Cloud Digital Leader Practice Test 18 — 15 Questions

Question 1

A startup is building a web application and wants to protect it from common web attacks like SQL injection and cross-site scripting. Which Google Cloud product provides web application firewall (WAF) capabilities?

Accepted Answer

Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks. Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.

Answer

Cloud Firewall, which controls network-level traffic based on IP and port rules

Answer

VPC Service Controls, which prevent data exfiltration from Google Cloud services

Answer

Security Command Center, which detects security misconfigurations across Google Cloud resources

Question 2

A company has migrated sensitive customer data to Google Cloud. The legal team asks: 'If Google is hosting our data, who is responsible for ensuring that data is not improperly accessed by unauthorized users through our application?' Under the shared responsibility model, how should the CTO answer?

Accepted Answer

The customer is responsible for application access controls, authentication, and IAM policies that protect data from unauthorized application-layer access, while Google secures the underlying infrastructure. Option B is correct because under the Google Cloud shared responsibility model, the customer is responsible for securing access to their application and data, including authentication, authorization, and IAM policies, while Google is responsible for the security of the underlying infrastructure (physical security, network, hypervisor). The legal team's question specifically asks about unauthorized access through the customer's application, which falls under the customer's responsibility for application-layer controls.

Answer

Google is fully responsible because they host the data and control the infrastructure

Answer

Both Google and the customer share equal 50/50 responsibility for all data access controls

Answer

No one is responsible because cloud computing inherently cannot prevent unauthorized access

Question 3

A business user asks what makes cloud storage different from simply buying a larger external hard drive for the office. Which characteristic most clearly differentiates cloud storage from local storage devices?

Accepted Answer

Cloud storage is accessible from anywhere via the internet, scales elastically without hardware purchases, and provides built-in redundancy across multiple physical locations. Cloud storage is fundamentally different from local storage because it provides internet-based accessibility, elastic scalability without requiring hardware procurement, and built-in redundancy across geographically distributed data centers. These characteristics enable on-demand resource provisioning and high availability, which a single external hard drive cannot offer. The correct answer, B, captures these core differentiators that align with the NIST definition of cloud computing.

Answer

Cloud storage is faster than local storage for all types of data access

Answer

Cloud storage cannot be used for backup, while external hard drives are purpose-built for backup

Answer

Cloud storage requires specialized hardware on the customer's side to access data

Question 4

A cloud operations team wants to ensure that all cloud resources created in their Google Cloud organization comply with company naming standards and required cost allocation labels. Which Google Cloud capability can automatically enforce these standards on resource creation?

Accepted Answer

Organization Policy Service with custom constraints or required label policies that prevent resource creation if naming and label standards are not met. Organization Policy Service with custom constraints or required label policies is correct because it provides a preventive control that blocks resource creation if the resource does not meet defined naming and label standards. This is enforced at the Google Cloud resource hierarchy level before any resource is provisioned, ensuring compliance automatically without relying on post-creation detection or manual processes.

Answer

Cloud Billing reports, which flag resources missing required labels after they are created

Answer

Cloud Monitoring alerts that notify the team when non-compliant resources are detected

Answer

Cloud IAM roles that only grant resource creation permissions to employees who have passed a naming standards training

Question 5

A company's IT team is planning its network architecture for a Google Cloud deployment. They want to ensure that their development, staging, and production environments are completely isolated from each other at the network level. What is the most effective way to achieve this isolation in Google Cloud?

Accepted Answer

Deploying each environment (dev, staging, prod) in separate VPC networks — optionally in separate Google Cloud projects — to achieve complete network isolation with no default connectivity between environments. Option B is correct because deploying each environment in separate VPC networks (optionally in separate projects) provides complete network isolation by default. In Google Cloud, VPC networks are isolated entities with no inherent peering or connectivity; traffic between them requires explicit VPC peering or VPN configurations. This ensures that development, staging, and production environments cannot communicate at the network layer unless intentionally connected, meeting the requirement for complete isolation.

Answer

Using separate subnets within the same VPC for each environment, with firewall rules blocking cross-subnet traffic

Answer

Using different IP address ranges for each environment within the same network

Answer

Using Cloud IAM to restrict developers from accessing production resources, which achieves the same isolation as network separation

Question 6

A company wants to expose its internal backend services to external partners through a managed API layer that handles authentication, rate limiting, traffic management, and analytics — without modifying the underlying services. Which Google Cloud product is designed for this API management use case?

Accepted Answer

Apigee, Google Cloud's full-featured enterprise API management platform for authentication, rate limiting, analytics, and developer portal without modifying backend services. Apigee is Google Cloud's full-featured enterprise API management platform designed to expose backend services to external partners without requiring modifications to those services. It provides built-in authentication, rate limiting, traffic management, and analytics, along with a developer portal for partner onboarding. This makes it the correct choice for the described use case.

Answer

Cloud Load Balancing, which distributes API requests across backend instances

Answer

Cloud Endpoints, a lighter-weight API gateway for Google Cloud-hosted APIs

Answer

Cloud Armor, Google Cloud's web application firewall and DDoS protection service

Question 7

A company is concerned that employees might accidentally or maliciously upload sensitive personal data (such as credit card numbers or Social Security Numbers) to Cloud Storage buckets. Which Google Cloud product can automatically scan uploaded files and identify sensitive data patterns?

Accepted Answer

Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection. Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to inspect and classify sensitive data within Cloud Storage objects. It uses built-in detectors (infoTypes) to identify patterns like credit card numbers (Luhn check) and Social Security Numbers, and can trigger automated actions such as redaction or logging when sensitive data is found.

Answer

Cloud Armor, which inspects incoming HTTP requests for sensitive data patterns

Answer

Cloud Logging, which records all file upload events to Cloud Storage

Answer

Security Command Center, which audits Cloud Storage bucket permissions

Question 8

A multinational company must ensure that personal data of European citizens stored in Google Cloud cannot be accessed by or transferred to systems outside the European Union, as required by GDPR data residency requirements. Which Google Cloud controls most directly enforce this?

Accepted Answer

Configuring organization policy to restrict resource creation to EU regions, using VPC Service Controls to prevent data movement outside the EU perimeter, and establishing a GDPR-compliant Data Processing Agreement with Google. Option B is correct because it combines three essential controls that directly enforce GDPR data residency: Organization Policies restrict resource creation to EU regions, VPC Service Controls create a data perimeter preventing exfiltration outside the EU, and a GDPR-compliant Data Processing Agreement (DPA) establishes the legal framework for data handling. These controls work together to ensure data at rest and in transit remains within the EU boundary, directly addressing the residency requirement.

Answer

Enabling HTTPS for all data transmission to ensure data is encrypted during transfer

Answer

Using Customer-Managed Encryption Keys (CMEK) where the encryption keys are stored outside Google's infrastructure

Answer

Training developers about GDPR requirements and requiring manual approval for any cross-region data transfers

Question 9

A company's operations team needs visibility into network traffic patterns, latency between services, and potential network bottlenecks across their Google Cloud deployment. Which Google Cloud product provides network performance monitoring, connectivity testing, and traffic analysis?

Accepted Answer

Network Intelligence Center, which provides network topology visualization, connectivity testing, firewall analysis, and performance monitoring. The Network Intelligence Center is the correct choice because it is a Google Cloud-native product specifically designed to provide network performance monitoring (latency, packet loss, throughput), connectivity testing (Connectivity Tests), and traffic analysis (Flow Tracer, Firewall Insights). It offers a unified dashboard for visualizing network topology, analyzing firewall rules, and diagnosing connectivity issues across VPCs, hybrid clouds, and on-premises environments, directly addressing the need for visibility into traffic patterns and bottlenecks.

Answer

Cloud Armor, which provides DDoS protection and traffic filtering

Answer

Cloud DNS, which translates domain names to IP addresses

Answer

Cloud VPN, which creates encrypted tunnels between cloud and on-premises networks

Question 10

A business leader asks: 'What is the difference between a data center region and an availability zone in Google Cloud?' Which explanation is most accurate?

Accepted Answer

A region is a geographic area containing multiple independent zones; each zone is a distinct facility with independent power, cooling, and networking — failures in one zone don't affect other zones in the region. Option B is correct because in Google Cloud, a region is a specific geographic location composed of multiple zones, where each zone is an independent data center with its own power, cooling, and networking infrastructure. This isolation ensures that failures within one zone do not impact other zones in the same region, providing high availability and fault tolerance for applications.

Answer

A region is a single data center building; an availability zone is a floor within that building

Answer

A region is equivalent to an availability zone; both terms refer to a single data center

Answer

An availability zone is larger than a region and spans multiple geographic areas for global redundancy

Question 11

A hospital network wants to improve patient outcomes by sharing medical records across its 12 hospitals so that any physician can access a patient's complete history. Currently, each hospital has its own isolated system. Which cloud characteristic is most relevant to enabling this cross-hospital data sharing?

Accepted Answer

Cloud's ubiquitous network access, enabling a secure shared data platform accessible to authorized physicians across all 12 hospital locations through standard internet connectivity. Ubiquitous network access is the cloud characteristic that ensures a secure, shared data platform is accessible to authorized physicians across all 12 hospital locations via standard internet connectivity. This enables seamless cross-hospital data sharing without requiring each hospital to maintain its own isolated system, as the cloud provides consistent network-based access to the centralized medical records.

Answer

Cloud elasticity, which allows the hospital to scale up server capacity during peak admission periods

Answer

Cloud's pay-per-use billing model, which reduces the cost of medical record storage

Answer

Cloud resource pooling, which allows multiple hospitals to share physical compute resources

Question 12

A software team is using Google Cloud and wants to understand the difference between 'scaling up' (vertical scaling) and 'scaling out' (horizontal scaling) for their web application. Which description correctly distinguishes these two approaches?

Accepted Answer

Vertical scaling (scaling up) increases the resources of an individual server (more CPU, RAM), while horizontal scaling (scaling out) adds more servers to distribute load — horizontal scaling is generally preferred in cloud environments for its flexibility and lack of a ceiling. Option B correctly distinguishes vertical scaling (scaling up) as increasing the resources (CPU, RAM) of an existing server, and horizontal scaling (scaling out) as adding more servers to distribute the load. In cloud environments like Google Cloud, horizontal scaling is generally preferred because it offers near-infinite scalability, better fault tolerance, and no single point of failure, unlike vertical scaling which has a hardware ceiling and can cause downtime during upgrades.

Answer

Scaling up adds more servers to handle increased load; scaling out makes each server more powerful by adding CPU and RAM

Answer

Both scaling up and scaling out describe the same approach — adding more cloud resources to handle increased demand

Answer

Scaling up is only possible in cloud environments; on-premises systems can only scale out

Question 13

An architect is evaluating whether to use a relational database or a NoSQL database for a new application that must store product catalog data. Products have highly variable attributes — a book has ISBN, author, and genre; a bicycle has frame size, wheel diameter, and material. Which database characteristic makes NoSQL document databases advantageous for this use case?

Accepted Answer

NoSQL document databases support flexible schemas where each document can have different fields — making them well-suited for product catalogs where different product types have different attributes. NoSQL document databases, such as MongoDB, store data in flexible, schema-less documents (often JSON or BSON). This allows each document to have a different set of fields, making them ideal for product catalogs where a book and a bicycle have entirely different attributes (e.g., ISBN vs. frame size). Relational databases require a predefined schema with fixed columns, forcing you to either create many sparse columns or use complex join tables to handle variable attributes.

Answer

NoSQL databases always provide faster query performance than relational databases for all use cases

Answer

NoSQL databases support ACID transactions better than relational databases, making them safer for product catalog updates

Answer

NoSQL databases are simpler to query because they don't require learning SQL

Question 14

A business analyst needs to understand why cloud services bill differently for compute (VMs) versus object storage. Compute VMs are billed per second while they are running; Cloud Storage is billed per GB-month of data stored. Which cloud pricing principle explains why these billing units are different?

Accepted Answer

Cloud resources are billed based on their natural unit of consumption: compute time for VMs (per second running) and data volume over time for storage (per GB-month) — matching billing to how each resource is actually consumed. Option B is correct because cloud providers align billing units with the natural consumption pattern of each resource. Compute VMs consume CPU and memory continuously while running, making per-second billing the most granular and fair measure of actual usage. Object storage, by contrast, incurs cost primarily from the capacity occupied over time, so billing per GB-month directly reflects the resource's persistent footprint. This principle ensures customers pay only for what they use, in the unit that matches the resource's operational behavior.

Answer

Cloud providers bill different resources differently to maximize revenue by charging the highest rates for the most-used services

Answer

Storage is charged per GB-month because cloud providers cannot measure storage usage per second accurately

Answer

The billing difference is a temporary situation; cloud providers are working toward a single universal billing unit for all services

Question 15

A company's analytics team wants to enable business users to create their own reports and dashboards from a governed set of BigQuery data, without writing SQL. At the same time, the data engineering team must maintain centralized control over how key metrics (like 'revenue' or 'active users') are defined. Which Google Cloud product architecture best meets both requirements?

Accepted Answer

Looker with LookML semantic layer: data engineers centrally govern metric definitions in LookML, business users create self-service reports through Looker's interface using those governed definitions — no SQL required. Option B is correct because Looker with LookML provides a semantic layer where data engineers centrally define governed metric definitions (e.g., 'revenue' as SUM(price * quantity) with specific filters). Business users can then create self-service reports and dashboards via Looker's drag-and-drop interface without writing SQL, ensuring consistency and control over key metrics.

Answer

Looker Studio connected directly to BigQuery, allowing each business user to create their own metric definitions

Answer

Sharing BigQuery query templates with business users and training them to modify them for their reports

Answer

Building a custom web application that wraps BigQuery APIs and presents data to business users