Cloud Digital Leader Practice Test 15 — 15 Questions

Question 1

Which Google Cloud service provides threat intelligence and incident response capabilities, including access to Mandiant expertise?

Accepted Answer

Mandiant. Mandiant is Google Cloud's threat intelligence and incident response service. Security Command Center provides vulnerability scanning but not Mandiant expertise. Chronicle is a SIEM. Cloud IDS is network intrusion detection.

Answer

Security Command Center

Answer

Chronicle

Answer

Cloud IDS

Question 2

A company runs a web application on Compute Engine. They want to reduce costs by committing to a 1-year contract for their VM usage. Which pricing model should they use?

Accepted Answer

Committed use discounts. Committed use discounts offer significant discounts in exchange for a 1-year or 3-year commitment to specific resource usage. Sustained use discounts apply automatically based on monthly usage. Preemptible VMs are for short-lived, fault-tolerant workloads. Pay-as-you-go is standard on-demand pricing.

Answer

Preemptible VMs

Answer

Sustained use discounts

Answer

Pay-as-you-go

Question 3

A company uses Cloud Storage to store sensitive data. They want to enforce that all objects uploaded are encrypted with a customer-managed key that they can rotate and control. What should they configure?

Accepted Answer

Set default encryption on the bucket to use a CMEK key from Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow customers to manage their own keys using Cloud KMS.

Answer

Use customer-supplied encryption keys (CSEK) for each upload.

Answer

Use Cloud HSM to generate a key and import it to Cloud KMS.

Answer

Enable default encryption with a Google-managed key.

Question 4

A developer tries to create a new Compute Engine instance in the us-central1 region but receives an error 'Quota 'CPUS' exceeded. Limit: 24.0'. What should the developer do to resolve this?

Accepted Answer

Request a quota increase for CPUs in us-central1. The error indicates a resource quota (CPU limit) has been reached. The correct action is to request a quota increase in the Cloud Console for the specific region and resource type (CPUs).

Answer

Wait for the quota to reset automatically

Answer

Use a different machine family with lower CPU count

Answer

Delete unused instances in other regions

Question 5

A company wants to reserve Compute Engine instances for a 3-year term to get the maximum discount. They expect consistent usage and want the discount to apply automatically to any instance matching the configuration. Which purchasing option should they choose?

Accepted Answer

Committed use discounts with a 3-year term. Committed use discounts (CUDs) offer significant discounts in exchange for a commitment to use a minimum level of resources for 1 or 3 years. They apply automatically to eligible instances in the specified region and machine series.

Answer

Sustained use discounts

Answer

Preemptible VM instances

Answer

Reserved instances (like AWS)

Question 6

A startup wants to launch a new application quickly and only pay for the compute resources they use, avoiding upfront hardware purchases. Which cloud benefit best supports this goal?

Accepted Answer

Cost optimisation (pay-as-you-go). Pay-as-you-go pricing allows customers to pay only for what they use, avoiding large capital expenditures (CAPEX) on hardware. Agility is about speed, scalability is about handling load, and global reach is about geographic coverage.

Answer

Scalability

Answer

Agility

Answer

Global reach

Question 7

A company wants to migrate its on-premises MySQL database to Google Cloud with minimal changes to the application. Which managed database service should they use?

Accepted Answer

Cloud SQL for MySQL. Cloud SQL provides managed MySQL, PostgreSQL, and SQL Server databases. It is compatible with existing MySQL applications. Cloud Spanner is globally distributed but not drop-in MySQL. Firestore and Bigtable are NoSQL.

Answer

Cloud Spanner

Answer

Cloud Bigtable

Answer

Firestore

Question 8

A developer wants a fully managed environment to deploy containerized applications without managing the underlying infrastructure. They need auto-scaling, load balancing, and a serverless experience. Which Google Cloud service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed, serverless container platform that auto-scales, handles load balancing, and charges only for resources used. It abstracts all infrastructure management.

Answer

Google Kubernetes Engine

Answer

Compute Engine

Answer

App Engine Standard

Question 9

A company wants to protect its web application from common web exploits like SQL injection and cross-site scripting. They also need to block traffic from known malicious IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities to protect against web exploits and DDoS, and can block traffic based on IP reputation.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Cloud IDS

Question 10

An organization wants to ensure that all projects in their GCP organization have consistent IAM policies. They also need to restrict the use of external IP addresses on Compute Engine instances for security. Which TWO tools should they use? (Choose TWO.)

Accepted Answer

Use an organization policy constraint 'compute.vmExternalIpAccess' at the organization level. Organization policies can enforce restrictions like disabling external IP addresses across the entire organization. IAM policies at the organization level can set baseline access controls inherited by all projects.

Answer

Apply a deny IAM policy to each project individually

Answer

Set a quota for external IP addresses per project

Answer

Use network tags to block external IPs

Question 11

A company wants to set up cost controls and analysis. They need to receive notifications when spending exceeds certain thresholds, and also be able to run custom queries on billing data. Which TWO actions should they take? (Choose 2)

Accepted Answer

Create a budget and set alert thresholds. To receive notifications at thresholds, they need to create a budget and set alerts. To run custom queries, they should enable billing export to BigQuery.

Answer

Set up a Pub/Sub topic for billing alerts

Answer

Activate the Cost Management dashboard

Answer

Enable billing export to Cloud Storage

Question 12

A company wants to detect and prioritize vulnerabilities in their Compute Engine VMs and GKE clusters. They also need a centralized view of security findings across their organization. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the central vulnerability and threat detection service for GCP. It finds misconfigurations, vulnerabilities, and threats across services like Compute Engine and GKE, and provides a dashboard for prioritization. Chronicle is a SIEM for log analysis, not vulnerability scanning. Cloud IDS is for network intrusion detection. Web Risk API is for checking URLs against threat lists.

Answer

Cloud IDS

Answer

Web Risk API

Answer

Chronicle

Question 13

A company wants to reduce its carbon footprint by running workloads on Google Cloud. Which Google Cloud commitment directly supports this goal?

Accepted Answer

Google Cloud's 100% renewable energy match for operations. Google Cloud matches 100% of its global electricity consumption with renewable energy and aims to run on carbon-free energy 24/7 by 2030.

Answer

Choosing a region with lower CO2 equivalent per kWh

Answer

Using preemptible VMs

Answer

Using committed use discounts

Question 14

A company needs to enforce that no project in the organization can create resources outside of the us-central1 region. They also need to allow the Finance team to manage billing for all projects. Which TWO steps should they take?

Accepted Answer

Apply the `gcp.resourceLocations` organization policy constraint at the organization node. Organization policies can be applied at the organization level to restrict locations. Billing account access is controlled by IAM roles on the billing account, granting the Finance team the Billing Account Administrator role.

Answer

Create a separate billing account for each project

Answer

Use IAM deny policies at the organization node to block resource creation outside us-central1

Answer

Create a folder and apply an organization policy constraint to restrict locations at the folder level

Question 15

Which characteristic of cloud computing allows a user to provision virtual machines without needing to interact with Google Cloud support or create a ticket?

Accepted Answer

On-demand self-service. On-demand self-service means users can provision resources automatically without human interaction. The other options are also NIST characteristics but do not specifically address provisioning without manual intervention.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling