Cloud Digital Leader Practice Test 18 — 15 Questions

Question 1

A company's application stores sensitive customer information in Cloud Storage. A security audit finds that one bucket has 'allUsers' access granted (making it publicly accessible on the internet). The security team wants to prevent this from happening in the future. Which control prevents public access from being granted to Cloud Storage buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the 'storage.publicAccessPrevention' organization policy constraint, which prevents allUsers and allAuthenticatedUsers from being granted in Cloud Storage IAM policies organization-wide. The 'storage.publicAccessPrevention' organization policy constraint is a Google Cloud IAM constraint that, when enforced at the organization, folder, or project level, prevents any IAM policy binding that grants access to 'allUsers' or 'allAuthenticatedUsers' on Cloud Storage buckets. This is a preventive control that blocks the action before it can occur, directly addressing the security team's requirement to prevent public access from being granted in the future.

Answer

Enable Cloud Armor on all Cloud Storage buckets to block public internet access

Answer

Enable VPC Service Controls around Cloud Storage to prevent public internet access

Answer

Configure Cloud Monitoring to alert the security team when a bucket is made public so they can revert it

Question 2

A business leader asks: 'What is the difference between a data center region and an availability zone in Google Cloud?' Which explanation is most accurate?

Accepted Answer

A region is a geographic area containing multiple independent zones; each zone is a distinct facility with independent power, cooling, and networking — failures in one zone don't affect other zones in the region. In Google Cloud, a region is a specific geographic location composed of multiple zones, where each zone is an independent data center with its own power, cooling, and networking infrastructure. This isolation ensures that failures within one zone do not impact other zones in the same region, providing high availability and fault tolerance for applications.

Answer

A region is a single data center building; an availability zone is a floor within that building

Answer

A region is equivalent to an availability zone; both terms refer to a single data center

Answer

An availability zone is larger than a region and spans multiple geographic areas for global redundancy

Question 3

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

Accepted Answer

Access Context Manager with device policy conditions requiring managed, compliant devices.. Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Answer

Cloud Armor — it inspects device fingerprints on incoming requests.

Answer

Cloud Firewall rules that allow only corporate office IP ranges.

Answer

Two-step verification — the second factor proves the device is trusted.

Question 4

A security team is conducting a threat model for their Google Cloud environment. They identify 'insider threat' — a malicious authorized employee who intentionally exfiltrates or destroys data — as a key risk. Which combination of Google Cloud controls most effectively mitigates this risk?

Accepted Answer

Least privilege IAM (limiting access to only necessary resources), comprehensive audit logging (detecting anomalous access), VPC Service Controls (preventing data exfiltration to external projects), and separation of duties for critical actions. It combines least privilege IAM to limit the blast radius, comprehensive audit logging (e.g., Cloud Audit Logs) to detect anomalous access patterns, VPC Service Controls to prevent data exfiltration via VPC perimeter enforcement, and separation of duties (e.g., using Cloud IAM Conditions) to ensure no single insider can perform critical actions alone. This layered defense addresses both prevention and detection of malicious insider activity.

Answer

Strong external firewall rules, because insider threats come from internal network actors who must be blocked at the perimeter

Answer

Encrypting all data at rest with CMEK, since encryption prevents authorized users from reading data

Answer

Requiring all employees to pass annual security training to prevent insider threats

Question 5

A security architect is evaluating Google Cloud's approach to securing customer data against both external attackers and potential internal Google personnel access. She identifies four distinct controls: (1) encryption at rest by default, (2) Access Transparency logs, (3) Customer-Managed Encryption Keys (CMEK), and (4) Access Approval. How do these four controls work together to provide layered data protection?

Accepted Answer

The four controls form complementary layers: default encryption protects physical storage, CMEK gives cryptographic customer control (revocable), Access Transparency provides visibility into Google personnel access, and Access Approval gives customers veto power — together addressing infrastructure attacks, insider threats, and provider access concerns. These four controls form a defense-in-depth strategy for data protection on Google Cloud. Default encryption at rest secures data on physical storage, CMEK provides cryptographic control with the ability to revoke access, Access Transparency logs offer visibility into Google personnel actions, and Access Approval gives customers the ability to veto access requests. Together, they address threats from infrastructure attacks, insider threats, and provider access concerns, creating a layered security model.

Answer

All four controls are redundant and address the same threat — customers only need to enable one of them

Answer

These controls are only relevant for government or military workloads; commercial enterprises don't need this level of protection

Answer

CMEK alone provides complete data protection — the other three controls are unnecessary if customer-managed keys are in use

Question 6

A startup wants to deploy a web application globally and expects traffic to be unpredictable — sometimes very low, sometimes very high. Which cloud characteristic ensures the startup only pays for the compute resources it actually uses?

Accepted Answer

Measured service / pay-per-use pricing, where the startup is billed only for actual resource consumption with no payment for idle capacity. The measured service / pay-per-use pricing model of cloud computing ensures that the startup is billed only for the compute resources it actually consumes, such as CPU hours, memory, or storage, with no charges for idle capacity. This directly addresses the need to handle unpredictable traffic spikes without incurring costs for unused resources during low-traffic periods. In Google Cloud, this is implemented through per-second billing for compute instances and autoscaling, which dynamically adjusts resources based on demand.

Answer

Resource pooling, which allows the startup to share physical hardware with other tenants

Answer

Broad network access, which allows the application to be reached from any device globally

Answer

On-demand self-service, which allows the startup to provision resources through a web interface without calling a sales team

Question 7

A CISO is implementing a Zero Trust security architecture for the company's Google Cloud environment. Under Zero Trust, which fundamental assumption about network traffic changes compared to traditional perimeter-based security?

Accepted Answer

Zero Trust assumes no traffic is trusted by default regardless of network origin — every request must be explicitly authenticated and authorized based on identity, device posture, and context. Zero Trust fundamentally shifts from implicit trust based on network location to explicit verification of every request. In Google Cloud, this means every API call, regardless of whether it originates from within the VPC or the internet, must be authenticated (e.g., using OAuth 2.0 or service account keys) and authorized based on identity, device posture, and context, as enforced by tools like Identity-Aware Proxy (IAP) and VPC Service Controls.

Answer

Zero Trust assumes that internal network traffic is more secure than external traffic because it has passed through the corporate firewall

Answer

Zero Trust assumes all traffic is malicious and blocks all requests by default, requiring explicit allowlisting for each connection

Answer

Zero Trust eliminates the need for encryption since all traffic is assumed to be on secure internal networks

Question 8

A company's cloud environment has grown rapidly and the team is struggling to understand what cloud resources exist across dozens of projects. Which Google Cloud product provides a unified inventory of all cloud assets across an organization's projects and folders?

Accepted Answer

Cloud Asset Inventory, which provides a searchable, unified inventory of all resources and IAM policies across an organization's projects and folders. Cloud Asset Inventory is the correct answer because it is the Google Cloud service specifically designed to provide a unified, searchable inventory of all cloud assets (resources and IAM policies) across an organization's projects, folders, and organization nodes. It supports real-time and historical snapshots, enabling teams to discover and track resources as the environment scales. This directly addresses the need to understand what resources exist across dozens of projects.

Answer

Cloud Billing console, which lists all resources that have incurred charges

Answer

Google Cloud Console project dashboard, which shows resources within a single project

Answer

Security Command Center, which lists security vulnerabilities in cloud resources

Question 9

A retail company needs to process financial transactions requiring strict ACID compliance, serve global customers with consistent low-latency reads and writes, and scale horizontally without downtime for maintenance. Which Google Cloud database service is uniquely designed to meet all three requirements simultaneously?

Accepted Answer

Cloud Spanner, Google's globally distributed relational database with ACID transactions and horizontal scalability. Cloud Spanner is the only Google Cloud database service that simultaneously provides ACID compliance across global transactions, consistent low-latency reads and writes via TrueTime and synchronous replication, and horizontal scaling without downtime through automatic sharding and resharding. It uniquely combines relational database semantics with global distribution, making it the correct choice for the given requirements.

Answer

Cloud SQL with read replicas in multiple regions

Answer

Firestore in Datastore mode with multi-region replication

Answer

BigQuery with streaming inserts for real-time transaction processing

Question 10

A traditional taxi company is losing market share to ride-sharing apps built on cloud platforms. A digital transformation consultant explains that the ride-sharing companies have a fundamental advantage rooted in their technology architecture. Which cloud-enabled capability most directly explains the ride-sharing companies' competitive advantage?

Accepted Answer

Cloud-enabled real-time matching, dynamic ML-driven pricing, and elastic mobile platforms create an operating model that taxi companies' legacy systems cannot replicate. Ride-sharing companies leverage cloud-native architectures—specifically real-time matching algorithms, machine learning (ML) for dynamic pricing, and elastic mobile platforms—to create an operating model that scales instantly with demand. This cloud-enabled capability allows them to optimize driver-rider pairing and pricing in milliseconds, a level of agility that traditional taxi companies with on-premises legacy systems cannot replicate. The fundamental advantage is not about asset ownership or tax structure but about the architectural ability to process massive real-time data streams and adjust operations dynamically.

Answer

Ride-sharing companies own more vehicles than taxi companies, giving them greater fleet capacity

Answer

Ride-sharing companies pay lower taxes, giving them a cost advantage over regulated taxi companies

Answer

Ride-sharing apps are available on smartphones, while taxis require phone calls

Question 11

A company's SRE team sets an SLO of 99.5% monthly availability for a non-critical internal tool. A business stakeholder argues the target should be 99.99%. The SRE team pushes back. Which SRE argument best supports keeping the 99.5% target?

Accepted Answer

For a non-critical internal tool, 99.99% reliability requires disproportionate engineering investment (redundancy, 24/7 on-call, chaos testing) compared to its business value; 99.5% matches the actual reliability need while preserving engineering capacity for higher-value work. Ly applies the SRE principle of aligning SLOs with business value. For a non-critical internal tool, the cost of achieving 99.99% availability—including redundant infrastructure, 24/7 on-call rotations, and chaos engineering—far exceeds the marginal benefit over 99.5%. This preserves engineering capacity for higher-value work, which is a core tenet of Google's SRE approach to error budgets and cost-benefit analysis.

Answer

Higher SLOs are always more expensive to achieve and the company cannot afford cloud infrastructure that provides 99.99% availability

Answer

Google Cloud cannot provide 99.99% availability for any service, so the SLO must be kept lower

Answer

The team should set 99.5% now and plan to increase it to 99.99% next quarter when the tool becomes more popular

Question 12

A company has migrated sensitive customer data to Google Cloud. The legal team asks: 'If Google is hosting our data, who is responsible for ensuring that data is not improperly accessed by unauthorized users through our application?' Under the shared responsibility model, how should the CTO answer?

Accepted Answer

The customer is responsible for application access controls, authentication, and IAM policies that protect data from unauthorized application-layer access, while Google secures the underlying infrastructure. Under the Google Cloud shared responsibility model, the customer is responsible for securing access to their application and data, including authentication, authorization, and IAM policies, while Google is responsible for the security of the underlying infrastructure (physical security, network, hypervisor). The legal team's question specifically asks about unauthorized access through the customer's application, which falls under the customer's responsibility for application-layer controls.

Answer

Google is fully responsible because they host the data and control the infrastructure

Answer

Both Google and the customer share equal 50/50 responsibility for all data access controls

Answer

No one is responsible because cloud computing inherently cannot prevent unauthorized access

Question 13

A company is comparing the total cost of keeping its data center versus moving to public cloud. An analyst argues that the comparison should include not just hardware costs but also facility costs. What facility costs should be included in the on-premises total cost of ownership calculation?

Accepted Answer

Physical space/rent, electricity (for servers and cooling), cooling system maintenance, physical security, and fire suppression — all of which are real costs borne by the organization for operating its own data center. A comprehensive on-premises total cost of ownership (TCO) must include all facility-related costs that are directly incurred to operate a data center. These include physical space/rent, electricity for servers and cooling, cooling system maintenance, physical security, and fire suppression. Excluding these costs would understate the true cost of running an on-premises environment, which is a key consideration when comparing to public cloud models like IaaS.

Answer

Only the cost of the servers themselves, since other costs are shared across the organization

Answer

Internet connectivity costs only, since data centers require high-bandwidth connections

Answer

Data center facility costs do not need to be included since they are fixed costs that don't change whether servers are present or not

Question 14

A CISO is designing an identity strategy for Google Cloud that follows Zero Trust principles. She proposes that no long-lived credentials (API keys, service account keys) should be used for any automated workloads. What Google Cloud mechanism replaces service account keys for authenticating workloads running on Google Cloud infrastructure?

Accepted Answer

Attaching a service account to the Compute Engine VM or GKE workload, allowing the workload to obtain short-lived access tokens from the metadata server automatically — no key files required. Google Cloud's default service account attached to Compute Engine VMs or GKE nodes uses the metadata server to automatically obtain short-lived OAuth 2.0 access tokens (typically valid for 1 hour). This eliminates the need for any long-lived key files, aligning with Zero Trust principles by reducing credential exposure and enabling automatic rotation.

Answer

Using long-lived API keys stored in Secret Manager instead of environment variables — the keys are the same but stored more securely

Answer

Rotating service account keys every 24 hours to minimize the exposure window

Answer

Using OAuth 2.0 user accounts instead of service accounts for all automated workloads

Question 15

A company wants to reduce its Google Cloud costs without reducing its workload capacity. The team identifies that several production VMs consistently use less than 30% of their allocated CPU and memory. What is the most straightforward cost optimization action?

Accepted Answer

Right-size the VMs by migrating to smaller machine types that match actual CPU and memory consumption, reducing costs proportionally. Right-sizing VMs by migrating to smaller machine types that match actual CPU and memory consumption directly reduces the cost per hour while maintaining the same workload capacity. Since the VMs are consistently under-utilized, this approach eliminates wasted resources without affecting performance or availability.

Answer

Delete the under-utilized VMs since low utilization indicates they are no longer needed

Answer

Purchase Committed Use Discounts for the over-provisioned VMs to reduce their per-hour cost

Answer

Enable sustained use discounts by ensuring VMs run continuously throughout the month