Cloud Digital Leader Practice Test 14 — 15 Questions

Question 1

A company uses Cloud Monitoring to collect metrics from their applications running on Google Kubernetes Engine (GKE). They want to create custom dashboards and set up alerting policies. Which THREE capabilities are available in Cloud Monitoring? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define custom metrics via the Monitoring API. The Cloud Monitoring API allows you to define and write custom metrics, which can then be used in dashboards and alerting policies. This is essential for capturing application-specific data that is not automatically collected by the default GKE integration, such as business KPIs or custom performance counters.

Answer

Query logs using Logging Query Language

Answer

Automatically remediate incidents with Cloud Functions

Question 2

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Answer

Access Transparency

Answer

Security Command Center

Answer

Cloud Armor

Question 3

Which THREE practices are recommended for securing a Kubernetes cluster in Google Kubernetes Engine (GKE)?

Accepted Answer

Use Binary Authorization to ensure only trusted container images are deployed. Binary Authorization is correct because it enforces deployment-time policy validation, ensuring that only container images signed by trusted authorities (e.g., via KMS) are allowed to run in GKE. This prevents the deployment of untrusted or tampered images, directly addressing supply chain security.

Answer

Enable node auto-repair to automatically fix security vulnerabilities in nodes

Answer

Expose the cluster control plane via a public endpoint to allow monitoring

Question 4

Which Google Cloud service provides a fully managed, scalable NoSQL document database suitable for mobile and web applications with real-time data synchronization?

Accepted Answer

Firestore. Firestore is Google Cloud's fully managed, scalable NoSQL document database designed for mobile and web applications, with built-in real-time synchronization across clients. It supports offline persistence and live updates, making it ideal for apps that need real-time data sync. Firestore is the direct successor to the original Cloud Datastore and is optimized for these use cases.

Answer

Cloud Bigtable

Answer

Cloud SQL

Answer

Memorystore

Question 5

A healthcare startup is building a HIPAA-compliant application on Google Cloud. They need to encrypt data at rest and manage their own encryption keys. Which service should they use for key management?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct service because it is Google Cloud's dedicated key management service that allows customers to create, manage, and use encryption keys for data at rest. It supports customer-managed encryption keys (CMEK) and integrates with many GCP services, enabling HIPAA-compliant encryption where the customer controls the keys. Cloud HSM is a hardware security module option within Cloud KMS, but the core key management service is Cloud KMS.

Answer

Cloud IAM

Answer

Cloud Data Loss Prevention (DLP)

Answer

Cloud HSM

Question 6

A company needs to reduce costs on Compute Engine instances that run batch jobs for varying durations. They can tolerate interruptions and do not require a specific uptime guarantee. Which TWO instance types or purchasing options should they consider? (Choose 2)

Accepted Answer

Spot VMs. Preemptible VMs can be terminated at any time but are significantly cheaper, suitable for fault-tolerant batch jobs. Spot VMs are similar to preemptible but with no maximum runtime and often lower price. Both are ideal for batch workloads that can handle interruptions.

Answer

Sole-tenant nodes

Answer

Committed use discounts

Answer

Sustained use discounts

Question 7

A startup wants to secure access to its internal web applications without using a VPN. They need to enforce access based on user identity and device security posture. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise is Google's zero-trust solution that replaces VPNs by using identity and context (device, location) to grant access. Identity-Aware Proxy (IAP) is a component of BeyondCorp that enforces access at the application layer.

Answer

Cloud VPN

Answer

VPC Service Controls

Answer

Cloud Armor

Question 8

An organization wants to tag resources with environment (dev/staging/prod) and cost center (e.g., 'marketing', 'engineering') for cost allocation and filtering in billing reports. Which feature should they use?

Accepted Answer

Labels. Labels are key-value pairs that can be attached to resources and are used for billing cost allocation, filtering in cost reports, and resource grouping. Tags are for organization policy enforcement and network firewall rules.

Answer

Organization policy tags

Answer

Folders

Answer

Network tags

Question 9

A company's cloud operations team is implementing a tagging strategy for cost allocation. They want to ensure that the 'cost-center' label is present on every Compute Engine VM and Cloud Storage bucket created in their Google Cloud organization. Currently, some resources are created without this label. Which combination of controls best enforces and remediates this requirement?

Accepted Answer

Organization Policy custom constraint to prevent creation of resources without the 'cost-center' label (preventive), plus Cloud Asset Inventory to identify existing unlabeled resources for remediation (detective). A preventive control (org policy custom constraint requiring the label) stops future non-compliant resources. A detective/corrective control (Cloud Asset Inventory + Cloud Functions or Security Command Center) finds and remediates existing unlabeled resources. Both are needed for comprehensive enforcement.

Answer

Only organization policy — once new resources are blocked, existing unlabeled resources don't matter

Answer

Only Cloud Asset Inventory monitoring — alerting on unlabeled resources is sufficient without preventing their creation

Answer

Grant all engineers the 'Labels Admin' role to encourage them to add labels voluntarily

Question 10

A cloud architect wants to ensure that only certain users in the finance team can access a Cloud Storage bucket containing invoices. They also want to log all access attempts. Which two services should they use?

Accepted Answer

IAM and Cloud Audit Logs. IAM (Identity and Access Management) is used to grant specific users (e.g., finance team members) granular access to the Cloud Storage bucket via roles like roles/storage.objectViewer. Cloud Audit Logs (specifically Admin Activity and Data Access audit logs) capture all access attempts, including who accessed the bucket, when, and from which IP address, meeting the logging requirement.

Answer

Cloud NAT and Cloud Audit Logs

Answer

Cloud NAT and Cloud Load Balancing

Answer

IAM and Cloud CDN

Question 11

A developer needs to deploy a containerized microservice that scales to zero when not in use and automatically scales up on incoming traffic. The microservice uses a custom container image that listens on port 8080. Which Google Cloud compute service is BEST suited for this requirement?

Accepted Answer

Cloud Run. Cloud Run is a managed compute platform that runs stateless containers, automatically scales (including to zero), and charges only for resources used during request processing. It fits the requirement perfectly. GKE requires managing a cluster and doesn't scale to zero by default; App Engine standard environment has a sandbox that may not support custom containers; Cloud Functions is limited to specific runtimes.

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) with Horizontal Pod Autoscaler

Answer

App Engine standard environment

Question 12

Which Google Cloud service provides a fully managed SIEM solution for log analysis, threat detection, and incident response?

Accepted Answer

Chronicle. Chronicle is Google's SIEM offering that ingests logs and telemetry for security analytics.

Answer

Security Command Center

Answer

Operations Suite

Answer

Cloud Logging

Question 13

A company wants to run containerized applications on Google Cloud without managing the underlying infrastructure. Which service should they use?

Accepted Answer

Cloud Run. Google Kubernetes Engine (GKE) is the managed Kubernetes service that abstracts node management, but it still requires some cluster management. Cloud Run is serverless and fully manages infrastructure, so it is the best choice for zero infrastructure management.

Answer

App Engine Flexible Environment

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Question 14

A company is migrating its on-premises workloads to Google Cloud and wants to understand the total cost of ownership (TCO) savings. Which costs are typically LOWER in the cloud compared to on-premises?

Accepted Answer

Hardware purchase and data centre costs. Cloud eliminates hardware purchase costs (CAPEX) and reduces data centre costs (power, cooling, maintenance). Compute costs may be similar or higher depending on usage, but overall TCO is often lower due to elimination of overhead. Software licensing depends on the agreement.

Answer

Compute instance costs

Answer

Software licensing fees

Answer

Network egress charges

Question 15

An engineer needs to increase the default limit of 24 CPUs per region for Compute Engine instances in their project. They have already consumed 20 CPUs and need to launch a new instance with 8 CPUs. What should they do?

Accepted Answer

Request a quota increase in the Cloud Console Quotas page.. Service quotas are per-project and per-region limits. The engineer must request a quota increase via the Quotas page in the Cloud Console before exceeding the limit.

Answer

Launch the instance anyway; Google Cloud will automatically increase the quota.

Answer

Create a new project and launch the instance there.

Answer

Use a different region with available quota.