Cloud Digital Leader Practice Test 19 — 15 Questions

Question 1

Which principle states that a user should be granted only the permissions necessary to perform their job functions?

Accepted Answer

Principle of least privilege. The principle of least privilege is the security concept of granting minimal required permissions. Separation of duties divides tasks among multiple people. Zero trust is a broader security model. Defence in depth is layered security.

Answer

Defence in depth

Answer

Separation of duties

Answer

Zero trust

Question 2

A startup wants to deploy a containerized web application without managing servers or clusters. They need automatic scaling, a managed runtime, and pay only for resources used. Which Google Cloud service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform for containers that automatically scales and charges only for resources used. It fits the requirements perfectly.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine

Question 3

A company wants to encrypt sensitive data stored in Cloud Storage with a key that is generated and stored on-premises using a hardware security module (HSM). They do not want Google to have access to the key. Which encryption option should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own keys; Google does not store the key and has no access to it.

Answer

Google-managed encryption keys

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud HSM

Question 4

An organization uses labels to track cost by environment (dev, test, prod). However, the Finance team notices that some resources are missing the 'env' label. Which service can automatically suggest labeling resources that are missing required labels?

Accepted Answer

Active Assist Recommendations. Active Assist provides recommendations for various optimizations, including labeling. The Recommender can suggest labels for resources that are missing them, based on usage patterns.

Answer

Cost Management dashboard

Answer

Cloud Asset Inventory

Answer

Organization Policy Service

Question 5

A startup uses Google Workspace for email and collaboration. They want to add a custom domain to their Gmail accounts. Which service model does Google Workspace represent?

Accepted Answer

SaaS. Google Workspace is a SaaS offering where Google manages all infrastructure, including the application, runtime, OS, and hardware.

Answer

PaaS

Answer

FaaS

Answer

IaaS

Question 6

An organization wants to protect its web application from DDoS attacks and SQL injection. Which Google Cloud service should they deploy?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and Web Application Firewall (WAF) capabilities to block attacks like SQL injection. Cloud IDS is for intrusion detection. Security Command Center is for vulnerability management. Cloud DNS is for DNS resolution.

Answer

Cloud DNS

Answer

Security Command Center

Answer

Cloud IDS

Question 7

A security administrator needs to ensure that Google personnel do not access customer data without explicit authorization. Which service should they use to get logs of Google employee access?

Accepted Answer

Access Transparency. Access Transparency provides logs of Google personnel actions on customer data. Cloud Audit Logs track user activities within the customer's project. Assured Workloads is for regulatory compliance. Security Command Center is for threat detection.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Assured Workloads

Question 8

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single physical server with a custom Linux distribution. The team wants to minimize changes to the application while gaining the benefits of cloud infrastructure. Which migration strategy should they use?

Accepted Answer

Rehost the application on Compute Engine using a custom image of the current OS. Lift and shift (rehosting) moves the application as-is to the cloud, often by creating a custom image to run on Compute Engine. This minimizes changes. Refactoring (rearchitecting) involves code changes; re-platforming modifies the OS/platform; rebuilding is a full rewrite.

Answer

Rebuild the application from scratch on Cloud Run

Answer

Re-platform the application to a supported OS version

Answer

Refactor the application into microservices and deploy on GKE

Question 9

A company has a production project that requires a compute quota of 500 vCPUs, but the default limit is 200. What is the correct process to request a quota increase?

Accepted Answer

Navigate to IAM & Admin > Quotas in Cloud Console, select the metric, and request an increase. Quota increases can be requested through the Cloud Console under IAM & Admin > Quotas, where the engineer can select the metric (e.g., CPUs) and request a higher limit.

Answer

Shut down idle VMs to free up quota

Answer

Create a new support ticket with the Billing team

Answer

Use the gcloud compute quotas update command

Question 10

What is the primary purpose of a folder in the Google Cloud resource hierarchy?

Accepted Answer

To group projects and apply policies. Folders allow you to group projects and apply IAM policies and organization policies at a level below the organization node, enabling departmental separation and delegated administration.

Answer

To manage user identities

Answer

To define network topologies

Answer

To store billing information

Question 11

A team wants to use a managed MySQL database that offers automatic failover, backups, and read replicas. They also need to connect from Compute Engine instances in the same region. Which service should they use?

Accepted Answer

Cloud SQL for MySQL. Cloud SQL provides managed MySQL with high availability, automated backups, and read replicas, and can be accessed from Compute Engine via internal IP.

Answer

Bigtable

Answer

Cloud Spanner

Answer

Firestore

Question 12

An e-commerce company experiences unpredictable traffic spikes. They need to ensure their web application automatically scales out during high demand and scales in when demand drops, paying only for resources used. Which cloud benefit best describes this?

Accepted Answer

Elasticity. Elasticity allows resources to automatically scale up and down based on demand, optimizing cost and performance.

Answer

Economies of scale

Answer

Broad network access

Answer

Reliability

Question 13

A developer wants to estimate the monthly cost of running a Kubernetes cluster with 3 nodes of n1-standard-4 in the us-central1 region before provisioning. Which tool should the developer use?

Accepted Answer

Google Cloud Pricing Calculator. The Google Cloud Pricing Calculator is used to estimate costs for various services before deployment.

Answer

Billing export to BigQuery

Answer

Active Assist recommendations

Answer

Cost Management dashboard

Question 14

An organization has multiple projects with many underutilized Compute Engine instances. They want to identify idle instances and generate recommendations for downsizing or deleting them. The finance team wants to see cost savings estimates. Which tool should they use?

Accepted Answer

Active Assist. Active Assist includes recommendations for rightsizing and idle resources, providing cost savings estimates. The Cost Management dashboard shows actual costs, not recommendations.

Answer

Google Cloud Pricing Calculator

Answer

Billing export to BigQuery

Answer

Cost Management dashboard

Question 15

A company wants to adopt a zero-trust security model for accessing Google Cloud resources. Which Google Cloud technology BEST supports this approach?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise is Google's zero-trust security model that allows access based on identity and context, without VPNs.

Answer

Cloud VPN

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Firewall Rules