Cloud Digital Leader Practice Test 13 — 15 Questions

Question 1

Drag and drop the steps to set up a Cloud NAT for private Compute Engine instances to access the internet in the correct order.

Accepted Answer

Create a VPC network with a subnet, then create a Cloud Router in that network, then create a Cloud NAT gateway on that router and subnet, then configure firewall rules to allow egress traffic, then verify connectivity from private instances.. The setup requires a VPC, Cloud Router, NAT gateway, appropriate firewall rules, and verification.

Answer

Create a Cloud NAT gateway first, then create a Cloud Router, then create a VPC network, then configure firewall rules, then verify connectivity.

Answer

Create firewall rules first, then create a VPC network, then create a Cloud Router, then create a Cloud NAT gateway, then verify connectivity.

Answer

Create a VPC network, then configure firewall rules, then create a Cloud NAT gateway, then create a Cloud Router, then verify connectivity.

Question 2

Drag and drop the steps to set up a Cloud Storage bucket with uniform bucket-level access into the correct order.

Accepted Answer

Access Cloud Storage, then create a bucket, then name the bucket, then select storage settings, then enable uniform bucket-level access.. The process begins with accessing Cloud Storage, then creating a bucket, naming it, selecting storage settings, and enabling uniform access control.

Answer

Access Cloud Storage, then create a bucket, then select storage settings, then name the bucket, then enable uniform bucket-level access.

Answer

Access Cloud Storage, then enable uniform bucket-level access, then create a bucket, then name the bucket, then select storage settings.

Answer

Create a bucket, then access Cloud Storage, then name the bucket, then select storage settings, then enable uniform bucket-level access.

Question 3

A company plans to run a batch processing job every night for 2 hours. They want to minimize costs while ensuring the job completes within a 4-hour window. Which pricing model should they choose?

Accepted Answer

Preemptible VM instances. Preemptible VM instances (B) are ideal for fault-tolerant, short-lived batch jobs that can handle interruptions. They offer significantly lower cost than on-demand instances, and because the job runs for only 2 hours within a 4-hour window, it can be restarted if preempted, ensuring completion at minimal expense.

Answer

On-demand pricing

Answer

Committed use discounts

Answer

Sustained use discounts

Question 4

A healthcare organization needs to store and analyze large volumes of patient diagnostic imaging data (e.g., DICOM files) in Google Cloud. The data must be stored in a cost-effective manner for long-term retention, with the ability to query metadata and run analytics using SQL-like queries. Which combination of Google Cloud services best meets these requirements?

Accepted Answer

Cloud Storage (Nearline) for images, BigQuery for metadata analytics. Cloud Storage Nearline provides cost-effective long-term storage for large imaging files with retrieval flexibility, while BigQuery enables SQL-based analytics on metadata extracted from DICOM headers, meeting both retention and query requirements without the cost of standard storage or the complexity of transactional databases.

Answer

Cloud Storage (Standard) for images, Datastore for metadata

Answer

Cloud Storage (Archive) for images, Cloud Spanner for metadata

Answer

Cloud Filestore for images, Cloud SQL for metadata

Question 5

A cloud architect wants to ensure that only certain users in the finance team can access a Cloud Storage bucket containing invoices. They also want to log all access attempts. Which two services should they use?

Accepted Answer

IAM and Cloud Audit Logs. IAM (Identity and Access Management) is used to grant specific users (e.g., finance team members) granular access to the Cloud Storage bucket via roles like roles/storage.objectViewer. Cloud Audit Logs (specifically Admin Activity and Data Access audit logs) capture all access attempts, including who accessed the bucket, when, and from which IP address, meeting the logging requirement.

Answer

Cloud NAT and Cloud Audit Logs

Answer

Cloud NAT and Cloud Load Balancing

Answer

IAM and Cloud CDN

Question 6

A company is planning a cloud architecture and needs to decide between a monolithic application design and a microservices architecture. What is the most significant operational trade-off between these two approaches in a cloud environment?

Accepted Answer

Microservices enable independent deployment and scaling per component but introduce distributed systems complexity (network overhead, distributed tracing, service discovery, consistency challenges); monoliths are simpler to operate but scale and deploy as a unit. Monoliths are simpler to develop, test, and deploy initially but scale as a unit and create tight coupling — a change to one part requires deploying the whole application. Microservices enable independent deployment and scaling of components but introduce distributed systems complexity (network calls, service discovery, distributed tracing, eventual consistency). Neither is universally better — the trade-off depends on team size, domain complexity, and operational maturity.

Answer

Monoliths can only run on-premises, while microservices were designed specifically for cloud environments

Answer

Microservices are always cheaper to operate in the cloud because each service uses fewer resources than a monolith

Answer

Monolithic applications cannot be scaled horizontally in cloud environments

Question 7

Drag and drop the steps to configure a load balancer for an HTTP application on Compute Engine into the correct order.

Accepted Answer

Create an instance group, then a health check, then a backend service, then a URL map, then a target proxy, then a forwarding rule. The correct order is: instance group, health check, backend service, URL map, then target proxy and forwarding rule.

Answer

Create a health check, then an instance group, then a backend service, then a URL map, then a target proxy, then a forwarding rule

Answer

Create an instance group, then a backend service, then a health check, then a URL map, then a target proxy, then a forwarding rule

Answer

Create an instance group, then a health check, then a URL map, then a backend service, then a target proxy, then a forwarding rule

Question 8

A telecommunications company has completed a cloud migration but finds that its business agility — the speed at which it can launch new products — has not improved. An analysis reveals that while the infrastructure is now cloud-based, the software development and release processes remain unchanged: quarterly release cycles, lengthy change approval boards, and manual testing. What does this situation illustrate?

Accepted Answer

Cloud infrastructure adoption without modernizing software delivery practices (CI/CD, automated testing, continuous deployment) does not unlock agility; the delivery process is the bottleneck. This illustrates that cloud infrastructure adoption without changing software delivery practices provides limited agility benefits. Cloud's agility potential is unlocked by complementary practices: CI/CD pipelines, automated testing, trunk-based development, and feature flags that enable continuous delivery. Quarterly release cycles with manual testing create the same bottleneck regardless of whether the infrastructure is on-premises or in the cloud.

Answer

The company chose the wrong cloud provider; a different provider's infrastructure would enable faster releases

Answer

Quarterly release cycles are appropriate for telecommunications products that require extensive regulatory testing, and the lack of agility is not a problem

Answer

The company must rebuild all applications as microservices before cloud can provide agility benefits

Question 9

A developer needs to debug a production issue by analyzing logs from multiple microservices. Which Google Cloud service should they use to filter and search logs in real time?

Accepted Answer

Cloud Logging. Cloud Logging (formerly Stackdriver Logging) is the correct service because it provides a centralized log management system that can ingest logs from multiple microservices, filter them using advanced queries, and search them in real time. Its Logs Explorer interface supports custom filters, labels, and timestamps, enabling developers to pinpoint production issues across distributed services without delay.

Answer

Cloud Monitoring

Answer

Error Reporting

Answer

Cloud Debugger

Question 10

A company wants to implement SLOs for their API service. They need to measure the proportion of successful requests over a 30-day window. Which metric should they use?

Accepted Answer

SLI = good events / total events. An SLI (Service Level Indicator) is defined as the ratio of good events to total events, which directly measures the proportion of successful requests over a 30-day window. This aligns with the requirement to track request success rate, not just system uptime. In Google Cloud operations, SLOs are built on SLIs that count discrete events like HTTP 200 responses versus all requests.

Answer

availability (uptime)

Answer

latency at 99th percentile

Answer

requests/success

Question 11

A retail company experiences sudden traffic spikes during flash sales. Their on-premises infrastructure often runs out of capacity, causing downtime. They are migrating to Google Cloud and need to automatically handle traffic spikes without manual intervention. Which approach should they take?

Accepted Answer

Create a managed instance group with autoscaling. Managed instance groups with autoscaling automatically add and remove VM instances based on load, handling spikes without manual intervention. GPUs are not needed; manual scaling is wasteful; Cloud Load Balancing alone does not auto-scale compute.

Answer

Manually add VMs when traffic increases

Answer

Use a GPU-accelerated VM for compute

Answer

Use a single large VM and rely on Cloud Load Balancing

Question 12

An engineer needs to deploy a containerized application on Google Kubernetes Engine (GKE) and ensure that each pod gets a static IP address that persists across rescheduling. Which networking approach should they use?

Accepted Answer

Use a VPC-native cluster and assign a static internal IP using the `networking.gke.io/static-ip` annotation.. GKE supports static IP addresses for pods using VPC-native clusters and alias IP ranges. By reserving a static internal IP address and assigning it to the pod via a Kubernetes annotation, the IP persists even if the pod is rescheduled.

Answer

Use a load balancer service of type LoadBalancer.

Answer

Use a DaemonSet to ensure one pod per node.

Answer

Use a StatefulSet with a headless service.

Question 13

A company wants to innovate quickly by leveraging machine learning without building models from scratch. Which Google Cloud service allows them to use pre-trained models via APIs?

Accepted Answer

Cloud Vision API. Cloud Vision API is correct because it provides pre-trained machine learning models via REST APIs, allowing the company to integrate image recognition capabilities (e.g., label detection, OCR, face detection) without building or training any models. This directly meets the requirement of leveraging ML without building from scratch, as the API abstracts all model training and deployment.

Answer

BigQuery ML

Answer

AI Platform

Answer

AutoML

Question 14

A security team needs to detect and alert on suspicious outbound network traffic from their GCP environment, such as data exfiltration attempts. They require a managed service that analyzes traffic for threats. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) monitors network traffic for threats like malware and data exfiltration. It integrates with VPC flow logs and provides threat detection. Cloud Armor is for inbound DDoS/WAF. Security Command Center is a broader security management platform. Chronicle is a SIEM for log analysis, not real-time network traffic inspection.

Answer

Cloud Armor

Answer

Security Command Center

Answer

Chronicle

Question 15

A security team needs to protect a web application behind an HTTP(S) Load Balancer from SQL injection and cross-site scripting (XSS) attacks. Which Google Cloud service provides these protections?

Accepted Answer

Cloud Armor. Cloud Armor is a Web Application Firewall (WAF) that provides pre-configured rules for OWASP Top 10 threats like SQLi and XSS. Cloud CDN is for caching, Cloud DNS for domain resolution, and VPC firewall rules operate at the network layer (not application layer).

Answer

Cloud CDN

Answer

VPC firewall rules

Answer

Cloud DNS