Cloud Digital Leader Practice Test 12 — 15 Questions

Question 1

A security engineer notices that a Compute Engine instance is running a VM with a public IP that should not be accessible from the internet. They want to ensure this configuration is prevented by default for all future projects in the organization. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define an Organization Policy with the constraint compute.vmExternalIpAccess. Organization Policies in Google Cloud allow you to set constraints at the organization, folder, or project level to enforce security controls. The `compute.vmExternalIpAccess` constraint specifically prevents VMs from being created with external IP addresses, ensuring that no future Compute Engine instances in the organization can have public IPs by default. This is a preventive control that applies to all new VM creations, unlike IAM policies or firewall rules which are more granular or reactive.

Answer

Set an IAM policy to deny compute.instances.create with public IP

Answer

Create a VPC firewall rule to deny all traffic from the internet to the VM

Answer

Use Cloud Security Scanner to identify and remediate

Question 2

A financial services firm wants to improve disaster recovery without maintaining a second physical data center. They need to replicate data asynchronously and failover quickly. How does cloud transformation help?

Accepted Answer

Creating a replica in another Cloud Region using Cloud Storage and Cloud SQL replicas. It leverages Cloud Storage for durable, asynchronous object replication and Cloud SQL replicas for cross-region database failover. This eliminates the need for a second physical data center while providing quick failover via a standby replica in another region, meeting the requirements for asynchronous replication and rapid recovery.

Answer

Setting up a VPC peering to a partner data center

Answer

Using managed instance groups in the same region

Answer

Using tape backup stored offsite

Question 3

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) into the correct order.

Accepted Answer

Build the Docker container image, push it to Container Registry, create a GKE cluster, apply a Deployment manifest using kubectl, then expose the Deployment as a Service.. The correct sequence starts with containerizing the app, creating a cluster, defining the deployment, applying it, and exposing it as a service.

Answer

Create a GKE cluster, build the Docker container image, push it to Container Registry, apply a Deployment manifest, then expose as a Service.

Answer

Build the Docker container image, create a GKE cluster, apply a Deployment manifest, push the image to Container Registry, then expose as a Service.

Answer

Build the Docker container image, push it to Container Registry, create a GKE cluster, expose as a Service, then apply a Deployment manifest.

Question 4

A company wants to ensure that no employee can accidentally delete critical data stored in Cloud Storage. They need a solution that protects against accidental deletion even by users with full permissions. Which approach should they use?

Accepted Answer

Enable Object Versioning and set a retention policy. Object Versioning in Cloud Storage preserves non-current object versions, allowing recovery from accidental overwrites or deletions. A retention policy prevents object deletion (including version deletion) until the retention period expires, even for users with full permissions like `storage.objects.delete`. Together, they provide a defense-in-depth against accidental data loss.

Answer

Use customer-managed encryption keys

Answer

Set up Cloud Audit Logs for data access

Answer

Restrict IAM roles to Viewer only

Question 5

A financial services company is designing a multi-cloud architecture with Google Cloud and AWS. They need to encrypt data at rest in Google Cloud using a key stored in their on-premises Hardware Security Module (HSM). What is the best approach?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM). Cloud External Key Manager (Cloud EKM) is the correct approach because it allows you to manage encryption keys in an external key management system, such as an on-premises HSM, while using those keys to encrypt data at rest in Google Cloud. This meets the requirement of storing the key in the on-premises HSM, as Cloud EKM integrates with supported external key management partners or directly with your HSM via a key management proxy, ensuring that Google Cloud never has direct access to the raw key material.

Answer

Use default encryption

Answer

Use Cloud HSM

Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK

Question 6

An organization wants to ensure business continuity by replicating critical data to a different region. Which Google Cloud feature should they use?

Accepted Answer

Cloud Storage dual-region or multi-region. Cloud Storage dual-region or multi-region configuration is the correct choice because it provides built-in, asynchronous replication of data across geographically separated locations, ensuring business continuity through high availability and durability. This feature automatically stores redundant copies of objects in multiple zones within a region or across regions, protecting against regional failures without requiring additional infrastructure or manual intervention.

Answer

Cloud Dataflow

Answer

Compute Engine instance groups

Answer

Cloud VPN

Question 7

A company needs to analyze streaming data from IoT devices in real time. Which Google Cloud service should they use as the primary ingestion and analysis pipeline?

Accepted Answer

Dataflow. Dataflow is the correct choice because it provides a unified stream and batch processing model based on Apache Beam, enabling real-time ingestion and analysis of streaming IoT data with exactly-once processing semantics and automatic scaling. BigQuery is a data warehouse for analytics on stored data, not a real-time ingestion pipeline. Cloud Storage is an object store for static data, not a streaming pipeline. Cloud Pub/Sub is a messaging service for ingestion but lacks built-in analysis capabilities.

Answer

BigQuery

Answer

Cloud Storage

Answer

Cloud Pub/Sub

Question 8

A retail company wants to migrate its on-premises e-commerce platform to Google Cloud. The application is stateless and runs on virtual machines. The company wants to minimize operational overhead and allow the application to automatically scale based on CPU utilization. Which Google Cloud service should they use?

Accepted Answer

Compute Engine with managed instance groups and autoscaling. The application runs on virtual machines and is stateless, making Compute Engine with managed instance groups and autoscaling the most direct fit. Managed instance groups automatically handle scaling based on CPU utilization without requiring containerization or code changes, minimizing operational overhead while preserving the existing VM-based architecture.

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Run

Answer

App Engine Standard Environment

Question 9

A security team wants to be alerted when Google Cloud personnel access their customer data. They need logs that show the reason for access and what data was accessed. Which service provides this?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed records of Google personnel access to customer data, including reason and scope.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Cloud Logging

Question 10

A financial services company must store and process sensitive customer data that is subject to GDPR and PCI DSS. They need to ensure that data is encrypted at rest and in transit, and that encryption keys are managed by a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which Google Cloud service should they use for key management?

Accepted Answer

Cloud Hardware Security Module (Cloud HSM). Cloud HSM provides dedicated HSM hardware, FIPS 140-2 Level 3 certification, and allows customers to manage their own keys. Cloud KMS is software-based and only offers Level 1 validation. Cloud EKM uses external key management but the question asks for a Google-managed HSM option. Secret Manager is for storing secrets, not key management with HSM.

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Secret Manager

Answer

Cloud Key Management Service (Cloud KMS)

Question 11

A company needs to estimate the monthly cost of running a set of Compute Engine instances, including network egress and Cloud Storage usage, before deploying the architecture. Which tool should they use?

Accepted Answer

Google Cloud Pricing Calculator. The Google Cloud Pricing Calculator allows users to input their expected resource usage and receive a cost estimate before deployment.

Answer

Active Assist recommendations

Answer

Budget alerts

Answer

Cost Management dashboard

Question 12

Which Google Cloud security layer is responsible for protecting data stored on disk using either Google-managed or customer-managed encryption keys?

Accepted Answer

Data security. Data encryption at rest is a core component of data security, ensuring data stored on disk is encrypted. Google Cloud encrypts all data at rest by default using Google-managed keys, with options for CMEK and CSEK.

Answer

Operational security

Answer

Infrastructure security

Answer

Hardware security

Question 13

A company uses Cloud Load Balancing to distribute traffic to Compute Engine VMs. They want to protect against SQL injection and cross-site scripting attacks. Which service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP/S traffic for malicious patterns, including SQL injection and cross-site scripting (XSS) signatures. It integrates directly with Cloud Load Balancing to filter requests before they reach backend Compute Engine VMs, using pre-configured rules from the ModSecurity Core Rule Set (CRS) to block these common OWASP Top 10 threats.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls

Question 14

A company stores sensitive customer data in Cloud Storage buckets. The security team wants to ensure that only authorized users can access the data, and access is logged for audit. Which two practices should they implement? (Choose two.)

Accepted Answer

Apply IAM conditions to restrict access based on user attributes like IP address or time of day.. IAM conditions allow fine-grained, attribute-based access control, such as restricting access to Cloud Storage buckets based on the requester's IP address or time of day, ensuring only authorized users can access the data under specific contexts. Option C is correct because Cloud Audit Logs record all access attempts (including successful and denied requests) to the bucket, providing the necessary audit trail for security and compliance.

Answer

Use Storage Transfer Service to replicate data to a secured bucket.

Answer

Set up Private Google Access to restrict access to the bucket.

Answer

Enable default encryption on all buckets using CMEK.

Question 15

A company migrating to the cloud wants to focus on building applications rather than managing servers. Which Google Cloud compute service provides a fully managed platform for web applications that automatically scales?

Accepted Answer

App Engine. App Engine is a fully managed, serverless platform that automatically scales web applications based on traffic. It abstracts away server management, allowing developers to focus solely on writing code, which aligns directly with the requirement to build applications without managing infrastructure.

Answer

Cloud Functions

Answer

Google Kubernetes Engine

Answer

Compute Engine