithms, machine learning (ML) for dynamic pricing, and elastic mobile platforms—to create an operating model that scales instantly with demand. This cloud-enabled capability allows them to optimize driver-rider pairing and pricing in milliseconds, a level of agility that traditional taxi companies with on-premises legacy systems cannot replicate. The fundamental advantage is not about asset ownership or tax structure but about the architectural ability to process massive real-time data streams and adjust operations dynamically.

Answer

Ride-sharing companies own more vehicles than taxi companies, giving them greater fleet capacity

Answer

Ride-sharing companies pay lower taxes, giving them a cost advantage over regulated taxi companies

Answer

Ride-sharing apps are available on smartphones, while taxis require phone calls

Question 8

A company is planning a cloud architecture and needs to decide between a monolithic application design and a microservices architecture. What is the most significant operational trade-off between these two approaches in a cloud environment?

Accepted Answer

Microservices enable independent deployment and scaling per component but introduce distributed systems complexity (network overhead, distributed tracing, service discovery, consistency challenges); monoliths are simpler to operate but scale and deploy as a unit. Monoliths are simpler to develop, test, and deploy initially but scale as a unit and create tight coupling — a change to one part requires deploying the whole application. Microservices enable independent deployment and scaling of components but introduce distributed systems complexity (network calls, service discovery, distributed tracing, eventual consistency). Neither is universally better — the trade-off depends on team size, domain complexity, and operational maturity.

Answer

Monoliths can only run on-premises, while microservices were designed specifically for cloud environments

Answer

Microservices are always cheaper to operate in the cloud because each service uses fewer resources than a monolith

Answer

Monolithic applications cannot be scaled horizontally in cloud environments

Question 9

A cloud team wants to understand their current Google Cloud resource inventory — specifically, which VMs are running in each region, their machine types, and whether they have public IP addresses. Which approach most efficiently provides this across all projects?

Accepted Answer

Use Cloud Asset Inventory to run a single org-wide query that returns all VM instances, their regions, machine types, and network configurations across all projects. Cloud Asset Inventory provides a single, unified API to query resources across all projects in an organization. By using the `gcloud asset search-all-resources` command with the `--asset-types=compute.googleapis.com/Instance` filter, you can retrieve all VM instances along with their regions, machine types, and network configurations (including public IP addresses) in one operation, without needing to access each project individually.

Answer

Log into each Google Cloud project individually through the Console and manually record VM details in a spreadsheet

Answer

Check the Cloud Billing reports, which list all resources that have incurred charges by resource type

Answer

Enable VPC flow logs in each project to capture VM network activity

Question 10

A company is building a new application that needs to send transactional emails (order confirmations, password resets, account notifications) to customers. Google Cloud does not provide a native SMTP email service. Which approach is standard for sending transactional emails from Google Cloud applications?

Accepted Answer

Integrating a third-party transactional email service (such as SendGrid, Mailgun, or Postmark) via API from the Cloud Run or Cloud Functions application. Option B is correct because Google Cloud does not offer a native SMTP service for sending transactional emails. The standard approach is to integrate a third-party transactional email service (e.g., SendGrid, Mailgun, Postmark) via API from serverless compute services like Cloud Run or Cloud Functions. These services handle deliverability, reputation, and compliance with email standards (SPF, DKIM, DMARC) that are critical for transactional email.

Answer

Using Cloud Storage to store email templates and delivering them directly to customers' inboxes

Answer

Running a self-managed SMTP server on a Compute Engine VM and configuring MX records to deliver email

Answer

Using Gmail directly by authenticating the application with a corporate Gmail account and sending through Gmail SMTP

Question 11

An organization wants to use Google Cloud for processing healthcare data subject to HIPAA regulations in the United States. Which contractual document must the organization obtain from Google before storing Protected Health Information (PHI) in Google Cloud?

Accepted Answer

A Business Associate Agreement (BAA), which is legally required by HIPAA before any covered entity can process Protected Health Information with a cloud provider. Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Answer

A Non-Disclosure Agreement (NDA) to prevent Google from disclosing the existence of the healthcare application

Answer

A Data Processing Agreement (DPA) as required under GDPR for European data subjects

Answer

An ISO 27001 certificate issued by Google Cloud demonstrating information security compliance

Question 12

A healthcare company needs to run a large batch processing job that analyzes patient records using Apache Spark, transforming data from Cloud Storage and writing results to BigQuery. The job runs once daily and requires a large cluster that should exist only during the job. Which Google Cloud product best handles this ephemeral large-batch Spark workload?

Accepted Answer

Cloud Dataproc, which runs managed Apache Spark clusters that can be created for the job and deleted on completion — paying only during the processing window. Cloud Dataproc is the correct choice because it provides managed Apache Spark clusters that can be created on demand for the batch job and automatically deleted upon completion, ensuring you only pay for the processing time. This ephemeral cluster model perfectly matches the requirement of a large cluster that exists only during the daily job, without manual infrastructure management.

Answer

Cloud Dataflow, for running the Apache Spark code as a streaming pipeline

Answer

Compute Engine VMs, by manually installing Apache Spark on a cluster of VMs each day before the job

Answer

BigQuery, by running the Spark transformation directly within BigQuery's execution engine

Question 13

A CISO is designing an identity strategy for Google Cloud that follows Zero Trust principles. She proposes that no long-lived credentials (API keys, service account keys) should be used for any automated workloads. What Google Cloud mechanism replaces service account keys for authenticating workloads running on Google Cloud infrastructure?

Accepted Answer

Attaching a service account to the Compute Engine VM or GKE workload, allowing the workload to obtain short-lived access tokens from the metadata server automatically — no key files required. Option B is correct because Google Cloud's default service account attached to Compute Engine VMs or GKE nodes uses the metadata server to automatically obtain short-lived OAuth 2.0 access tokens (typically valid for 1 hour). This eliminates the need for any long-lived key files, aligning with Zero Trust principles by reducing credential exposure and enabling automatic rotation.

Answer

Using long-lived API keys stored in Secret Manager instead of environment variables — the keys are the same but stored more securely

Answer

Rotating service account keys every 24 hours to minimize the exposure window

Answer

Using OAuth 2.0 user accounts instead of service accounts for all automated workloads

Question 14

A startup is building a gaming application where players must see each other's moves in real time. The database storing game state must guarantee that all players see the same state simultaneously. Which consistency requirement does this impose and why does it matter for database selection?

Accepted Answer

Strong consistency is required so all players simultaneously read the same current game state; eventual consistency would create conflicting game states visible to different players. B is correct because real-time multiplayer gaming requires strong consistency to ensure all players see the identical game state simultaneously. In a GCDL context, this means the database must support ACID transactions or linearizable reads (e.g., using Google Cloud Spanner or a strongly consistent NoSQL system like Cloud Firestore in strong consistency mode). Eventual consistency would allow different players to observe different board positions, breaking the game's core requirement of a shared, current state.

Answer

Eventual consistency is sufficient; the game can show slightly stale state to some players without impact on gameplay

Answer

Consistency doesn't matter for gaming databases because games update state so frequently that any inconsistency resolves within milliseconds

Answer

The game should avoid databases entirely and use local storage on each player's device to ensure fast, consistent state access

Question 15

A cloud team wants to automatically enforce that all new Compute Engine VMs are created with a specific label (environment: production) and that no VMs are created with external IP addresses in the production project. Which Google Cloud capability enforces these organizational policies at resource creation time?

Accepted Answer

Organization Policy Service constraints that enforce no external IPs and required labels at resource creation time, blocking non-compliant VMs before they are created. Organization Policy Service constraints, specifically `compute.vmExternalIpAccess` and `compute.requireOsLogin` or custom constraints for labels, are evaluated at resource creation time. They block non-compliant VM creation before the API call succeeds, enforcing policies like 'no external IPs' and 'required labels' without relying on post-creation detection or IAM permissions.

Answer

Cloud Monitoring alerting policies that detect and notify when non-compliant VMs are created

Answer

Cloud IAM roles that prevent developers from creating VMs without the proper labels

Answer

Cloud Billing budget alerts that detect when VM spending exceeds expected amounts for labeled resources