Cloud Digital Leader Practice Test 20 — 15 Questions

Question 1

A security architect is evaluating Google Cloud's approach to securing customer data against both external attackers and potential internal Google personnel access. She identifies four distinct controls: (1) encryption at rest by default, (2) Access Transparency logs, (3) Customer-Managed Encryption Keys (CMEK), and (4) Access Approval. How do these four controls work together to provide layered data protection?

Accepted Answer

The four controls form complementary layers: default encryption protects physical storage, CMEK gives cryptographic customer control (revocable), Access Transparency provides visibility into Google personnel access, and Access Approval gives customers veto power — together addressing infrastructure attacks, insider threats, and provider access concerns. Option B is correct because these four controls form a defense-in-depth strategy for data protection on Google Cloud. Default encryption at rest secures data on physical storage, CMEK provides cryptographic control with the ability to revoke access, Access Transparency logs offer visibility into Google personnel actions, and Access Approval gives customers the ability to veto access requests. Together, they address threats from infrastructure attacks, insider threats, and provider access concerns, creating a layered security model.

Answer

All four controls are redundant and address the same threat — customers only need to enable one of them

Answer

These controls are only relevant for government or military workloads; commercial enterprises don't need this level of protection

Answer

CMEK alone provides complete data protection — the other three controls are unnecessary if customer-managed keys are in use

Question 2

Google Cloud's operations suite includes Cloud Monitoring for metrics. What is the difference between 'monitoring' and 'observability' in cloud operations?

Accepted Answer

Monitoring tracks predefined metrics and alerts on known conditions; observability is the system property enabling engineers to understand any internal state from its outputs (metrics, logs, traces).. Option B is correct because monitoring and observability are distinct concepts in cloud operations. Monitoring involves tracking predefined metrics and setting alerts for known failure conditions, while observability is a system property that allows engineers to understand any internal state by analyzing outputs like metrics, logs, and traces. In Google Cloud, Cloud Monitoring provides monitoring capabilities, but achieving true observability requires integrating Cloud Logging and Cloud Trace to explore unknown issues.

Answer

Monitoring and observability are identical terms — both describe collecting and analyzing system metrics.

Answer

Monitoring is for production; observability is for development and testing environments.

Answer

Observability only applies to AI systems; monitoring is for traditional applications.

Question 3

A company running critical applications on Google Cloud wants access to technical support with a response time under 1 hour for critical issues and a dedicated Technical Account Manager (TAM). Which Google Cloud support tier should they purchase?

Accepted Answer

Premium support. Premium support is the only Google Cloud tier that includes a dedicated Technical Account Manager (TAM) and a response time under 1 hour for critical (P1) issues. Basic and Standard support offer slower SLAs and no TAM, while Enhanced support is not a valid Google Cloud tier.

Answer

Basic support

Answer

Standard support

Answer

Enhanced support

Question 4

Match each Google Cloud service to its primary use case.

Question 5

Match each Google Cloud DevOps tool to its purpose.

Question 6

What is an API (Application Programming Interface), and why is it fundamental to cloud services and digital transformation?

Accepted Answer

An API is a standardized interface that allows software components to communicate, enabling programmatic access to cloud services and digital ecosystem integration.. Option B is correct because an API is a standardized interface (often RESTful, using HTTP methods like GET, POST, PUT, DELETE) that enables software components to communicate and exchange data. In cloud services, APIs are fundamental because they allow programmatic access to resources (e.g., AWS EC2, Azure VMs) without manual intervention, forming the backbone of automation, orchestration, and integration in digital transformation initiatives.

Answer

An API is a type of database that stores application settings.

Answer

An API is a security protocol that encrypts data between applications.

Answer

APIs are only used by large technology companies and are too complex for small businesses.

Question 7

A retail bank's branch staff currently look up customer information in disconnected systems, requiring multiple logins and manual data consolidation before advising customers. A cloud transformation project unifies customer data into a single 360° view platform accessible from any device. What type of transformation does this primarily represent?

Accepted Answer

Business process and customer experience transformation — unifying data to enable better customer service through digital tools.. Option B is correct because the project unifies fragmented customer data into a single 360° view platform accessible from any device, directly improving how staff serve customers. This is a business process and customer experience transformation, as it eliminates manual data consolidation and multiple logins, enabling faster, more personalized service through digital tools. The cloud enables this by providing a centralized data store and API-driven access, which is the core of transforming customer interactions rather than just upgrading infrastructure.

Answer

Infrastructure modernization — replacing old servers with cloud VMs.

Answer

Security transformation — reducing the number of password logins required.

Answer

Cost reduction initiative — eliminating duplicate software licenses.

Question 8

A company uses Google Workspace for identity. They want employees to use their Google Workspace credentials to access third-party applications (Salesforce, Slack, etc.) without separate passwords for each app. Which technology enables this?

Accepted Answer

Single Sign-On (SSO) using SAML 2.0 or OIDC with Google Workspace as the Identity Provider.. Option B is correct because Single Sign-On (SSO) using SAML 2.0 or OIDC allows Google Workspace to act as the Identity Provider (IdP), issuing authentication tokens that third-party applications (like Salesforce and Slack) trust. This eliminates the need for separate passwords, as users authenticate once with Google Workspace and the IdP handles subsequent access via security assertions or ID tokens.

Answer

VPN — employees connect to the corporate VPN which provides access to all apps.

Answer

Cloud Armor — blocks unauthorized access attempts to applications.

Answer

Shared service account — all employees use the same credential.

Question 9

What is the difference between RTO (Recovery Time Objective) and RPO (Recovery Point Objective) in disaster recovery planning?

Accepted Answer

RTO is the maximum acceptable downtime duration; RPO is the maximum acceptable data loss measured in time.. Option B is correct because RTO (Recovery Time Objective) defines the maximum acceptable duration of downtime after a disaster, while RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time (e.g., the age of the last backup). These are key metrics in disaster recovery planning that directly influence the choice of backup frequency, replication strategy, and failover architecture in cloud environments like GCDL.

Answer

RTO is the time to back up data; RPO is the time to restore it.

Answer

RTO and RPO are both measured in bytes — the maximum data that can be lost during recovery.

Answer

RTO is the number of replicas required; RPO is the geographic distance between backup sites.

Question 10

A data engineering team needs to orchestrate a complex data pipeline that involves multiple steps: extracting data from various sources, transforming it with Dataflow, loading it into BigQuery, and running validation jobs — all in a specific sequence with retry logic and scheduling. Which Google Cloud service manages this workflow orchestration?

Accepted Answer

Cloud Composer (managed Apache Airflow). Cloud Composer is a managed Apache Airflow service that provides workflow orchestration, including dependency management, retry logic, and scheduling for complex pipelines. It allows you to define a DAG (Directed Acyclic Graph) that sequences tasks like Dataflow extraction, BigQuery loading, and validation jobs, with built-in retry and scheduling capabilities.

Answer

Cloud Scheduler — cron-based job scheduling.

Answer

Cloud Dataflow — stream and batch processing.

Answer

Cloud Functions — event-driven function execution.

Question 11

A company is evaluating whether to use a public cloud (Google Cloud), a private cloud (on-premises VMware), or a managed private cloud (hosted single-tenant environment). Which scenario is the strongest argument for choosing a managed private cloud over a public cloud?

Accepted Answer

The company has regulatory requirements that mandate physically dedicated (single-tenant) infrastructure or strict hardware-level isolation.. Option B is correct because a managed private cloud (hosted single-tenant) provides physically dedicated infrastructure that ensures hardware-level isolation, which is often required by strict regulatory standards such as HIPAA, PCI-DSS, or FedRAMP. Public clouds like Google Cloud typically use multi-tenant architectures where multiple customers share the same physical hardware, which may not satisfy these compliance mandates. The key differentiator is the guarantee of dedicated physical resources, not just logical isolation.

Answer

The company wants to pay less for cloud services.

Answer

The company wants the fastest possible internet speeds for their applications.

Answer

The company has fewer than 10 employees and doesn't need multi-tenant scale.

Question 12

A company has multiple teams deploying to Google Cloud and wants to allocate cloud costs by team. Each team should see only their own costs and be accountable for their spending. Which Google Cloud feature enables this cost allocation and visibility?

Accepted Answer

Use separate projects per team within a folder structure, with resource labels for sub-team cost attribution.. Option B is correct because Google Cloud's resource hierarchy allows you to create separate projects per team within a folder structure, and resource labels provide granular cost attribution for sub-teams or environments. This enables each team to see only their own costs via billing export and cost breakdowns in the Cloud Billing console, ensuring accountability without manual splitting.

Answer

Create one large project for all teams and split the bill manually at month-end.

Answer

Purchase dedicated hardware for each team so costs are inherently separate.

Answer

Use Cloud Identity to create separate accounts for each team and bill separately.

Question 13

An organization's leadership sets a goal to make all future business decisions based on data rather than intuition. They migrate from siloed departmental spreadsheets to a centralized cloud data platform where all teams access the same real-time data. What organizational concept does this represent?

Accepted Answer

Data-driven decision making — using objective data analysis rather than intuition to guide business decisions.. Option B is correct because the scenario describes a shift from intuition-based decisions to decisions grounded in objective data analysis, which is the essence of data-driven decision making. The migration to a centralized cloud data platform ensures all teams access the same real-time data, eliminating silos and enabling consistent, evidence-based choices across the organization.

Answer

Data warehousing — storing historical data for reporting purposes.

Answer

Business intelligence — creating reports and dashboards.

Answer

Data governance — policies for who owns and manages data.

Question 14

What is 'infrastructure as code' (IaC), and what problem does it solve compared to manually configuring cloud resources through a web console?

Accepted Answer

IaC defines infrastructure in version-controlled code files, enabling reproducible, automated, and consistent environment provisioning versus error-prone manual console configuration.. Infrastructure as Code (IaC) is the practice of managing and provisioning cloud resources through machine-readable definition files (e.g., YAML, JSON, HCL) rather than through manual processes like clicking in a web console. The core problem it solves is eliminating the error-prone, inconsistent, and non-reproducible nature of manual configuration by enabling version-controlled, automated, and repeatable deployments. Tools like Terraform, AWS CloudFormation, and Azure Resource Manager (ARM) templates are common IaC implementations that enforce desired state configuration and drift detection.

Answer

IaC is a programming language specifically for writing cloud applications.

Answer

IaC is a tool that automatically discovers and documents existing cloud infrastructure.

Answer

IaC requires writing custom Python scripts for every cloud resource type.

Question 15

A web application's homepage loads user-specific data (shopping cart, recent orders) on every visit. The data changes frequently. An engineer suggests caching this data in a Redis cache between the web tier and the database. What is the primary benefit of this caching layer?

Accepted Answer

Caching reduces database load and improves response times by serving frequently accessed data from fast in-memory storage.. Option B is correct because caching user-specific data like shopping carts and recent orders in Redis reduces the load on the primary database by serving frequently accessed data from fast in-memory storage. This improves response times for the web application, as Redis can deliver data in microseconds compared to the millisecond latency of a typical relational database query. The caching layer acts as a temporary, high-speed buffer that offloads read-heavy traffic from the database, which is especially beneficial for data that changes frequently but is read often.

Answer

Caching encrypts data in transit between the web tier and database.

Answer

Caching permanently stores user data so the database can be deleted.

Answer

Caching automatically synchronizes data between multiple database replicas.