Cloud Digital Leader Practice Test 17 — 15 Questions

Question 1

A security administrator needs to ensure that Google personnel do not access customer data without explicit authorization. Which service should they use to get logs of Google employee access?

Accepted Answer

Access Transparency. Access Transparency provides logs of Google personnel actions on customer data. Cloud Audit Logs track user activities within the customer's project. Assured Workloads is for regulatory compliance. Security Command Center is for threat detection.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Assured Workloads

Question 2

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single physical server with a custom Linux distribution. The team wants to minimize changes to the application while gaining the benefits of cloud infrastructure. Which migration strategy should they use?

Accepted Answer

Rehost the application on Compute Engine using a custom image of the current OS. Lift and shift (rehosting) moves the application as-is to the cloud, often by creating a custom image to run on Compute Engine. This minimizes changes. Refactoring (rearchitecting) involves code changes; re-platforming modifies the OS/platform; rebuilding is a full rewrite.

Answer

Rebuild the application from scratch on Cloud Run

Answer

Re-platform the application to a supported OS version

Answer

Refactor the application into microservices and deploy on GKE

Question 3

A company has a production project that requires a compute quota of 500 vCPUs, but the default limit is 200. What is the correct process to request a quota increase?

Accepted Answer

Navigate to IAM & Admin > Quotas in Cloud Console, select the metric, and request an increase. Quota increases can be requested through the Cloud Console under IAM & Admin > Quotas, where the engineer can select the metric (e.g., CPUs) and request a higher limit.

Answer

Shut down idle VMs to free up quota

Answer

Create a new support ticket with the Billing team

Answer

Use the gcloud compute quotas update command

Question 4

A team wants to use a managed MySQL database that offers automatic failover, backups, and read replicas. They also need to connect from Compute Engine instances in the same region. Which service should they use?

Accepted Answer

Cloud SQL for MySQL. Cloud SQL for MySQL is a fully managed relational database service that supports MySQL, automatic failover, backups, and read replicas. It integrates natively with Compute Engine instances in the same region via private IP or Cloud SQL Auth Proxy. This matches all stated requirements.

Answer

Bigtable

Answer

Cloud Spanner

Answer

Firestore

Question 5

A developer wants to estimate the monthly cost of running a Kubernetes cluster with 3 nodes of n1-standard-4 in the us-central1 region before provisioning. Which tool should the developer use?

Accepted Answer

Google Cloud Pricing Calculator. The Google Cloud Pricing Calculator is a web-based tool that lets you estimate costs for GCP services before provisioning any resources. It supports Compute Engine instance types like n1-standard-4, allows you to specify region (us-central1), quantity (3 nodes), and even add Kubernetes Engine management fees. This is the only option designed for pre-provisioning cost estimation.

Answer

Billing export to BigQuery

Answer

Active Assist recommendations

Answer

Cost Management dashboard

Question 6

A company wants to adopt a zero-trust security model for accessing Google Cloud resources. Which Google Cloud technology BEST supports this approach?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise is Google Cloud's zero-trust access platform that enforces identity- and context-aware access to applications and resources without requiring a VPN. It embodies the zero-trust principle of 'never trust, always verify' by evaluating user identity, device posture, and context for every request. This is the most comprehensive Google Cloud technology for zero-trust.

Answer

Cloud VPN

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Firewall Rules

Question 7

A company runs a critical application on Compute Engine. They need a backup and disaster recovery strategy that includes automated backups and the ability to restore in a different region. Which TWO services should they use together? (Select 2)

Accepted Answer

Persistent Disk snapshots. Persistent Disk snapshots can be used for automated backups. Cloud Storage can store these snapshots in a different region for DR. Cloud SQL is not relevant if the application runs on Compute Engine. Cloud Run is a compute service, not backup. Dataflow is processing.

Answer

Cloud Run

Answer

Dataflow

Answer

Cloud SQL

Question 8

A retailer experiences traffic spikes during holiday sales. They want to ensure their website can handle the load without performance degradation. Which cloud characteristic is most relevant?

Accepted Answer

Scalability. Scalability is the cloud characteristic that allows a system to handle increasing loads by adding resources, either vertically (scaling up) or horizontally (scaling out). During holiday sales, the retailer needs to accommodate traffic spikes without performance degradation, which directly aligns with the ability to scale resources dynamically. Thus, scalability is the most relevant characteristic.

Answer

Reliability

Answer

Security

Answer

Cost optimisation

Question 9

A company's finance director asks: 'If we move to cloud, do we need to buy fewer servers?' An IT architect responds that the answer depends on whether the company is adopting IaaS, PaaS, or SaaS. How does the service model affect hardware ownership?

Accepted Answer

In all three models, the cloud provider owns and manages the physical hardware, eliminating the need for customer-owned servers for those workloads — with IaaS requiring the most customer management (VMs) and SaaS requiring the least (just use the application). In IaaS, PaaS, and SaaS, the cloud provider owns and manages the physical hardware in their data centers. The customer's hardware ownership decreases as the service model abstracts more layers: IaaS provides virtual machines (VMs) that the customer manages, PaaS provides a managed platform (runtime, middleware) without customer control over the underlying OS or hardware, and SaaS delivers a fully managed application where the customer only uses the software. Thus, moving to any of these models reduces or eliminates the need for customer-owned servers for those specific workloads.

Answer

All three models (IaaS, PaaS, SaaS) require the same amount of customer-owned hardware since cloud supplements rather than replaces on-premises systems

Answer

Only SaaS eliminates the need for customer servers; IaaS and PaaS still require on-premises hardware for hybrid connectivity

Answer

The service model doesn't affect hardware ownership — hardware purchase decisions are independent of whether the company uses cloud services

Question 10

A healthcare company needs to run a large batch processing job that analyzes patient records using Apache Spark, transforming data from Cloud Storage and writing results to BigQuery. The job runs once daily and requires a large cluster that should exist only during the job. Which Google Cloud product best handles this ephemeral large-batch Spark workload?

Accepted Answer

Cloud Dataproc, which runs managed Apache Spark clusters that can be created for the job and deleted on completion — paying only during the processing window. Cloud Dataproc is the correct choice because it provides managed Apache Spark clusters that can be created on demand for the batch job and automatically deleted upon completion, ensuring you only pay for the processing time. This ephemeral cluster model perfectly matches the requirement of a large cluster that exists only during the daily job, without manual infrastructure management.

Answer

Cloud Dataflow, for running the Apache Spark code as a streaming pipeline

Answer

Compute Engine VMs, by manually installing Apache Spark on a cluster of VMs each day before the job

Answer

BigQuery, by running the Spark transformation directly within BigQuery's execution engine

Question 11

A company has employees who use personal (unmanaged) devices to access corporate applications. The security team wants to prevent sensitive Google Workspace documents from being downloaded to personal devices. Which Google control most directly addresses this data loss prevention requirement for device-based scenarios?

Accepted Answer

Google Workspace context-aware access and endpoint management controls that restrict actions (such as downloads) for users accessing from unmanaged personal devices. Google Workspace context-aware access combined with endpoint management allows administrators to create access level policies that restrict specific actions—such as downloading, printing, or copying—based on device trust signals. When a user accesses Google Workspace from an unmanaged personal device, the policy can block the download of sensitive documents directly, addressing the data loss prevention requirement at the action level rather than just the access level.

Answer

Cloud Armor, by blocking requests from IP addresses associated with personal devices

Answer

Enabling two-factor authentication for all users, which prevents unauthorized access

Answer

Encrypting all Google Drive files so they cannot be read on personal devices

Question 12

A company runs a mission-critical PostgreSQL database on Google Cloud that must support automatic failover to a standby instance within 60 seconds if the primary instance fails, with minimal data loss. Which Cloud SQL configuration satisfies this high availability requirement?

Accepted Answer

Cloud SQL High Availability configuration with a synchronously replicated standby instance that automatically promotes to primary within approximately 60 seconds of primary failure. Cloud SQL's High Availability (HA) configuration uses a synchronous replication mechanism between the primary and standby instances. This ensures that transactions are committed on both instances before being acknowledged, meeting the requirement for minimal data loss. In the event of a primary failure, the standby is automatically promoted to primary within approximately 60 seconds, satisfying the failover time requirement.

Answer

Cloud SQL with automated daily backups, restoring from backup if the primary fails

Answer

Cloud SQL read replicas in another region, manually promoted if the primary fails

Answer

Running a self-managed PostgreSQL cluster on Compute Engine VMs with a custom pacemaker/corosync HA setup

Question 13

A company's SRE team is debating whether to automate a frequently performed manual operational task. The automation would take 4 weeks of engineering time to build. The manual task takes 30 minutes per occurrence and happens approximately 20 times per month. Using the SRE concept of 'toil,' how should the team approach this decision?

Accepted Answer

Build the automation: eliminating toil permanently is a core SRE principle, and the 4-week investment pays back within approximately 16 months while freeing engineers for higher-value reliability work indefinitely. Automating toil aligns with the core SRE principle of eliminating repetitive, manual work to free engineers for higher-value reliability tasks. The 4-week build cost is justified: 20 occurrences/month × 0.5 hours = 10 hours/month, so the payback period is 4 weeks × 40 hours/week ÷ 10 hours/month = 16 months, after which the team gains indefinite time savings. This decision does not require exact salary data, as the primary goal is reducing toil, not purely cost optimization.

Answer

Do not automate — the manual task is only 10 hours per month and the 4-week build cost is too high to justify

Answer

Hire an additional junior engineer to perform the manual task more efficiently instead of automating

Answer

The team cannot make this decision without knowing the exact annual salary cost of the engineers who perform the manual task

Question 14

A cloud architect is explaining to executives why they should use managed services (like Cloud SQL, Memorystore, Pub/Sub) instead of running self-managed equivalents on VMs (PostgreSQL on VM, Redis on VM, RabbitMQ on VM). Which argument best captures the strategic rationale for preferring managed services?

Accepted Answer

Managed services transfer undifferentiated operational complexity (patching, backups, HA, scaling) to Google, freeing engineering teams to focus on differentiated business logic rather than infrastructure management. Ly captures the strategic rationale because managed services like Cloud SQL, Memorystore, and Pub/Sub offload undifferentiated heavy lifting—such as automated patching, backup management, high-availability failover, and horizontal scaling—to Google Cloud. This allows engineering teams to focus on building and improving application-specific features rather than spending time on infrastructure tasks that do not provide competitive advantage.

Answer

Managed services are always less expensive than self-managed alternatives on VMs

Answer

Managed services guarantee better performance than self-managed deployments in all scenarios

Answer

Using managed services eliminates the need for any cloud expertise within the engineering team

Question 15

A startup is building an application that sends daily promotional push notifications to millions of mobile users on both iOS and Android devices. Which Google Cloud or Google service most directly provides the infrastructure for sending these mobile push notifications?

Accepted Answer

Firebase Cloud Messaging (FCM), which delivers push notifications to iOS and Android devices through Google's mobile notification infrastructure. Firebase Cloud Messaging (FCM) is Google's dedicated, scalable infrastructure for delivering push notifications to both iOS and Android devices. It handles device registration, message routing, and platform-specific delivery through Apple Push Notification service (APNs) for iOS and Google's own push service for Android, making it the most direct and appropriate service for this use case.

Answer

Cloud Pub/Sub, which delivers messages to subscribed mobile application instances

Answer

Cloud Storage, by writing notification content to buckets that mobile applications poll for new messages

Answer

Cloud Run, by exposing an API that mobile applications call to retrieve their pending notifications