Cloud Digital Leader Practice Test 18 — 15 Questions

Question 1

An organization wants to ensure that all projects in their GCP organization have consistent IAM policies. They also need to restrict the use of external IP addresses on Compute Engine instances for security. Which TWO tools should they use? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an organization policy constraint 'compute.vmExternalIpAccess' at the organization level. Organization policies can enforce restrictions like disabling external IP addresses across the entire organization. IAM policies at the organization level can set baseline access controls inherited by all projects.

Answer

Apply a deny IAM policy to each project individually

Answer

Set a quota for external IP addresses per project

Answer

Use network tags to block external IPs

Question 2

A company wants to set up cost controls and analysis. They need to receive notifications when spending exceeds certain thresholds, and also be able to run custom queries on billing data. Which TWO actions should they take? (Choose 2)

Accepted Answer

Create a budget and set alert thresholds. To receive notifications at thresholds, they need to create a budget and set alerts. To run custom queries, they should enable billing export to BigQuery.

Answer

Set up a Pub/Sub topic for billing alerts

Answer

Activate the Cost Management dashboard

Answer

Enable billing export to Cloud Storage

Question 3

A company wants to detect and prioritize vulnerabilities in their Compute Engine VMs and GKE clusters. They also need a centralized view of security findings across their organization. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the central vulnerability and threat detection service for GCP. It finds misconfigurations, vulnerabilities, and threats across services like Compute Engine and GKE, and provides a dashboard for prioritization. Chronicle is a SIEM for log analysis, not vulnerability scanning. Cloud IDS is for network intrusion detection. Web Risk API is for checking URLs against threat lists.

Answer

Cloud IDS

Answer

Web Risk API

Answer

Chronicle

Question 4

A company wants to reduce its carbon footprint by running workloads on Google Cloud. Which Google Cloud commitment directly supports this goal?

Accepted Answer

Google Cloud's 100% renewable energy match for operations. Google Cloud matches 100% of its global electricity consumption with renewable energy and aims to run on carbon-free energy 24/7 by 2030.

Answer

Choosing a region with lower CO2 equivalent per kWh

Answer

Using preemptible VMs

Answer

Using committed use discounts

Question 5

A company needs to enforce that no project in the organization can create resources outside of the us-central1 region. They also need to allow the Finance team to manage billing for all projects. Which TWO steps should they take?

Accepted Answer

Apply the `gcp.resourceLocations` organization policy constraint at the organization node. Organization policies can be applied at the organization level to restrict locations. Billing account access is controlled by IAM roles on the billing account, granting the Finance team the Billing Account Administrator role.

Answer

Create a separate billing account for each project

Answer

Use IAM deny policies at the organization node to block resource creation outside us-central1

Answer

Create a folder and apply an organization policy constraint to restrict locations at the folder level

Question 6

Which characteristic of cloud computing allows a user to provision virtual machines without needing to interact with Google Cloud support or create a ticket?

Accepted Answer

On-demand self-service. On-demand self-service means users can provision resources automatically without human interaction. The other options are also NIST characteristics but do not specifically address provisioning without manual intervention.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 7

A data scientist wants to train a machine learning model using a managed service that supports custom TensorFlow code and provides GPU/TPU hardware acceleration. They prefer not to manage the underlying infrastructure. Which Google Cloud service should they use?

Accepted Answer

AI Platform Training (Vertex AI Training). AI Platform Training (now Vertex AI Training) is a managed service that allows you to run custom TensorFlow/PyTorch training jobs on pre-configured VM instances with GPUs/TPUs, without managing the cluster.

Answer

Compute Engine with pre-installed TensorFlow

Answer

Cloud Functions

Answer

Google Kubernetes Engine with GPU nodes

Question 8

A data engineering team needs to process streaming data from Cloud Pub/Sub, perform transformations, and write the results to BigQuery. The team requires exactly-once processing semantics and automatic scaling. Which service should they use?

Accepted Answer

Cloud Dataflow. Dataflow (Apache Beam) provides exactly-once processing, autoscaling, and native integration with Pub/Sub and BigQuery for streaming pipelines. Cloud Dataproc is for batch Spark/Hadoop, not streaming. Cloud Functions processes events one at a time without exactly-once guarantees across a pipeline. BigQuery itself does not transform streaming data.

Answer

Cloud Functions

Answer

Cloud Dataproc

Answer

BigQuery

Question 9

A company has a VPC with multiple subnets and wants to prevent data exfiltration by restricting access to a Cloud Storage bucket from only resources within a defined perimeter. Which Google Cloud service should they use to create an API perimeter around the bucket?

Accepted Answer

VPC Service Controls. VPC Service Controls allows you to define perimeters around Google Cloud services like Cloud Storage, preventing data exfiltration to networks outside the perimeter. VPC firewall rules control network traffic but not API access. Cloud Armor is for DDoS protection. Cloud NAT is for outbound internet access.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC firewall rules

Question 10

A company wants to analyze its Google Cloud spending trends by project, service, and labels. They need to run custom SQL queries on billing data and retain it for 2 years. Which approach should they use?

Accepted Answer

Set up billing export to BigQuery.. Billing export to BigQuery allows you to export detailed billing data into BigQuery datasets, where you can run custom SQL queries and retain data for your desired period.

Answer

Use the Google Cloud Pricing Calculator.

Answer

Enable the Cost Management dashboard.

Answer

Configure budgets and alerts.

Question 11

Which Google Cloud service provides a unified platform for building, training, and deploying machine learning models at scale?

Accepted Answer

Vertex AI. Vertex AI is the unified ML platform covering all stages of ML workflow. AutoML is a component, Dataflow is for data processing, and BigQuery ML runs ML models in SQL.

Answer

BigQuery ML

Answer

AutoML

Answer

Cloud Dataflow

Question 12

A company has a folder for each department. The Finance team needs to prevent all projects under its folder from creating external IP addresses. What is the most efficient way to enforce this restriction?

Accepted Answer

Apply an organization policy constraint at the folder level. Organization policies can be defined at any level of the resource hierarchy and are inherited by child resources. Setting a constraint at the folder level applies to all projects under that folder.

Answer

Configure a service perimeter in VPC Service Controls

Answer

Use a deny IAM policy at the folder level

Answer

Set a VPC firewall rule in each project

Question 13

An organization needs to apply security policies to protect their web application from DDoS attacks and SQL injection. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is a web application firewall (WAF) that provides DDoS protection and security rules to block threats like SQL injection. Cloud CDN is for content caching. Load Balancing distributes traffic. Cloud NAT is for outbound connectivity.

Answer

Cloud NAT

Answer

Cloud Load Balancing

Answer

Cloud CDN

Question 14

A company wants to run a batch job that processes data every night. They need to provision a VM for this task but want to minimize costs. The job can tolerate interruptions and can be resumed. Which Compute Engine VM option should they use?

Accepted Answer

Preemptible VM. Preemptible VMs are short-lived, cost-effective instances that can be terminated at any time but are ideal for batch jobs that can handle interruptions.

Answer

VM with committed use discount

Answer

Sole-tenant node

Answer

Standard VM

Question 15

A company's cloud spending suddenly spikes by 300% for one week before returning to normal. The cloud team investigates and finds a developer accidentally left a large cluster of VMs running over the weekend. Which cloud financial management practice most effectively prevents this type of unexpected cost spike?

Accepted Answer

Setting Cloud Billing budget alerts that notify stakeholders when spending approaches defined thresholds, enabling early detection and response to abnormal spending patterns. Cloud Billing budget alerts provide real-time notifications when spending exceeds defined thresholds, enabling the cloud team to detect and respond to the 300% spike immediately rather than after the fact. This proactive monitoring directly addresses the root cause—unexpected resource usage—by alerting stakeholders while the VMs are still running, allowing them to shut down the cluster and prevent further cost accumulation.

Answer

Requiring all cloud resource creation to go through a central IT approval process to prevent accidental VM creation

Answer

Reviewing cloud bills at the end of each month to identify cost anomalies and address them retroactively

Answer

Using Reserved Instances for all VM workloads to reduce per-hour costs, making accidental long-running VMs less expensive