Cloud Digital Leader Practice Test 19 — 15 Questions

Question 1

An enterprise's security team is implementing a strategy to protect against 'credential stuffing' attacks — where attackers use lists of username/password combinations from previous data breaches to try to log in to the company's applications. Which authentication control most effectively mitigates this threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multi-Factor Authentication (MFA/2SV), which requires a second verification factor beyond the password that attackers don't have even when they possess the stolen credentials. Multi-Factor Authentication (MFA/2SV) is the most effective control against credential stuffing because it requires an additional verification factor (e.g., a one-time code from an authenticator app, a hardware token, or a biometric) that the attacker does not possess, even if they have valid username/password pairs from a breach. This renders the stolen credentials useless for authentication, as the attacker cannot complete the second factor challenge. In Google Cloud, this is commonly enforced via Identity Platform or Cloud Identity with security keys or TOTP.

Answer

Requiring longer, more complex passwords to make credentials harder to guess

Answer

Encrypting passwords in the company's database using bcrypt to prevent the stolen passwords from being usable

Answer

Implementing HTTPS on the login page to prevent credentials from being intercepted in transit

Question 2

A financial services company needs a managed data warehouse that can ingest streaming transaction data in real time AND support complex SQL analytics across years of historical data — all without managing any infrastructure. Which Google Cloud product meets both streaming ingest and analytical query requirements in a single serverless service?

Accepted Answer

BigQuery, which supports real-time streaming ingest via its Storage Write API and large-scale analytical SQL queries across petabytes of data in a single fully managed, serverless service. BigQuery is a fully managed, serverless data warehouse that supports real-time streaming ingest via the Storage Write API and enables complex SQL analytics across petabytes of historical data. This single service meets both requirements without any infrastructure management, unlike the other options that require separate services or manual orchestration.

Answer

Cloud Bigtable for streaming ingest and BigQuery for historical analytics — two separate services

Answer

Cloud SQL with read replicas — one instance for streaming writes, read replicas for analytical queries

Answer

Cloud Dataflow running continuously to process the stream and load to Persistent Disk for SQL queries

Question 3

A company needs to run containerized workloads but wants to avoid managing Kubernetes cluster infrastructure (node pools, cluster upgrades, node autoscaling) entirely. They want to simply deploy container images and have Google Cloud manage all underlying infrastructure automatically. Which Google Cloud product best fits this fully managed container execution requirement?

Accepted Answer

Cloud Run, which executes container images on fully managed serverless infrastructure with automatic scaling and no cluster or node management. Cloud Run is the correct choice because it provides a fully managed serverless platform that executes container images without any cluster or node management. It automatically handles scaling, infrastructure provisioning, and maintenance, aligning perfectly with the requirement to avoid managing Kubernetes cluster infrastructure entirely.

Answer

Google Kubernetes Engine (GKE) Standard mode, where the team manages node pools and cluster configuration

Answer

Compute Engine with a startup script that pulls and runs the container image from Artifact Registry

Answer

App Engine Flexible, which runs containers on managed virtual machines

Question 4

A DevOps team wants to implement a release process where a new application version is first deployed to 5% of production traffic, monitored for errors, then gradually increased to 100% if metrics remain healthy. Which deployment strategy does this describe?

Accepted Answer

Canary deployment, where a new version receives a small percentage of traffic first and is progressively rolled out as metrics confirm it is healthy. This describes a canary deployment, where the new version is initially exposed to a small subset of users (e.g., 5% of traffic) and then gradually rolled out to 100% only if key metrics (latency, error rate, CPU usage) remain within acceptable thresholds. Google Cloud's Deployment Manager and GKE support canary deployments via traffic splitting with services like Istio or native GKE ingress, allowing fine-grained control over the rollout percentage.

Answer

Blue/green deployment, where two identical environments run simultaneously and traffic is switched atomically

Answer

Rolling deployment, where instances are updated sequentially one at a time until all run the new version

Answer

Recreate deployment, where the old version is terminated before the new version is deployed

Question 5

A fashion retailer wants to use cloud to better understand customer preferences and launch trend-responsive product lines faster. Which capability most directly enables the retailer to sense market trends earlier and respond faster than competitors?

Accepted Answer

Real-time analytics on social media, search trends, and purchase signals to detect emerging preferences earlier, combined with cloud-integrated supply chain APIs for faster product launches. It directly addresses the retailer's goal of sensing market trends earlier and responding faster. Real-time analytics on social media, search trends, and purchase signals enable early detection of emerging preferences, while cloud-integrated supply chain APIs allow for rapid product launches by automating and accelerating the procurement and production processes. This combination of sensing and response capabilities is the most direct enabler of competitive advantage in trend-responsive retail.

Answer

Moving the ERP system to a cloud-hosted VM to reduce infrastructure management overhead

Answer

Training the design team on cloud-based graphic design software for faster product visualization

Answer

Storing all historical sales data in cloud object storage for cheaper archival

Question 6

A cloud team performs a quarterly review of its Compute Engine instances and discovers 15 VMs that have had zero CPU utilization for over 90 days. What is the recommended operational response to these idle resources?

Accepted Answer

Investigate whether each VM is still needed; delete confirmed unused VMs to eliminate wasted spend, potentially saving thousands per month. The recommended operational response to idle Compute Engine instances is to investigate their necessity and delete them if unused. Idle VMs with zero CPU utilization for over 90 days incur ongoing costs for persistent disks, static IPs, and other attached resources, even if the CPU is idle. Deleting confirmed unused VMs eliminates this wasted spend, potentially saving thousands per month, aligning with Google Cloud's cost optimization best practices.

Answer

Leave the VMs running in case they are needed for future workloads — storage costs are minimal for idle VMs

Answer

Upgrade the idle VMs to larger machine types so they can handle future workloads if needed

Answer

Apply committed use discounts to the idle VMs to reduce their cost while keeping them available

Question 7

A solutions architect is designing a system that must remain available even if an entire Google Cloud region becomes unavailable due to a major disaster. Which deployment approach achieves this goal?

Accepted Answer

Deploying the application across multiple Google Cloud regions so that if one region fails, other regions continue serving traffic. Deploying across multiple Google Cloud regions ensures that if an entire region becomes unavailable, traffic can be rerouted to healthy regions, achieving disaster recovery across regional failures. This approach leverages Google Cloud's global load balancing (e.g., External HTTPS Load Balancer with backend services in multiple regions) and regional managed instance groups to maintain availability even when a complete region is lost.

Answer

Deploying the application across multiple zones within the same Google Cloud region

Answer

Using a single zone but enabling automatic VM restart policies

Answer

Enabling Cloud Backup for all VMs in the deployment to allow rapid restoration after a regional failure

Question 8

A startup is building a read-heavy mobile backend. They want a database that can scale out reads without downtime. Which database service should they choose?

Accepted Answer

Cloud SQL with read replicas.. Cloud SQL with read replicas is the correct choice because it allows you to offload read traffic to one or more read replicas, scaling out reads without downtime. Read replicas are asynchronous replicas of the primary instance, and you can promote them to standalone instances if needed, making this ideal for a read-heavy mobile backend that requires high availability.

Answer

Cloud Firestore.

Answer

Cloud Spanner.

Answer

Cloud Bigtable.

Question 9

Which term best describes when an organization uses cloud-based tools (video conferencing, cloud document collaboration, project management platforms) to enable employees to work productively from any location?

Accepted Answer

Cloud-enabled distributed work / remote work — employees collaborate productively from any location using cloud tools.. The scenario explicitly describes employees using cloud-based tools (video conferencing, cloud document collaboration, project management platforms) to work productively from any location. This is the definition of cloud-enabled distributed work or remote work, where cloud infrastructure provides the connectivity, storage, and collaboration capabilities that decouple work from a fixed physical office. The key enabler is the cloud's ability to deliver real-time synchronization and access to shared resources over the internet, which is the core technical mechanism here.

Answer

Outsourcing — moving work to contractors in lower-cost locations.

Answer

Digital transformation — the company is changing its business model.

Answer

Automation — replacing human work with AI and robotics.

Question 10

A company uses committed use discounts (CUDs) for its production workload baseline. An engineer proposes also using sustained use discounts (SUDs) for the same VMs. Why is this incorrect?

Accepted Answer

CUDs and SUDs are mutually exclusive: VMs already covered by committed use discounts don't accrue sustained use discounts — you receive only the CUD, not both. Committed use discounts (CUDs) and sustained use discounts (SUDs) are mutually exclusive on the same VM. When a VM is covered by a CUD, it does not accrue SUDs; only the CUD discount is applied. This prevents double-discounting and ensures billing consistency.

Answer

CUDs and SUDs can be combined on the same VMs — applying both gives the maximum possible discount

Answer

SUDs cannot be applied to production workloads — they are only available for development environments

Answer

Applying both CUDs and SUDs creates a billing conflict that could result in Google charging the company more than on-demand pricing

Question 11

A company's security policy requires that all cloud-to-cloud communication between services must be encrypted in transit. An auditor asks how Google Cloud handles encryption for network traffic between Google services within its network. What is Google's default approach to encryption in transit within its infrastructure?

Accepted Answer

Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required. Google Cloud encrypts all network traffic between its data centers and internal services by default, using application-layer (e.g., gRPC with TLS) and link-layer encryption (e.g., MACsec or similar). This is a foundational security measure that requires no customer configuration, ensuring data is protected in transit even within Google's own infrastructure.

Answer

Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication

Answer

Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance

Answer

Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network

Question 12

A security team wants to get a comprehensive, organization-wide view of security misconfigurations (such as publicly accessible storage buckets, VMs without firewalls, and IAM overprivilege), vulnerabilities in container images, and active threats across all Google Cloud projects. Which Google Cloud service provides this unified security posture management?

Accepted Answer

Security Command Center (SCC) — unified security posture management across all GCP projects.. Security Command Center (SCC) is the correct answer because it is Google Cloud's native, unified security and risk management platform that provides continuous monitoring for misconfigurations (e.g., publicly accessible storage buckets, VMs without firewalls, IAM overprivilege), vulnerability scanning for container images, and threat detection across all projects in an organization. It aggregates findings from services like Cloud Asset Inventory, Web Security Scanner, and Event Threat Detection into a single dashboard, enabling comprehensive security posture management.

Answer

Cloud Monitoring — it detects security anomalies through metric analysis.

Answer

Cloud Audit Logs — they show all API calls that could indicate security issues.

Answer

Cloud DLP — it scans all resources for sensitive data exposure.

Question 13

A company's cloud team is asked to demonstrate that their infrastructure changes are repeatable and auditable. They use Terraform configuration files committed to a Git repository to define all cloud resources. Which operational practice does this exemplify?

Accepted Answer

Infrastructure as Code (IaC) managed through version control, providing repeatable and auditable infrastructure changes. By storing Terraform configuration files in a Git repository, the team treats infrastructure definitions as code, enabling version control, peer review, and a complete audit trail of changes. This is the core principle of Infrastructure as Code (IaC), which ensures that every infrastructure change is repeatable because the exact same configuration can be applied multiple times, and auditable because Git history records who changed what and when.

Answer

Manual change management, where each infrastructure change is recorded in a spreadsheet for audit purposes

Answer

Disaster recovery planning, using configuration files to document what needs to be rebuilt after a failure

Answer

Cost optimization, by defining infrastructure in code to enable automatic right-sizing of resources

Question 14

A startup is building a gaming application where players must see each other's moves in real time. The database storing game state must guarantee that all players see the same state simultaneously. Which consistency requirement does this impose and why does it matter for database selection?

Accepted Answer

Strong consistency is required so all players simultaneously read the same current game state; eventual consistency would create conflicting game states visible to different players. B is correct because real-time multiplayer gaming requires strong consistency to ensure all players see the identical game state simultaneously. In a GCDL context, this means the database must support ACID transactions or linearizable reads (e.g., using Google Cloud Spanner or a strongly consistent NoSQL system like Cloud Firestore in strong consistency mode). Eventual consistency would allow different players to observe different board positions, breaking the game's core requirement of a shared, current state.

Answer

Eventual consistency is sufficient; the game can show slightly stale state to some players without impact on gameplay

Answer

Consistency doesn't matter for gaming databases because games update state so frequently that any inconsistency resolves within milliseconds

Answer

The game should avoid databases entirely and use local storage on each player's device to ensure fast, consistent state access

Question 15

A company wants to optimize Cloud Storage costs for a bucket containing 100 TB of access logs. The logs from the last 7 days are frequently analyzed; logs from 8–90 days are occasionally reviewed; logs older than 90 days are archived for compliance but rarely accessed. What is the most cost-effective storage class configuration?

Accepted Answer

Configure lifecycle rules: Standard (0-7 days) → Nearline (8-90 days) → Archive (90+ days).. It aligns the storage class with the access patterns of the logs: Standard for frequently accessed recent data, Nearline for occasional access, and Archive for rarely accessed compliance data. This minimizes costs by using cheaper storage for older data while maintaining performance for active analysis. Lifecycle rules automate the transition, ensuring no manual intervention is needed.

Answer

Store all 100 TB in Standard storage for consistent access performance.

Answer

Delete all logs older than 7 days to minimize storage costs.

Answer

Store all logs in Archive storage since most are rarely accessed.