Cloud Digital Leader Practice Test 17 — 15 Questions

Question 1

A company's cloud operations team is implementing a tagging strategy for cost allocation. They want to ensure that the 'cost-center' label is present on every Compute Engine VM and Cloud Storage bucket created in their Google Cloud organization. Currently, some resources are created without this label. Which combination of controls best enforces and remediates this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Organization Policy custom constraint to prevent creation of resources without the 'cost-center' label (preventive), plus Cloud Asset Inventory to identify existing unlabeled resources for remediation (detective). A preventive control (org policy custom constraint requiring the label) stops future non-compliant resources. A detective/corrective control (Cloud Asset Inventory + Cloud Functions or Security Command Center) finds and remediates existing unlabeled resources. Both are needed for comprehensive enforcement.

Answer

Only organization policy — once new resources are blocked, existing unlabeled resources don't matter

Answer

Only Cloud Asset Inventory monitoring — alerting on unlabeled resources is sufficient without preventing their creation

Answer

Grant all engineers the 'Labels Admin' role to encourage them to add labels voluntarily

Question 2

A developer needs to deploy a containerized microservice that scales to zero when not in use and automatically scales up on incoming traffic. The microservice uses a custom container image that listens on port 8080. Which Google Cloud compute service is BEST suited for this requirement?

Accepted Answer

Cloud Run. Cloud Run is a managed compute platform that runs stateless containers, automatically scales (including to zero), and charges only for resources used during request processing. It fits the requirement perfectly. GKE requires managing a cluster and doesn't scale to zero by default; App Engine standard environment has a sandbox that may not support custom containers; Cloud Functions is limited to specific runtimes.

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) with Horizontal Pod Autoscaler

Answer

App Engine standard environment

Question 3

Which Google Cloud service provides a fully managed SIEM solution for log analysis, threat detection, and incident response?

Accepted Answer

Chronicle. Chronicle is Google's SIEM offering that ingests logs and telemetry for security analytics.

Answer

Security Command Center

Answer

Operations Suite

Answer

Cloud Logging

Question 4

A company wants to run containerized applications on Google Cloud without managing the underlying infrastructure. Which service should they use?

Accepted Answer

Cloud Run. Google Kubernetes Engine (GKE) is the managed Kubernetes service that abstracts node management, but it still requires some cluster management. Cloud Run is serverless and fully manages infrastructure, so it is the best choice for zero infrastructure management.

Answer

App Engine Flexible Environment

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Question 5

A company is migrating its on-premises workloads to Google Cloud and wants to understand the total cost of ownership (TCO) savings. Which costs are typically LOWER in the cloud compared to on-premises?

Accepted Answer

Hardware purchase and data centre costs. Cloud eliminates hardware purchase costs (CAPEX) and reduces data centre costs (power, cooling, maintenance). Compute costs may be similar or higher depending on usage, but overall TCO is often lower due to elimination of overhead. Software licensing depends on the agreement.

Answer

Compute instance costs

Answer

Software licensing fees

Answer

Network egress charges

Question 6

An engineer needs to increase the default limit of 24 CPUs per region for Compute Engine instances in their project. They have already consumed 20 CPUs and need to launch a new instance with 8 CPUs. What should they do?

Accepted Answer

Request a quota increase in the Cloud Console Quotas page.. Service quotas are per-project and per-region limits. The engineer must request a quota increase via the Quotas page in the Cloud Console before exceeding the limit.

Answer

Launch the instance anyway; Google Cloud will automatically increase the quota.

Answer

Create a new project and launch the instance there.

Answer

Use a different region with available quota.

Question 7

Which Google Cloud service provides threat intelligence and incident response capabilities, including access to Mandiant expertise?

Accepted Answer

Mandiant. Mandiant is Google Cloud's threat intelligence and incident response service. Security Command Center provides vulnerability scanning but not Mandiant expertise. Chronicle is a SIEM. Cloud IDS is network intrusion detection.

Answer

Security Command Center

Answer

Chronicle

Answer

Cloud IDS

Question 8

A company runs a web application on Compute Engine. They want to reduce costs by committing to a 1-year contract for their VM usage. Which pricing model should they use?

Accepted Answer

Committed use discounts. Committed use discounts offer significant discounts in exchange for a 1-year or 3-year commitment to specific resource usage. Sustained use discounts apply automatically based on monthly usage. Preemptible VMs are for short-lived, fault-tolerant workloads. Pay-as-you-go is standard on-demand pricing.

Answer

Preemptible VMs

Answer

Sustained use discounts

Answer

Pay-as-you-go

Question 9

A company uses Cloud Storage to store sensitive data. They want to enforce that all objects uploaded are encrypted with a customer-managed key that they can rotate and control. What should they configure?

Accepted Answer

Set default encryption on the bucket to use a CMEK key from Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow customers to manage their own keys using Cloud KMS.

Answer

Use customer-supplied encryption keys (CSEK) for each upload.

Answer

Use Cloud HSM to generate a key and import it to Cloud KMS.

Answer

Enable default encryption with a Google-managed key.

Question 10

A developer tries to create a new Compute Engine instance in the us-central1 region but receives an error 'Quota 'CPUS' exceeded. Limit: 24.0'. What should the developer do to resolve this?

Accepted Answer

Request a quota increase for CPUs in us-central1. The error indicates a resource quota (CPU limit) has been reached. The correct action is to request a quota increase in the Cloud Console for the specific region and resource type (CPUs).

Answer

Wait for the quota to reset automatically

Answer

Use a different machine family with lower CPU count

Answer

Delete unused instances in other regions

Question 11

A company wants to reserve Compute Engine instances for a 3-year term to get the maximum discount. They expect consistent usage and want the discount to apply automatically to any instance matching the configuration. Which purchasing option should they choose?

Accepted Answer

Committed use discounts with a 3-year term. Committed use discounts (CUDs) offer significant discounts in exchange for a commitment to use a minimum level of resources for 1 or 3 years. They apply automatically to eligible instances in the specified region and machine series.

Answer

Sustained use discounts

Answer

Preemptible VM instances

Answer

Reserved instances (like AWS)

Question 12

A startup wants to launch a new application quickly and only pay for the compute resources they use, avoiding upfront hardware purchases. Which cloud benefit best supports this goal?

Accepted Answer

Cost optimisation (pay-as-you-go). Pay-as-you-go pricing allows customers to pay only for what they use, avoiding large capital expenditures (CAPEX) on hardware. Agility is about speed, scalability is about handling load, and global reach is about geographic coverage.

Answer

Scalability

Answer

Agility

Answer

Global reach

Question 13

A company wants to migrate its on-premises MySQL database to Google Cloud with minimal changes to the application. Which managed database service should they use?

Accepted Answer

Cloud SQL for MySQL. Cloud SQL provides managed MySQL, PostgreSQL, and SQL Server databases. It is compatible with existing MySQL applications. Cloud Spanner is globally distributed but not drop-in MySQL. Firestore and Bigtable are NoSQL.

Answer

Cloud Spanner

Answer

Cloud Bigtable

Answer

Firestore

Question 14

A developer wants a fully managed environment to deploy containerized applications without managing the underlying infrastructure. They need auto-scaling, load balancing, and a serverless experience. Which Google Cloud service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed, serverless container platform that auto-scales, handles load balancing, and charges only for resources used. It abstracts all infrastructure management.

Answer

Google Kubernetes Engine

Answer

Compute Engine

Answer

App Engine Standard

Question 15

A company wants to protect its web application from common web exploits like SQL injection and cross-site scripting. They also need to block traffic from known malicious IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities to protect against web exploits and DDoS, and can block traffic based on IP reputation.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Cloud IDS