Cloud Digital Leader Practice Test 16 — 15 Questions

Question 1

A data scientist wants to train a machine learning model using a managed service that supports custom TensorFlow code and provides GPU/TPU hardware acceleration. They prefer not to manage the underlying infrastructure. Which Google Cloud service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AI Platform Training (Vertex AI Training). AI Platform Training (now Vertex AI Training) is a managed service that allows you to run custom TensorFlow/PyTorch training jobs on pre-configured VM instances with GPUs/TPUs, without managing the cluster.

Answer

Compute Engine with pre-installed TensorFlow

Answer

Cloud Functions

Answer

Google Kubernetes Engine with GPU nodes

Question 2

A data engineering team needs to process streaming data from Cloud Pub/Sub, perform transformations, and write the results to BigQuery. The team requires exactly-once processing semantics and automatic scaling. Which service should they use?

Accepted Answer

Cloud Dataflow. Dataflow (Apache Beam) provides exactly-once processing, autoscaling, and native integration with Pub/Sub and BigQuery for streaming pipelines. Cloud Dataproc is for batch Spark/Hadoop, not streaming. Cloud Functions processes events one at a time without exactly-once guarantees across a pipeline. BigQuery itself does not transform streaming data.

Answer

Cloud Functions

Answer

Cloud Dataproc

Answer

BigQuery

Question 3

A company has a VPC with multiple subnets and wants to prevent data exfiltration by restricting access to a Cloud Storage bucket from only resources within a defined perimeter. Which Google Cloud service should they use to create an API perimeter around the bucket?

Accepted Answer

VPC Service Controls. VPC Service Controls allows you to define perimeters around Google Cloud services like Cloud Storage, preventing data exfiltration to networks outside the perimeter. VPC firewall rules control network traffic but not API access. Cloud Armor is for DDoS protection. Cloud NAT is for outbound internet access.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC firewall rules

Question 4

A company wants to analyze its Google Cloud spending trends by project, service, and labels. They need to run custom SQL queries on billing data and retain it for 2 years. Which approach should they use?

Accepted Answer

Set up billing export to BigQuery.. Billing export to BigQuery allows you to export detailed billing data into BigQuery datasets, where you can run custom SQL queries and retain data for your desired period.

Answer

Use the Google Cloud Pricing Calculator.

Answer

Enable the Cost Management dashboard.

Answer

Configure budgets and alerts.

Question 5

Which Google Cloud service provides a unified platform for building, training, and deploying machine learning models at scale?

Accepted Answer

Vertex AI. Vertex AI is the unified ML platform covering all stages of ML workflow. AutoML is a component, Dataflow is for data processing, and BigQuery ML runs ML models in SQL.

Answer

BigQuery ML

Answer

AutoML

Answer

Cloud Dataflow

Question 6

A company has a folder for each department. The Finance team needs to prevent all projects under its folder from creating external IP addresses. What is the most efficient way to enforce this restriction?

Accepted Answer

Apply an organization policy constraint at the folder level. Organization policies can be defined at any level of the resource hierarchy and are inherited by child resources. Setting a constraint at the folder level applies to all projects under that folder.

Answer

Configure a service perimeter in VPC Service Controls

Answer

Use a deny IAM policy at the folder level

Answer

Set a VPC firewall rule in each project

Question 7

An organization needs to apply security policies to protect their web application from DDoS attacks and SQL injection. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is a web application firewall (WAF) that provides DDoS protection and security rules to block threats like SQL injection. Cloud CDN is for content caching. Load Balancing distributes traffic. Cloud NAT is for outbound connectivity.

Answer

Cloud NAT

Answer

Cloud Load Balancing

Answer

Cloud CDN

Question 8

A company wants to run a batch job that processes data every night. They need to provision a VM for this task but want to minimize costs. The job can tolerate interruptions and can be resumed. Which Compute Engine VM option should they use?

Accepted Answer

Preemptible VM. Preemptible VMs are short-lived, cost-effective instances that can be terminated at any time but are ideal for batch jobs that can handle interruptions.

Answer

VM with committed use discount

Answer

Sole-tenant node

Answer

Standard VM

Question 9

A company's cloud spending suddenly spikes by 300% for one week before returning to normal. The cloud team investigates and finds a developer accidentally left a large cluster of VMs running over the weekend. Which cloud financial management practice most effectively prevents this type of unexpected cost spike?

Accepted Answer

Setting Cloud Billing budget alerts that notify stakeholders when spending approaches defined thresholds, enabling early detection and response to abnormal spending patterns. Cloud Billing budget alerts provide real-time notifications when spending exceeds defined thresholds, enabling the cloud team to detect and respond to the 300% spike immediately rather than after the fact. This proactive monitoring directly addresses the root cause—unexpected resource usage—by alerting stakeholders while the VMs are still running, allowing them to shut down the cluster and prevent further cost accumulation.

Answer

Requiring all cloud resource creation to go through a central IT approval process to prevent accidental VM creation

Answer

Reviewing cloud bills at the end of each month to identify cost anomalies and address them retroactively

Answer

Using Reserved Instances for all VM workloads to reduce per-hour costs, making accidental long-running VMs less expensive

Question 10

Which principle states that a user should be granted only the permissions necessary to perform their job functions?

Accepted Answer

Principle of least privilege. The principle of least privilege is the security concept of granting minimal required permissions. Separation of duties divides tasks among multiple people. Zero trust is a broader security model. Defence in depth is layered security.

Answer

Defence in depth

Answer

Separation of duties

Answer

Zero trust

Question 11

A startup wants to deploy a containerized web application without managing servers or clusters. They need automatic scaling, a managed runtime, and pay only for resources used. Which Google Cloud service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform for containers that automatically scales and charges only for resources used. It fits the requirements perfectly.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine

Question 12

A company wants to encrypt sensitive data stored in Cloud Storage with a key that is generated and stored on-premises using a hardware security module (HSM). They do not want Google to have access to the key. Which encryption option should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own keys; Google does not store the key and has no access to it.

Answer

Google-managed encryption keys

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud HSM

Question 13

An organization uses labels to track cost by environment (dev, test, prod). However, the Finance team notices that some resources are missing the 'env' label. Which service can automatically suggest labeling resources that are missing required labels?

Accepted Answer

Active Assist Recommendations. Active Assist provides recommendations for various optimizations, including labeling. The Recommender can suggest labels for resources that are missing them, based on usage patterns.

Answer

Cost Management dashboard

Answer

Cloud Asset Inventory

Answer

Organization Policy Service

Question 14

A startup uses Google Workspace for email and collaboration. They want to add a custom domain to their Gmail accounts. Which service model does Google Workspace represent?

Accepted Answer

SaaS. Google Workspace is a SaaS offering where Google manages all infrastructure, including the application, runtime, OS, and hardware.

Answer

PaaS

Answer

FaaS

Answer

IaaS

Question 15

An organization wants to protect its web application from DDoS attacks and SQL injection. Which Google Cloud service should they deploy?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and Web Application Firewall (WAF) capabilities to block attacks like SQL injection. Cloud IDS is for intrusion detection. Security Command Center is for vulnerability management. Cloud DNS is for DNS resolution.

Answer

Cloud DNS

Answer

Security Command Center

Answer

Cloud IDS