Cloud Digital Leader Practice Test 14 — 15 Questions

Question 1

A company's monolithic application is difficult to update because any change requires testing and redeploying the entire application, causing multi-hour downtime during updates. The team is considering a microservices architecture. What is the primary benefit of microservices in this context?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Each service can be updated and deployed independently, enabling teams to release changes faster with lower risk and without full-application downtime.. Microservices architecture decomposes a monolithic application into small, independently deployable services. Each service can be updated, scaled, and deployed without affecting other services. This eliminates the 'entire-application-redeploy' problem — updating the payment service doesn't require redeploying the catalog or user management services. Cloud platforms support microservices with containers (GKE), serverless functions (Cloud Run), and managed messaging (Pub/Sub) for service communication.

Answer

Microservices always cost less than monolithic applications to run.

Answer

Microservices eliminate the need for testing because each service is small enough to be bug-free.

Answer

Microservices allow applications to run on any hardware without modification.

Question 2

A company is migrating to Google Cloud and wants to reduce operational overhead for managing their infrastructure. Which Google Cloud service allows them to define infrastructure as code and automate provisioning?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager is the correct answer because it is a Google Cloud service that allows you to define your infrastructure as code using declarative templates (in YAML, Python, or Jinja2). It automates the provisioning and management of Google Cloud resources, reducing manual operational overhead by enabling repeatable, version-controlled deployments.

Answer

Google Cloud SDK

Answer

Cloud Console

Answer

Cloud Shell

Question 3

A company's cloud costs have increased by 40% over the past quarter. The operations team wants to identify and address the root causes. Which cost optimization strategies should they investigate first?

Accepted Answer

Identify idle and underutilized resources (oversized VMs, unused disks, unattached IPs), apply lifecycle policies to storage, and commit to CUDs for stable workloads.. The first step in cloud cost optimization is to identify and eliminate waste from idle or oversized resources, which is the most common source of cost inefficiency. Applying lifecycle policies to storage and committing to Committed Use Discounts (CUDs) for stable workloads are proven strategies to reduce costs without compromising performance. This approach aligns with Google Cloud's recommended FinOps practices, focusing on immediate, high-impact savings before considering architectural changes.

Answer

Immediately upgrade all infrastructure to the latest generation hardware for better efficiency.

Answer

Migrate all workloads to Spot VMs immediately to reduce costs by 90%.

Answer

Switch cloud providers to whoever has the lowest advertised list price.

Question 4

Which TWO of the following are key benefits of cloud technology that are transforming business operations?

Accepted Answer

Elasticity to automatically scale resources up and down. Cloud elasticity allows resources to automatically scale up or down based on demand, eliminating over-provisioning and underutilization. This dynamic adjustment is a key transformation driver, enabling businesses to handle variable workloads efficiently without manual intervention.

Answer

Physical security of data centers

Answer

Data locality to keep data within national borders

Answer

Ability to purchase reserved instances for predictable workloads

Question 5

A financial services firm is migrating a legacy application to Google Cloud. The application requires static IP addresses that must not change during migration. The network team wants to minimize downtime. Which migration strategy should they use?

Accepted Answer

Set up a Cloud VPN tunnel and migrate using the same IP addresses. A Cloud VPN tunnel can extend the on-premises network into Google Cloud, allowing the legacy application to retain its existing static IP addresses during migration. By establishing a VPN tunnel, traffic can be routed seamlessly between environments, minimizing downtime as the application is migrated without requiring IP address changes.

Answer

Use a global load balancer and update DNS

Answer

Lift and shift the application to Compute Engine with new IP addresses

Answer

Use Cloud Interconnect to extend the on-premises network

Question 6

A company wants to monitor the health and performance of their applications running on Google Cloud. Which two Google Cloud services should they use together for comprehensive observability?

Accepted Answer

Cloud Monitoring. Cloud Monitoring and Cloud Logging together form the core of Google Cloud's observability stack. Cloud Monitoring collects metrics, uptime checks, and alerting policies, while Cloud Logging ingests, stores, and analyzes log data. Combined, they provide the metrics, logs, and alerting needed to comprehensively monitor application health and performance.

Answer

Cloud Profiler

Answer

Cloud Debugger

Answer

Cloud Trace

Question 7

A company migrates its on-premises database to Cloud SQL. The security team is concerned about who is responsible for patching the underlying operating system and database engine. Under the shared responsibility model, which of the following is true?

Accepted Answer

Google Cloud is responsible for patching the operating system and database engine.. Under the Google Cloud shared responsibility model, Google Cloud manages the underlying infrastructure, including patching the operating system and database engine for managed services like Cloud SQL. This is because Cloud SQL is a fully managed service where Google Cloud handles OS and database engine updates, ensuring security and compliance without customer intervention. The customer remains responsible for data, access management, and application-level configurations.

Answer

The customer must patch the operating system of the Cloud SQL instances.

Answer

The customer is responsible for physical security of the data centers.

Answer

The customer is responsible for applying database engine patches.

Question 8

A developer needs to run a small piece of Python code that processes a message from Pub/Sub and stores the result in Firestore. The code runs infrequently (a few hundred times per day) and takes less than a second to execute. Which compute service is most cost-effective and simple to manage?

Accepted Answer

Cloud Functions. Cloud Functions is serverless and event-driven, ideal for infrequent short-lived tasks triggered by Pub/Sub. It scales to zero and charges only per invocation. App Engine and Cloud Run require a container or runtime, and Compute Engine requires a running VM.

Answer

Cloud Run

Answer

Compute Engine with preemptible VM

Answer

App Engine Standard Environment

Question 9

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Answer

Firestore

Answer

Cloud Spanner

Answer

BigQuery

Question 10

A company has a batch processing job that reads data from Cloud Storage, transforms it, and writes to BigQuery. The job runs nightly and takes approximately 2 hours. The team wants to reduce costs by using a managed service that automatically provisions and de-provisions resources. Which service should they use?

Accepted Answer

Dataflow. Dataflow is a managed service that automatically scales resources up and down for batch and stream processing. It reads from Cloud Storage, transforms data, and writes to BigQuery. Dataproc is also managed but requires cluster configuration and is more suited for Hadoop/Spark. Cloud Composer is for workflow orchestration, not data transformation. Cloud Functions is not suitable for long-running batch jobs.

Answer

Cloud Composer

Answer

Cloud Functions

Answer

Dataproc

Question 11

A company wants to monitor its Google Cloud spending and receive alerts when costs exceed a threshold. Which two services should they use together?

Accepted Answer

Cloud Billing Budgets and Alerts. Cloud Billing Budgets and Alerts (D) allows you to define a spending threshold and receive notifications when costs approach or exceed that limit. Cloud Monitoring (E) can ingest those budget alert events and trigger additional actions, such as sending notifications via email, SMS, or Pub/Sub, or integrating with incident management tools. Together, they provide a complete cost monitoring and alerting solution.

Answer

Cloud Scheduler

Answer

Cloud Asset Inventory

Answer

Cloud Logging

Question 12

A company uses Cloud Monitoring to collect metrics from their applications running on Google Kubernetes Engine (GKE). They want to create custom dashboards and set up alerting policies. Which THREE capabilities are available in Cloud Monitoring? (Choose THREE.)

Accepted Answer

Define custom metrics via the Monitoring API. The Cloud Monitoring API allows you to define and write custom metrics, which can then be used in dashboards and alerting policies. This is essential for capturing application-specific data that is not automatically collected by the default GKE integration, such as business KPIs or custom performance counters.

Answer

Query logs using Logging Query Language

Answer

Automatically remediate incidents with Cloud Functions

Question 13

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Answer

Access Transparency

Answer

Security Command Center

Answer

Cloud Armor

Question 14

An organization wants to enforce that all Compute Engine instances must have a label 'environment' set to 'production', 'staging', or 'development'. They also want to ensure that instances in the 'production' folder cannot be created with public IP addresses. Which THREE steps should they take? (Choose 3)

Accepted Answer

Use IAM conditions to deny the compute.instances.create permission without the label.. The correct steps are options A, C, and E. Option A uses IAM conditions to deny the compute.instances.create permission if the required 'environment' label is not present, directly enforcing the labeling requirement. Option C uses an organization policy constraint to prohibit external IP addresses on Compute Engine instances in the production folder, preventing public IPs. Option E uses a custom organization policy constraint to require the 'environment' label on all Compute Engine instances. Option B is incorrect because VPC Service Controls restrict data exfiltration, not the creation of instances with public IPs. Option D is incorrect because automatically applying labels via a Cloud Function is a remediation approach, not an enforcement mechanism; the policy constraints and IAM conditions are the appropriate enforcement tools.

Answer

Set up VPC Service Controls to restrict access to the production VPC.

Answer

Create a folder for each environment and apply the label automatically using a Cloud Function triggered by Resource Manager events.

Question 15

Which THREE practices are recommended for securing a Kubernetes cluster in Google Kubernetes Engine (GKE)?

Accepted Answer

Use Binary Authorization to ensure only trusted container images are deployed. Binary Authorization is correct because it enforces deployment-time policy validation, ensuring that only container images signed by trusted authorities (e.g., via KMS) are allowed to run in GKE. This prevents the deployment of untrusted or tampered images, directly addressing supply chain security.

Answer

Enable node auto-repair to automatically fix security vulnerabilities in nodes

Answer

Expose the cluster control plane via a public endpoint to allow monitoring