Cloud Digital Leader Practice Test 19 — 15 Questions

Question 1

A company is moving its financial reporting application to Google Cloud. The CFO asks: 'If Google Cloud experiences a data breach and our financial data is exposed, who is financially liable?' How should the cloud architect answer this question?

Accepted Answer

Liability depends on where the breach originated: Google is responsible for failures in its infrastructure security; the customer is responsible for breaches resulting from misconfiguration, application vulnerabilities, or inadequate access controls in areas under their responsibility. Option B is correct because the Google Cloud Shared Responsibility Model explicitly delineates liability: Google is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor, network controls), while the customer is responsible for security in the cloud (e.g., IAM policies, application code, data encryption). In a breach, liability is determined by where the failure occurred—if Google’s infrastructure (e.g., GKE node isolation) fails, Google bears liability; if the customer misconfigures a Cloud Storage bucket or leaves a Compute Engine firewall open, the customer bears liability. This aligns with the CFO’s question about financial liability, which is not absolute but contingent on the breach’s origin.

Answer

Google Cloud bears full financial liability for all data breaches involving customer data on its platform

Answer

The customer bears all liability for any breach because they chose to use cloud services

Answer

No party is liable because data breaches in cloud are force majeure events similar to natural disasters

Question 2

A government digital transformation initiative aims to make citizen services available online 24/7. A project manager notes that the technical implementation is proceeding well but citizen adoption remains low. Which dimension of digital transformation has the initiative overlooked?

Accepted Answer

The initiative overlooked user-centered design, accessibility, digital literacy support, and citizen trust-building — critical dimensions of public sector digital transformation beyond technical delivery. Option B is correct because digital transformation in the public sector requires more than just technical deployment; it demands user-centered design, accessibility compliance (e.g., WCAG 2.1), digital literacy programs, and trust-building mechanisms. Without these, even a fully functional cloud-based platform will fail to achieve adoption, as citizens may lack the skills, confidence, or ability to use the service.

Answer

The government should have used a different cloud provider with better uptime guarantees

Answer

The government needs to force citizens to use online services by removing all in-person service options

Answer

The initiative should have started with machine learning features before launching basic services

Question 3

An organization's Chief Digital Officer is building a case for cloud investment by framing it in terms of 'cloud as a strategic asset rather than a cost center.' Which argument most strongly supports this framing?

Accepted Answer

Cloud enables new revenue streams, faster product launches, data-driven competitive differentiation, and innovation capabilities that directly drive business growth — making cloud investment as strategic as R&D or customer acquisition. Option B is correct because it directly aligns with the framing of 'cloud as a strategic asset' by highlighting how cloud computing enables new revenue streams, faster product launches, data-driven differentiation, and innovation — all of which drive business growth. This contrasts with viewing cloud purely as a cost center, as it emphasizes competitive advantage and long-term value creation, similar to R&D or customer acquisition investments.

Answer

Cloud reduces data center costs, making IT a more efficient cost center rather than a business liability

Answer

Cloud is always less expensive than on-premises, so it should be viewed as a cost-savings program rather than a strategic investment

Answer

Cloud providers assume liability for all security breaches, making cloud a risk-reduction tool rather than a strategic enabler

Question 4

An architect is evaluating trade-offs between using Google Cloud's global network backbone for application traffic versus routing traffic over the public internet. She notes that Google's global network is one of the largest private networks in the world. What is the primary performance advantage of routing application traffic over Google's private backbone?

Accepted Answer

Traffic on Google's private backbone avoids public internet congestion and variable routing, providing consistently lower latency and higher throughput for traffic between regions and to users near Google PoPs. Option B is correct because Google's private backbone is a dedicated, software-defined network that uses Google's own fiber infrastructure and BGP routing policies to keep traffic entirely within Google's controlled environment. This avoids the unpredictable congestion, packet loss, and variable routing paths of the public internet, resulting in consistently lower latency and higher throughput for traffic between Google Cloud regions and to users near Google Points of Presence (PoPs).

Answer

Google's private backbone uses faster optical fiber than public internet service providers

Answer

Google's private backbone is free for customers while public internet egress incurs data transfer charges

Answer

Using Google's backbone eliminates the need for application-level TLS encryption because the network is inherently secure

Question 5

A company's DevOps team wants to orchestrate a complex workflow that involves calling multiple Google Cloud APIs in sequence — first running a Cloud Build job, then checking the results, then either deploying to Cloud Run or sending a notification. Which Google Cloud product is designed for orchestrating multi-step workflow logic?

Accepted Answer

Google Cloud Workflows, which orchestrates multi-step processes by calling APIs in sequence with conditional logic, error handling, and state management. Google Cloud Workflows is the correct choice because it is a fully managed orchestration platform specifically designed to define multi-step workflows that call Google Cloud APIs and external services in sequence. It supports conditional logic (e.g., if-then-else), error handling (e.g., retries with exponential backoff), and state management, making it ideal for the described scenario of running a Cloud Build job, checking results, and conditionally deploying to Cloud Run or sending a notification.

Answer

Cloud Scheduler, which triggers a series of jobs at specified cron intervals

Answer

Cloud Pub/Sub, by publishing messages between pipeline stages to trigger each subsequent step

Answer

Cloud Run, by writing the orchestration logic as a container application that calls other services sequentially

Question 6

A security team is conducting a threat model for their Google Cloud environment. They identify 'insider threat' — a malicious authorized employee who intentionally exfiltrates or destroys data — as a key risk. Which combination of Google Cloud controls most effectively mitigates this risk?

Accepted Answer

Least privilege IAM (limiting access to only necessary resources), comprehensive audit logging (detecting anomalous access), VPC Service Controls (preventing data exfiltration to external projects), and separation of duties for critical actions. Option B is correct because it combines least privilege IAM to limit the blast radius, comprehensive audit logging (e.g., Cloud Audit Logs) to detect anomalous access patterns, VPC Service Controls to prevent data exfiltration via VPC perimeter enforcement, and separation of duties (e.g., using Cloud IAM Conditions) to ensure no single insider can perform critical actions alone. This layered defense addresses both prevention and detection of malicious insider activity.

Answer

Strong external firewall rules, because insider threats come from internal network actors who must be blocked at the perimeter

Answer

Encrypting all data at rest with CMEK, since encryption prevents authorized users from reading data

Answer

Requiring all employees to pass annual security training to prevent insider threats

Question 7

A consulting firm advises a client that their digital transformation strategy must include 'ecosystem thinking.' What does this mean in the context of cloud and digital transformation?

Accepted Answer

Digital transformation should include building open API platforms and partner integrations that create network effects — where the company's value grows as more participants (developers, partners, customers) join and contribute. Ecosystem thinking in cloud and digital transformation means designing platforms that leverage open APIs and partner integrations to create network effects. As more developers, partners, and customers connect to the platform, the overall value of the service increases exponentially, which is a core driver of cloud-native business models like those used by AWS, Salesforce, or Stripe.

Answer

The company should only use cloud services from a single provider to maximize integration within that provider's ecosystem

Answer

The company should focus on eliminating all external dependencies by building all capabilities internally on cloud infrastructure

Answer

Ecosystem thinking refers to the environmental sustainability of cloud infrastructure, including renewable energy usage

Question 8

A company uses committed use discounts (CUDs) for its production workload baseline. An engineer proposes also using sustained use discounts (SUDs) for the same VMs. Why is this incorrect?

Accepted Answer

CUDs and SUDs are mutually exclusive: VMs already covered by committed use discounts don't accrue sustained use discounts — you receive only the CUD, not both. Option B is correct because committed use discounts (CUDs) and sustained use discounts (SUDs) are mutually exclusive on the same VM. When a VM is covered by a CUD, it does not accrue SUDs; only the CUD discount is applied. This prevents double-discounting and ensures billing consistency.

Answer

CUDs and SUDs can be combined on the same VMs — applying both gives the maximum possible discount

Answer

SUDs cannot be applied to production workloads — they are only available for development environments

Answer

Applying both CUDs and SUDs creates a billing conflict that could result in Google charging the company more than on-demand pricing

Question 9

A non-profit organization with limited IT staff wants to use cloud to improve its fundraising and donor management without hiring technology specialists. Which type of cloud service model is most appropriate for this organization's need?

Accepted Answer

Software as a Service (SaaS), where a fully managed donor management application is subscribed to and used without any infrastructure management. Software as a Service (SaaS) is the most appropriate model because it provides a fully managed, ready-to-use donor management application over the internet. The organization's limited IT staff can simply subscribe and use the software without provisioning servers, installing applications, or managing infrastructure, directly addressing the need to avoid hiring technology specialists.

Answer

Infrastructure as a Service (IaaS), where the organization provisions VMs and installs donor management software

Answer

Platform as a Service (PaaS), where the organization deploys custom-built donor management code

Answer

Private cloud, where the organization builds its own cloud infrastructure for complete data control

Question 10

A company's cloud spending suddenly spikes by 300% for one week before returning to normal. The cloud team investigates and finds a developer accidentally left a large cluster of VMs running over the weekend. Which cloud financial management practice most effectively prevents this type of unexpected cost spike?

Accepted Answer

Setting Cloud Billing budget alerts that notify stakeholders when spending approaches defined thresholds, enabling early detection and response to abnormal spending patterns. Option B is correct because Cloud Billing budget alerts provide real-time notifications when spending exceeds defined thresholds, enabling the cloud team to detect and respond to the 300% spike immediately rather than after the fact. This proactive monitoring directly addresses the root cause—unexpected resource usage—by alerting stakeholders while the VMs are still running, allowing them to shut down the cluster and prevent further cost accumulation.

Answer

Requiring all cloud resource creation to go through a central IT approval process to prevent accidental VM creation

Answer

Reviewing cloud bills at the end of each month to identify cost anomalies and address them retroactively

Answer

Using Reserved Instances for all VM workloads to reduce per-hour costs, making accidental long-running VMs less expensive

Question 11

An SRE team is practicing 'chaos engineering' by simulating a zone-level failure in their staging environment. They find that their application does not automatically recover — traffic is not redirected and the service remains down. What architectural component is most likely missing?

Accepted Answer

A load balancer with health checks across multiple zones is most likely missing — without it, there is no mechanism to detect the zone failure and automatically redirect traffic to healthy instances in surviving zones. In a zone-level failure, traffic cannot be redirected to healthy instances in surviving zones without a load balancer that performs health checks across multiple zones. Google Cloud's external or internal load balancers (e.g., HTTP(S) Load Balancer, TCP/UDP Network Load Balancer) use health checks to detect unhealthy instances and automatically route traffic only to healthy backends. Without this component, the application has no mechanism to detect the zone failure and reroute traffic, leaving the service down.

Answer

The application needs more replicas in the failing zone to survive the failure

Answer

The application needs a larger machine type to handle the full traffic load without the failed zone's capacity

Answer

Cloud Monitoring alerts need to be configured to notify the team when a zone fails, enabling manual traffic redirection

Question 12

A company's application stores sensitive customer information in Cloud Storage. A security audit finds that one bucket has 'allUsers' access granted (making it publicly accessible on the internet). The security team wants to prevent this from happening in the future. Which control prevents public access from being granted to Cloud Storage buckets?

Accepted Answer

Apply the 'storage.publicAccessPrevention' organization policy constraint, which prevents allUsers and allAuthenticatedUsers from being granted in Cloud Storage IAM policies organization-wide. Option B is correct because the 'storage.publicAccessPrevention' organization policy constraint is a Google Cloud IAM constraint that, when enforced at the organization, folder, or project level, prevents any IAM policy binding that grants access to 'allUsers' or 'allAuthenticatedUsers' on Cloud Storage buckets. This is a preventive control that blocks the action before it can occur, directly addressing the security team's requirement to prevent public access from being granted in the future.

Answer

Enable Cloud Armor on all Cloud Storage buckets to block public internet access

Answer

Enable VPC Service Controls around Cloud Storage to prevent public internet access

Answer

Configure Cloud Monitoring to alert the security team when a bucket is made public so they can revert it

Question 13

A company runs a mission-critical PostgreSQL database on Google Cloud that must support automatic failover to a standby instance within 60 seconds if the primary instance fails, with minimal data loss. Which Cloud SQL configuration satisfies this high availability requirement?

Accepted Answer

Cloud SQL High Availability configuration with a synchronously replicated standby instance that automatically promotes to primary within approximately 60 seconds of primary failure. Option B is correct because Cloud SQL's High Availability (HA) configuration uses a synchronous replication mechanism between the primary and standby instances. This ensures that transactions are committed on both instances before being acknowledged, meeting the requirement for minimal data loss. In the event of a primary failure, the standby is automatically promoted to primary within approximately 60 seconds, satisfying the failover time requirement.

Answer

Cloud SQL with automated daily backups, restoring from backup if the primary fails

Answer

Cloud SQL read replicas in another region, manually promoted if the primary fails

Answer

Running a self-managed PostgreSQL cluster on Compute Engine VMs with a custom pacemaker/corosync HA setup

Question 14

A retail bank is building a partnership with a fintech startup. The bank provides regulated financial services infrastructure and customer reach; the fintech provides innovative digital experiences. Which cloud architectural pattern most naturally enables this kind of bank-fintech partnership?

Accepted Answer

An API-first Open Banking architecture where the bank exposes regulated capabilities (accounts, payments, KYC) through managed APIs that the fintech builds innovative experiences on top of. Option B is correct because an API-first Open Banking architecture allows the bank to expose regulated capabilities (e.g., account information, payment initiation, KYC verification) through managed, secure APIs. The fintech can then build innovative digital experiences on top of these APIs without direct access to the bank's core systems, ensuring compliance, security, and loose coupling. This pattern aligns with PSD2 and Open Banking standards, enabling partnership without compromising regulatory control.

Answer

Giving the fintech startup direct database access to the bank's customer records system for maximum data sharing

Answer

The bank should acquire the fintech startup and consolidate all technology onto the bank's legacy infrastructure

Answer

The fintech should build all required banking infrastructure independently to avoid dependency on the bank's legacy systems

Question 15

A company wants to migrate its existing on-premises virtual machines (VMware VMs) to Google Cloud with minimal changes to the operating system and applications. Which Google Cloud product is specifically designed for migrating on-premises VMs to Google Cloud with minimal modification?

Accepted Answer

Migrate to Virtual Machines (formerly Velostrata), which migrates on-premises VMware VMs to Compute Engine with minimal modification and downtime. Migrate to Virtual Machines (formerly Velostrata) is the correct choice because it is specifically designed to migrate on-premises VMware VMs to Compute Engine with minimal modification to the OS and applications. It uses a streaming migration approach that moves the VM's disk state incrementally while keeping the VM running, resulting in minimal downtime and no need to re-architect the workloads.

Answer

Cloud Dataflow, by streaming data from on-premises VMs to Google Cloud storage

Answer

Anthos, by registering on-premises Kubernetes clusters with Google Cloud's management plane

Answer

Cloud Storage Transfer Service, by copying VM disk images from on-premises storage to Cloud Storage