Cloud Digital Leader Practice Test 12 — 15 Questions

Question 1

A company has a Google Cloud environment with 50 projects and 200 engineers. The security team wants to ensure that a new security policy — requiring all Cloud Storage buckets to have uniform bucket-level access enabled — applies to all existing and future buckets across all projects. Which approach scales to the entire organization?

Accepted Answer

Apply an Organization Policy constraint ('storage.uniformBucketLevelAccess') at the organization level to enforce the setting automatically across all current and future projects and buckets. Option B is correct because Organization Policy constraints, such as `storage.uniformBucketLevelAccess`, are enforced at the organization level and automatically apply to all existing and future projects and resources within the organization. This ensures uniform compliance without manual intervention, scaling seamlessly across 50 projects and 200 engineers.

Answer

Send an email to all 200 engineers explaining the policy and asking them to manually enable uniform bucket-level access on their buckets

Answer

Create a Cloud Function that checks bucket configurations hourly and enables uniform access on non-compliant buckets

Answer

Grant the security team Owner access to all 50 projects so they can manually enforce the policy in each project

Question 2

A company's security policy requires that when an employee is terminated, their access to all cloud resources must be revoked immediately — including any active sessions. Which approach most comprehensively achieves this in a Google Cloud environment integrated with Google Workspace?

Accepted Answer

Disabling the employee's Google Workspace account (which immediately invalidates all active sessions and prevents new authentication), then auditing for and revoking any service account keys they created. Disabling the Google Workspace account immediately invalidates all active sessions and prevents new authentication because Google Cloud IAM relies on the Workspace identity for user-based access. This single action revokes access across all Google Cloud projects and services that use that identity, including Cloud Console, gcloud CLI, and API sessions. Auditing and revoking service account keys the user created is necessary because those keys are not tied to the user's Workspace account and remain valid until explicitly deleted.

Answer

Manually reviewing and removing the employee's IAM bindings across all Google Cloud projects one by one

Answer

Changing the employee's password immediately — they can no longer log in with the old password

Answer

Waiting until the end of the business day to revoke access to avoid disrupting active workflows

Question 3

A company wants to connect its on-premises data center to Google Cloud with a reliable, lower-latency connection that doesn't traverse the public internet, but doesn't need the bandwidth of a full Dedicated Interconnect. Which Google Cloud connectivity product is most appropriate?

Accepted Answer

Partner Interconnect, which provides private connectivity through a service provider partner's network — supporting lower bandwidth tiers without requiring a direct physical fiber connection. Partner Interconnect is the correct choice because it provides private connectivity between an on-premises data center and Google Cloud via a service provider partner's network, offering lower bandwidth tiers (e.g., 50 Mbps to 10 Gbps) without requiring a direct physical fiber connection. This meets the requirements for a reliable, lower-latency connection that avoids the public internet, while Dedicated Interconnect would be overkill for bandwidth needs below 10 Gbps.

Answer

Cloud VPN, which creates an encrypted IPsec tunnel over the public internet

Answer

Dedicated Interconnect, which requires provisioning a 10 Gbps or 100 Gbps dedicated physical fiber connection

Answer

Cloud CDN, which caches content at edge locations close to the on-premises data center

Question 4

A company's risk management team wants to understand Google Cloud's approach to supply chain security — specifically, how Google ensures that the hardware and firmware running in its data centers have not been tampered with. Which Google security initiative addresses hardware supply chain integrity?

Accepted Answer

Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance. Option B is correct because Google's Titan security chip is a dedicated hardware root of trust that cryptographically verifies the boot firmware integrity and machine identity at every startup. This ensures that only Google-signed firmware runs on servers, preventing tampering during manufacturing, shipping, or deployment. Titan provides a hardware-anchored attestation chain that validates the entire supply chain from chip fabrication to rack installation.

Answer

Google uses third-party antivirus software to scan all hardware components for tampering before installation

Answer

Google relies on hardware manufacturers' security certifications to ensure supply chain integrity

Answer

Google encrypts all hardware components with AES-256 to prevent tampering

Question 5

A startup's website becomes unexpectedly popular and traffic spikes 50x within minutes. The application is hosted on Google Cloud. Which Google Cloud product automatically increases the number of application instances in response to this traffic spike without manual intervention?

Accepted Answer

Managed Instance Groups with autoscaling (for VMs) or Cloud Run (for containers), which automatically provision additional instances based on traffic load without manual intervention. Managed Instance Groups (MIGs) with autoscaling and Cloud Run both automatically adjust the number of running instances or container replicas based on real-time metrics like CPU utilization, request rate, or latency. When traffic spikes 50x, the autoscaler detects the increased load and provisions new VMs or container instances without any manual intervention, ensuring the application remains responsive. This is the only option that provides automatic, infrastructure-level scaling in response to load.

Answer

Cloud Monitoring, which detects the traffic spike and sends an alert to the operations team to manually scale up

Answer

Cloud Load Balancing, which distributes traffic evenly across existing instances to handle the spike

Answer

Cloud Billing, which automatically increases the spending limit when traffic spikes occur

Question 6

A company's cloud operations team is implementing a tagging strategy for cost allocation. They want to ensure that the 'cost-center' label is present on every Compute Engine VM and Cloud Storage bucket created in their Google Cloud organization. Currently, some resources are created without this label. Which combination of controls best enforces and remediates this requirement?

Accepted Answer

Organization Policy custom constraint to prevent creation of resources without the 'cost-center' label (preventive), plus Cloud Asset Inventory to identify existing unlabeled resources for remediation (detective). A preventive control (org policy custom constraint requiring the label) stops future non-compliant resources. A detective/corrective control (Cloud Asset Inventory + Cloud Functions or Security Command Center) finds and remediates existing unlabeled resources. Both are needed for comprehensive enforcement.

Answer

Only organization policy — once new resources are blocked, existing unlabeled resources don't matter

Answer

Only Cloud Asset Inventory monitoring — alerting on unlabeled resources is sufficient without preventing their creation

Answer

Grant all engineers the 'Labels Admin' role to encourage them to add labels voluntarily

Question 7

A telecommunications company has completed a cloud migration but finds that its business agility — the speed at which it can launch new products — has not improved. An analysis reveals that while the infrastructure is now cloud-based, the software development and release processes remain unchanged: quarterly release cycles, lengthy change approval boards, and manual testing. What does this situation illustrate?

Accepted Answer

Cloud infrastructure adoption without modernizing software delivery practices (CI/CD, automated testing, continuous deployment) does not unlock agility; the delivery process is the bottleneck. This illustrates that cloud infrastructure adoption without changing software delivery practices provides limited agility benefits. Cloud's agility potential is unlocked by complementary practices: CI/CD pipelines, automated testing, trunk-based development, and feature flags that enable continuous delivery. Quarterly release cycles with manual testing create the same bottleneck regardless of whether the infrastructure is on-premises or in the cloud.

Answer

The company chose the wrong cloud provider; a different provider's infrastructure would enable faster releases

Answer

Quarterly release cycles are appropriate for telecommunications products that require extensive regulatory testing, and the lack of agility is not a problem

Answer

The company must rebuild all applications as microservices before cloud can provide agility benefits

Question 8

A company's production database is running on a Compute Engine VM with a 500 GB Persistent Disk. The operations team wants to create a backup they can restore from in case of data corruption or accidental deletion. Which Google Cloud capability provides point-in-time backup for Persistent Disks?

Accepted Answer

Persistent Disk Snapshots, which capture the disk state at a point in time and enable restoration or creation of new disks from that snapshot. Persistent Disk Snapshots are the correct Google Cloud feature for creating point-in-time backups of Persistent Disks. They capture the disk's data and configuration at a specific moment, allowing you to restore the disk or create new disks from that snapshot. This is the native, recommended method for backup and disaster recovery of Compute Engine VM disks.

Answer

Cloud Storage bucket replication, by continuously copying the database files to a storage bucket

Answer

Cloud SQL automated backups, which protect databases running on Compute Engine VMs

Answer

VM live migration, which moves the running VM between physical hosts, automatically creating a backup in the process

Question 9

A company is deciding whether to store a large video archive (hundreds of terabytes, accessed perhaps twice per year for legal holds) in Google Cloud. Which Cloud Storage class is designed for this infrequently accessed, long-term archival use case?

Accepted Answer

Archive storage, which offers the lowest storage cost for data accessed less than once per year, accepting higher retrieval costs and latency for infrequent access. Archive storage is the correct choice because it is specifically designed for data that is accessed less than once per year, offering the lowest storage cost among Google Cloud Storage classes. This aligns perfectly with the use case of a large video archive accessed only twice per year for legal holds, where higher retrieval costs and latency are acceptable trade-offs for long-term preservation.

Answer

Standard storage, which provides the lowest latency and highest availability for frequently accessed data

Answer

Nearline storage, for data accessed approximately once per month

Answer

Coldline storage, for data accessed approximately once per quarter

Question 10

A company's cloud cost has grown significantly. A FinOps analysis reveals the largest waste category is idle Cloud SQL instances — 12 database instances that were provisioned for projects that have since ended, but were never deleted. What process failure most directly caused this waste?

Accepted Answer

The absence of a resource decommissioning process: when projects end, there is no formal step to identify and delete associated cloud resources, allowing idle infrastructure to persist and accrue costs indefinitely. Option B is correct because the root cause is the lack of a formal resource decommissioning process. When projects end, there is no automated or manual step to identify and delete associated Cloud SQL instances, so idle databases continue to incur costs. In Google Cloud, Cloud SQL instances do not auto-delete; they persist until explicitly removed, making a decommissioning workflow essential to prevent waste.

Answer

The company should have used a cheaper database service instead of Cloud SQL

Answer

Cloud SQL pricing is too high compared to on-premises databases, making any unused capacity expensive

Answer

The database administrators forgot to enable automatic deletion for idle Cloud SQL instances

Question 11

Match each Google Cloud data service to its primary function.

Question 12

Match each Google Cloud storage class to its use case.

Question 13

Match each Google Cloud networking concept to its description.

Question 14

Match each Google Cloud pricing concept to its definition.

Question 15

Match each Google Cloud AI/ML term to its definition.