Cloud Digital Leader Practice Exam 2 — 20 Questions

Question 1

A CISO is evaluating Google Cloud's security posture and asks about independent third-party validation of Google's security practices. Which types of certifications and audit reports most directly provide this independent assurance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Third-party audit certifications such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP, which independently verify that Google's security controls meet defined international and industry standards. Independent third-party validation of Google Cloud's security posture is most directly provided by certifications and audit reports such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP. These are issued by accredited external auditors who verify that Google's security controls, processes, and infrastructure meet rigorous, internationally recognized standards. This gives customers objective assurance beyond Google's own claims.

Answer

Google's internal security policies and self-assessment reports published on its website

Answer

Google's Bug Bounty program, which shows that the public can report security vulnerabilities

Answer

Customer testimonials from large enterprises that use Google Cloud for sensitive workloads

Question 2

A multinational company must ensure that personal data of European citizens stored in Google Cloud cannot be accessed by or transferred to systems outside the European Union, as required by GDPR data residency requirements. Which Google Cloud controls most directly enforce this?

Accepted Answer

Configuring organization policy to restrict resource creation to EU regions, using VPC Service Controls to prevent data movement outside the EU perimeter, and establishing a GDPR-compliant Data Processing Agreement with Google. It combines three essential controls that directly enforce GDPR data residency: Organization Policies restrict resource creation to EU regions, VPC Service Controls create a data perimeter preventing exfiltration outside the EU, and a GDPR-compliant Data Processing Agreement (DPA) establishes the legal framework for data handling. These controls work together to ensure data at rest and in transit remains within the EU boundary, directly addressing the residency requirement.

Answer

Enabling HTTPS for all data transmission to ensure data is encrypted during transfer

Answer

Using Customer-Managed Encryption Keys (CMEK) where the encryption keys are stored outside Google's infrastructure

Answer

Training developers about GDPR requirements and requiring manual approval for any cross-region data transfers

Question 3

A security team is reviewing a developer's request to be granted the 'Owner' role on a production Google Cloud project 'just in case they need broad access.' The security team rejects this and instead grants a more specific role. Which security principle does the security team's decision enforce?

Accepted Answer

Principle of least privilege, by granting only the minimum permissions necessary for the developer's specific role and tasks. The security team's decision to reject the overly broad 'Owner' role and grant a more specific role directly enforces the principle of least privilege. This principle dictates that users should be granted only the minimum permissions necessary to perform their job functions, reducing the risk of accidental or malicious misuse of elevated access. In Google Cloud, this is implemented by assigning predefined or custom IAM roles with precisely scoped permissions rather than broad roles like Owner.

Answer

Defense in depth, by ensuring multiple security layers protect the project

Answer

Separation of duties, by ensuring no single person has too many responsibilities

Answer

Zero trust networking, by treating the developer's device as untrusted

Question 4

A healthcare company needs to store patient data in Google Cloud and must comply with HIPAA (Health Insurance Portability and Accountability Act). Which statement correctly describes how Google Cloud helps them achieve HIPAA compliance?

Accepted Answer

Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.. Google Cloud provides HIPAA-eligible services and offers a Business Associate Agreement (BAA) to covered entities, but compliance is a shared responsibility. Customers must configure their own technical safeguards, such as access controls, audit logging, and encryption key management, to meet HIPAA requirements. Google Cloud does not automatically make an application compliant; the customer must implement the necessary controls.

Answer

Storing data in Google Cloud automatically makes an application HIPAA-compliant.

Answer

HIPAA compliance is impossible on public cloud; healthcare data must stay on-premises.

Answer

Google Cloud's automatic data encryption fully satisfies all HIPAA technical safeguard requirements.

Question 5

A company has a Google Cloud environment with 50 projects and 200 engineers. The security team wants to ensure that a new security policy — requiring all Cloud Storage buckets to have uniform bucket-level access enabled — applies to all existing and future buckets across all projects. Which approach scales to the entire organization?

Accepted Answer

Apply an Organization Policy constraint ('storage.uniformBucketLevelAccess') at the organization level to enforce the setting automatically across all current and future projects and buckets. Organization Policy constraints, such as `storage.uniformBucketLevelAccess`, are enforced at the organization level and automatically apply to all existing and future projects and resources within the organization. This ensures uniform compliance without manual intervention, scaling seamlessly across 50 projects and 200 engineers.

Answer

Send an email to all 200 engineers explaining the policy and asking them to manually enable uniform bucket-level access on their buckets

Answer

Create a Cloud Function that checks bucket configurations hourly and enables uniform access on non-compliant buckets

Answer

Grant the security team Owner access to all 50 projects so they can manually enforce the policy in each project

Question 6

A company wants to expose its internal backend services to external partners through a managed API layer that handles authentication, rate limiting, traffic management, and analytics — without modifying the underlying services. Which Google Cloud product is designed for this API management use case?

Accepted Answer

Apigee, Google Cloud's full-featured enterprise API management platform for authentication, rate limiting, analytics, and developer portal without modifying backend services. Apigee is Google Cloud's full-featured enterprise API management platform designed to expose backend services to external partners without requiring modifications to those services. It provides built-in authentication, rate limiting, traffic management, and analytics, along with a developer portal for partner onboarding. This makes it the correct choice for the described use case.

Answer

Cloud Load Balancing, which distributes API requests across backend instances

Answer

Cloud Endpoints, a lighter-weight API gateway for Google Cloud-hosted APIs

Answer

Cloud Armor, Google Cloud's web application firewall and DDoS protection service

Question 7

A software team wants to host their container images securely within Google Cloud and integrate with Cloud Build for CI/CD pipelines and GKE for deployments. Which Google Cloud product serves as the managed repository for storing and managing container images?

Accepted Answer

Artifact Registry, Google Cloud's managed repository for container images and build artifacts with native CI/CD integration. Artifact Registry is Google Cloud's fully managed, next-generation repository for storing, managing, and securing container images and build artifacts. It natively integrates with Cloud Build for CI/CD pipelines and GKE for deployments, providing features like vulnerability scanning, access control via IAM, and support for multiple formats (Docker, Maven, npm, etc.). This makes it the correct choice for the team's requirements.

Answer

Cloud Storage, by storing container images as objects in a bucket

Answer

Container Registry (gcr.io), the legacy Google container image service

Answer

Cloud Source Repositories, for storing source code and container build files

Question 8

An operations team wants to receive an automated alert when their web application's HTTP error rate exceeds 5% for more than 5 minutes. Which Google Cloud product is used to configure this type of metric-based alert?

Accepted Answer

Cloud Monitoring, by creating an alerting policy on the HTTP error rate metric with a 5-minute evaluation window and notification channel. Cloud Monitoring is the correct service because it is purpose-built for creating alerting policies based on metrics like HTTP error rates. You can define a condition that triggers when the error rate exceeds 5% for a specified evaluation window (e.g., 5 minutes) and route the alert through a notification channel (e.g., email, Slack). This directly matches the requirement for a metric-based alert with a time-based threshold.

Answer

Cloud Logging, by configuring a log-based metric and email notification

Answer

Cloud Trace, by setting a trace sampling threshold for error requests

Answer

Security Command Center, by configuring a finding for high error rates

Question 9

A company wants to use computing resources over the internet without managing physical servers. The cloud provider manages the underlying hardware and virtualization, while the company manages the operating system, middleware, and applications. Which cloud service model does this describe?

Accepted Answer

Infrastructure as a Service (IaaS). This scenario describes Infrastructure as a Service (IaaS) because the cloud provider manages the physical hardware and virtualization layer, while the customer retains control over the operating system, middleware, and applications. In IaaS, the provider offers virtualized computing resources (e.g., virtual machines, storage, networks) via APIs or dashboards, and the customer is responsible for OS patches, application configuration, and middleware management. This matches the given split of responsibilities exactly.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 10

Google Cloud runs its own infrastructure operations using the Site Reliability Engineering (SRE) model, which Google invented. What is the core principle that distinguishes SRE from traditional IT operations?

Accepted Answer

SRE applies software engineering principles to operations — automating toil, using quantitative SLOs, and treating reliability as an engineered system property.. The core principle of SRE is applying software engineering practices to operations work. This means automating manual toil, defining quantitative Service Level Objectives (SLOs) to measure reliability, and treating reliability as an engineered property of the system — not as an afterthought. This contrasts with traditional IT operations, which often rely on manual processes and reactive troubleshooting.

Answer

SRE teams never allow production deployments to ensure maximum stability.

Answer

SRE relies entirely on external monitoring vendors to detect and respond to all incidents.

Answer

SRE means development and operations teams are separate departments that communicate only via ticketing systems.

Question 11

What is the key difference between a virtual machine (VM) and a container in terms of how they package and run applications?

Accepted Answer

VMs include a full guest OS; containers share the host OS kernel and contain only the application and its dependencies.. The key difference is that a virtual machine (VM) includes a full guest operating system (OS) running on top of a hypervisor, which virtualizes the underlying hardware. In contrast, a container packages only the application and its dependencies (libraries, binaries, configuration files) and shares the host OS kernel via the container runtime (e.g., Docker, containerd). This makes containers lightweight and faster to start, as they avoid the overhead of a separate OS instance.

Answer

VMs run on physical hardware; containers run in the cloud.

Answer

Containers are less secure than VMs because they share hardware.

Answer

VMs are only for Linux applications; containers support all operating systems.

Question 12

A security architect wants to implement a 'never trust, always verify' security approach where no user or service is assumed to be trustworthy based on network location alone. Every access request must be authenticated and authorized regardless of whether it comes from inside or outside the corporate network. Which security model describes this approach?

Accepted Answer

Zero Trust security model. The Zero Trust security model (Option B) is correct because it explicitly enforces the 'never trust, always verify' principle, requiring authentication and authorization for every access request regardless of network location. In Google Cloud, this aligns with BeyondCorp, which uses identity-aware proxy (IAP) and context-aware access to verify each request based on user identity, device posture, and other attributes, rather than trusting based on IP address or network perimeter.

Answer

Perimeter security model

Answer

Defense in depth model

Answer

Principle of least privilege

Question 13

A company wants to migrate its existing on-premises virtual machines (VMware VMs) to Google Cloud with minimal changes to the operating system and applications. Which Google Cloud product is specifically designed for migrating on-premises VMs to Google Cloud with minimal modification?

Accepted Answer

Migrate to Virtual Machines (formerly Velostrata), which migrates on-premises VMware VMs to Compute Engine with minimal modification and downtime. Migrate to Virtual Machines (formerly Velostrata) is the correct choice because it is specifically designed to migrate on-premises VMware VMs to Compute Engine with minimal modification to the OS and applications. It uses a streaming migration approach that moves the VM's disk state incrementally while keeping the VM running, resulting in minimal downtime and no need to re-architect the workloads.

Answer

Cloud Dataflow, by streaming data from on-premises VMs to Google Cloud storage

Answer

Anthos, by registering on-premises Kubernetes clusters with Google Cloud's management plane

Answer

Cloud Storage Transfer Service, by copying VM disk images from on-premises storage to Cloud Storage

Question 14

A company has a requirement from their security auditor to demonstrate that all administrative actions performed in Google Cloud (such as creating VMs, modifying IAM policies, and deleting storage buckets) are logged and tamper-evident. Which Cloud Logging log type fulfills this requirement?

Accepted Answer

Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.. Admin Activity audit logs are always-on, tamper-resistant logs that record all administrative API calls, such as creating VMs, modifying IAM policies, and deleting storage buckets. They cannot be disabled or modified by users, ensuring tamper-evident logging for security auditor requirements.

Answer

Data Access audit logs — they capture all read and write operations.

Answer

System Event audit logs — they capture all Google Cloud operations.

Answer

Cloud Monitoring logs — they track all changes to monitored resources.

Question 15

A company's production database is running on a Compute Engine VM with a 500 GB Persistent Disk. The operations team wants to create a backup they can restore from in case of data corruption or accidental deletion. Which Google Cloud capability provides point-in-time backup for Persistent Disks?

Accepted Answer

Persistent Disk Snapshots, which capture the disk state at a point in time and enable restoration or creation of new disks from that snapshot. Persistent Disk Snapshots are the correct Google Cloud feature for creating point-in-time backups of Persistent Disks. They capture the disk's data and configuration at a specific moment, allowing you to restore the disk or create new disks from that snapshot. This is the native, recommended method for backup and disaster recovery of Compute Engine VM disks.

Answer

Cloud Storage bucket replication, by continuously copying the database files to a storage bucket

Answer

Cloud SQL automated backups, which protect databases running on Compute Engine VMs

Answer

VM live migration, which moves the running VM between physical hosts, automatically creating a backup in the process

Question 16

A startup is building a web application and wants to protect it from common web attacks like SQL injection and cross-site scripting. Which Google Cloud product provides web application firewall (WAF) capabilities?

Accepted Answer

Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks. Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.

Answer

Cloud Firewall, which controls network-level traffic based on IP and port rules

Answer

VPC Service Controls, which prevent data exfiltration from Google Cloud services

Answer

Security Command Center, which detects security misconfigurations across Google Cloud resources

Question 17

A product team is discussing how to handle a planned 48-hour maintenance window for a critical customer-facing service. The SRE team argues the maintenance window is unnecessary with proper cloud architecture. Which cloud capability eliminates the need for planned downtime maintenance windows?

Accepted Answer

Zero-downtime deployment strategies like rolling updates and blue/green deployments, combined with cloud live migration for infrastructure maintenance. Cloud platforms like Google Cloud support zero-downtime deployment strategies (rolling updates, blue/green deployments) and live migration for infrastructure maintenance. Live migration transparently moves running VMs between hosts without interrupting the OS or applications, while blue/green deployments allow traffic to be switched to a fully updated environment before the old one is taken down. Together, these capabilities eliminate the need for planned downtime maintenance windows entirely.

Answer

Longer maintenance windows scheduled during off-peak hours to minimize customer impact

Answer

Notifying customers in advance of the maintenance window and offering service credits for the downtime

Answer

Backing up all data before the maintenance window to ensure recovery if something goes wrong

Question 18

A Virtual Private Cloud (VPC) in Google Cloud provides network isolation. What does 'network isolation' mean in this context, and why is it important?

Accepted Answer

VPC provides a logically isolated private network where resources are separated from other customers' networks by default, preventing unauthorized cross-customer traffic.. A Google Cloud VPC provides a logically isolated private network within the shared Google Cloud infrastructure. This isolation ensures that resources in one customer's VPC cannot directly communicate with resources in another customer's VPC by default, preventing unauthorized cross-customer traffic. This is achieved through software-defined networking (SDN) constructs like virtual firewalls and routing tables, not through physical separation.

Answer

Network isolation means the VPC blocks all internet access — resources cannot communicate with external services.

Answer

Network isolation means all traffic within the VPC is automatically encrypted.

Answer

A VPC requires dedicated physical hardware separate from other customers to ensure isolation.

Question 19

A data analyst at a media company needs to run complex SQL queries on petabytes of user engagement data to produce weekly reports. The dataset is stored in Google Cloud. Which Google Cloud product is purpose-built for this type of large-scale analytical SQL workload?

Accepted Answer

BigQuery, Google Cloud's serverless data warehouse for petabyte-scale analytical SQL. BigQuery is Google Cloud's serverless, highly scalable data warehouse specifically designed for petabyte-scale analytical SQL queries. It separates compute from storage and uses a columnar storage format and a distributed query engine to execute complex SQL on massive datasets without provisioning infrastructure, making it the ideal choice for the described workload.

Answer

Cloud SQL, Google Cloud's managed relational database service

Answer

Cloud Bigtable, Google's NoSQL wide-column database

Answer

Firestore, Google Cloud's serverless NoSQL document database

Question 20

A company wants to enable its developers to write and run code in various programming languages (Python, Node.js, Go) without provisioning or managing any servers. The code should execute in response to HTTP requests. Which Google Cloud product is designed for this serverless, function-level execution model?

Accepted Answer

Cloud Functions, which executes code functions in response to events or HTTP requests with no server management required. Cloud Functions is the correct choice because it is Google Cloud's event-driven, serverless compute platform that allows developers to write and deploy single-purpose functions in languages like Python, Node.js, and Go. These functions automatically scale and execute in response to HTTP triggers (e.g., HTTP requests) without any server provisioning or management, directly matching the requirement for a function-level execution model.

Answer

Compute Engine, which provides virtual machines for running code in any language

Answer

Cloud SQL, which runs SQL queries in response to HTTP requests

Answer

Persistent Disk, which stores code that can be executed on demand