Cloud Digital Leader Practice Exam 3 — 20 Questions

Question 1

An architect is evaluating trade-offs between using Google Cloud's global network backbone for application traffic versus routing traffic over the public internet. She notes that Google's global network is one of the largest private networks in the world. What is the primary performance advantage of routing application traffic over Google's private backbone?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traffic on Google's private backbone avoids public internet congestion and variable routing, providing consistently lower latency and higher throughput for traffic between regions and to users near Google PoPs. Google's private backbone is a dedicated, software-defined network that uses Google's own fiber infrastructure and BGP routing policies to keep traffic entirely within Google's controlled environment. This avoids the unpredictable congestion, packet loss, and variable routing paths of the public internet, resulting in consistently lower latency and higher throughput for traffic between Google Cloud regions and to users near Google Points of Presence (PoPs).

Answer

Google's private backbone uses faster optical fiber than public internet service providers

Answer

Google's private backbone is free for customers while public internet egress incurs data transfer charges

Answer

Using Google's backbone eliminates the need for application-level TLS encryption because the network is inherently secure

Question 2

You are trying to create a Compute Engine VM instance and receive the error: "The resource 'projects/my-project' was not found." What is the most likely cause of the error?

Accepted Answer

The project does not exist. The error message "The resource 'projects/my-project' was not found" indicates that the specified project does not exist or the project ID is incorrect. The most likely cause is that the project does not exist.

Answer

The machine type is invalid

Answer

The zone is incorrect

Answer

The user lacks compute.instances.create permission

Question 3

A healthcare company must comply with HIPAA and store all protected health information (PHI) only in the United States. They use Google Cloud and want to prevent any accidental data storage outside the US. Which two services should they implement?

Accepted Answer

VPC Service Controls and Organization Policies. VPC Service Controls create a security perimeter around Google Cloud resources, preventing data from being copied or moved outside allowed regions. Organization Policies allow you to set a constraint (e.g., `gcp.resourceLocations`) that restricts where resources like Cloud Storage buckets or BigQuery datasets can be created, ensuring PHI remains in the US. Together, they enforce both data exfiltration prevention and location-based resource creation restrictions.

Answer

Data Loss Prevention API

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 4

An engineering team uses the `--preemptible` flag when creating an instance for a batch data processing job that runs nightly and can tolerate interruptions. What business transformation benefit does using the `--preemptible` flag provide?

Accepted Answer

Lower cost for fault-tolerant workloads, enabling more experimentation. The `--preemptible` flag creates a preemptible VM instance that can be terminated by Google Cloud at any time, typically after 24 hours, but at a significantly lower cost (up to 60-80% discount). For batch data processing jobs that run nightly and can tolerate interruptions, this cost savings directly enables more experimentation and iterative development because teams can run more jobs or larger datasets for the same budget, accelerating innovation and business transformation.

Answer

Higher reliability for critical applications

Answer

Better performance due to dedicated hardware

Answer

Enhanced security through automatic patching

Question 5

A company wants to create a customer-facing conversational AI assistant that understands natural language and can answer questions about its products, integrated into their website and mobile app. Which Google Cloud AI product is the most appropriate starting point?

Accepted Answer

Dialogflow CX, Google Cloud's managed conversational AI platform for building natural language understanding chatbots integrated into web and mobile apps. Dialogflow CX is the correct choice because it is Google Cloud's managed conversational AI platform specifically designed for building natural language understanding (NLU) chatbots that can be integrated into websites and mobile apps. It provides advanced state management, flow-based conversation design, and seamless integration with web and mobile channels, making it the most appropriate starting point for a customer-facing conversational AI assistant.

Answer

BigQuery ML, for building machine learning models on customer data to predict product recommendations

Answer

Cloud Vision API, for analyzing images to understand customer product photos

Answer

Cloud Natural Language API, for analyzing the sentiment of customer product reviews

Question 6

A company's finance team wants to understand why their cloud bills vary significantly month to month, unlike their fixed on-premises IT costs. Which fundamental cloud pricing characteristic explains this variability?

Accepted Answer

Consumption-based pricing means cloud costs scale directly with actual usage, unlike fixed on-premises costs. Cloud computing operates on a consumption-based (pay-as-you-go) pricing model, where costs are directly tied to the amount of resources consumed (e.g., compute hours, storage GB, data transfer). Unlike fixed on-premises IT costs, which are incurred regardless of actual usage (e.g., hardware depreciation, facility leases), cloud bills fluctuate as usage scales up or down. This fundamental characteristic explains the month-to-month variability observed by the finance team.

Answer

Cloud providers change their prices frequently, causing unpredictable costs

Answer

Cloud providers apply hidden fees that vary randomly each month

Answer

Cloud costs are fixed like on-premises costs; the variability must be caused by billing errors

Question 7

A team needs to process and analyze streaming data in real-time as it arrives from IoT sensors. The pipeline must apply transformations, filter events, and write results to BigQuery. Which Google Cloud service is designed for this stream processing use case?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is the correct choice because it is a fully managed, serverless service designed specifically for stream and batch data processing. It uses Apache Beam as its programming model, enabling you to apply transformations, filter events, and write results to BigQuery in real-time, exactly matching the described pipeline requirements.

Answer

Cloud Dataproc

Answer

Cloud Composer

Answer

BigQuery Streaming Insert

Question 8

A global fintech company needs a database that can handle financial transactions across 50+ countries with consistent, ACID-compliant operations, SQL queries, and automatic global replication with no downtime for maintenance. Which Google Cloud database service meets all these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that provides ACID-compliant transactions, full SQL support, and automatic synchronous global replication with no downtime for maintenance. It is designed for horizontally scalable, globally distributed applications that require strong consistency across regions, making it the ideal choice for a fintech company operating in 50+ countries.

Answer

Cloud SQL (PostgreSQL)

Answer

Cloud Bigtable

Answer

Firestore

Question 9

A media company stores video files, images, and static website assets that must be served globally with low latency. They want an object storage solution that is highly durable, accessible via standard HTTPS, and can be configured to make specific assets publicly accessible. Which Google Cloud storage product is most appropriate?

Accepted Answer

Cloud Storage, Google Cloud's object storage for unstructured data accessible via HTTPS with configurable public access. Cloud Storage is Google Cloud's object storage service designed for unstructured data such as video files, images, and static website assets. It provides global accessibility via standard HTTPS, offers 99.999999999% (11 9's) durability, and supports granular access control through IAM and ACLs, allowing specific assets to be made publicly accessible. This directly matches all the requirements in the question.

Answer

Filestore, Google Cloud's managed NFS file storage service

Answer

Persistent Disk, Google Cloud's block storage for virtual machine instances

Answer

Cloud SQL, Google Cloud's managed relational database service

Question 10

A chief digital officer is designing a transformation roadmap. She argues that cloud adoption must be accompanied by organizational changes to be effective. Which organizational change is most critical for realizing the full potential of cloud technology?

Accepted Answer

Shifting from project-based, siloed IT teams to persistent, cross-functional product teams that own services end-to-end — enabling continuous delivery and rapid iteration aligned with cloud-native operating models. Cloud-native operating models (e.g., microservices, containers, CI/CD) require persistent, cross-functional product teams that own services end-to-end. This structure enables continuous delivery, rapid iteration, and aligns with DevOps practices, which are essential for leveraging cloud elasticity and automation. Without this organizational shift, technical cloud adoption alone often fails to deliver expected agility and cost efficiencies.

Answer

Replacing all existing employees with new hires who have cloud certifications

Answer

Moving IT from a cost center to a profit center by charging business units market rates for cloud services

Answer

Outsourcing all cloud operations to a managed service provider so internal teams can focus on business strategy

Question 11

A company wants to use pre-trained Google AI models to add vision capabilities to their application — specifically to detect objects in images and extract text from scanned documents — without training their own models. Which Google Cloud APIs provide these capabilities?

Accepted Answer

Cloud Vision API for object detection and OCR; Cloud Document AI for structured document extraction.. Cloud Vision API provides pre-trained models for object detection and OCR (Optical Character Recognition) to extract text from images, while Cloud Document AI specializes in extracting structured data (e.g., fields, tables) from scanned documents. Both services require no custom training, aligning with the company's requirement to use pre-trained Google AI models.

Answer

BigQuery ML for both use cases — it trains vision models on image data stored in BigQuery.

Answer

Vertex AI AutoML Vision — train a custom model on your own images.

Answer

Cloud Natural Language API for text extraction from images.

Question 12

An enterprise wants employees to access internal web applications securely from any location (including remote work from home) without using a VPN. Employees should only access apps they're authorized for, based on their identity and device context. Which Google Cloud service enables this zero-trust access model?

Accepted Answer

Cloud Identity-Aware Proxy (IAP). Cloud Identity-Aware Proxy (IAP) is the correct service because it enforces zero-trust access by verifying a user's identity and device context before granting access to internal web applications, without requiring a VPN. It uses Google's BeyondCorp model to authenticate and authorize each request based on identity and context, allowing secure access from any location.

Answer

Cloud VPN with split tunneling for internal application access.

Answer

Cloud Armor IP allowlist to restrict access to corporate office IP ranges.

Answer

Cloud Load Balancing with SSL termination.

Question 13

A company's security team wants to control which resources on the internet can communicate with their virtual machines in Google Cloud. Which fundamental cloud networking concept provides this control?

Accepted Answer

VPC firewall rules that control inbound and outbound network traffic to VMs based on IP ranges, protocols, and ports. VPC firewall rules are the fundamental cloud networking construct that controls network traffic to and from virtual machine instances in Google Cloud. These rules operate at the network layer, filtering traffic based on source/destination IP ranges, protocols (e.g., TCP, UDP, ICMP), and port numbers, thereby governing which internet resources can communicate with the VMs.

Answer

Cloud IAM policies that grant or deny permissions for external systems to access VM resources

Answer

Cloud Storage bucket policies that restrict access to VM storage volumes

Answer

DNS records that determine which internet addresses can resolve the VM's hostname

Question 14

Which IAM component determines what actions a user is allowed to perform on a resource?

Accepted Answer

Authorization. Authorization is the IAM component that determines what an authenticated principal is allowed to do on a resource; it evaluates policies attached to users, groups, roles, and resources to allow or deny specific actions. Authentication establishes identity, while authorization decides permissions — so authorization is the correct answer.

Answer

Audit Logging

Answer

Authentication

Answer

Encryption

Question 15

A company wants to send transactional emails (receipts, password resets) and marketing emails at scale from their application. Which approach is recommended when using Google Cloud?

Accepted Answer

Integrate a third-party email delivery service (e.g., SendGrid, Mailgun) with the GCP application.. Google Cloud does not provide a native transactional email service, so integrating a dedicated third-party email delivery service like SendGrid or Mailgun is the recommended approach. These services handle deliverability, reputation management, and compliance with email standards (e.g., SPF, DKIM, DMARC), which are critical for high-volume transactional and marketing emails. Using GCP's native services like Cloud Functions or App Engine to send emails directly would rely on SMTP relays that often have strict sending limits and poor deliverability.

Answer

Use Gmail to manually send all transactional emails.

Answer

Use BigQuery to store and send emails directly to customers.

Answer

Deploy an SMTP server on Compute Engine and send emails directly from GCP IP addresses.

Question 16

A company's risk management team wants to understand Google Cloud's approach to supply chain security — specifically, how Google ensures that the hardware and firmware running in its data centers have not been tampered with. Which Google security initiative addresses hardware supply chain integrity?

Accepted Answer

Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance. Google's Titan security chip is a dedicated hardware root of trust that cryptographically verifies the boot firmware integrity and machine identity at every startup. This ensures that only Google-signed firmware runs on servers, preventing tampering during manufacturing, shipping, or deployment. Titan provides a hardware-anchored attestation chain that validates the entire supply chain from chip fabrication to rack installation.

Answer

Google uses third-party antivirus software to scan all hardware components for tampering before installation

Answer

Google relies on hardware manufacturers' security certifications to ensure supply chain integrity

Answer

Google encrypts all hardware components with AES-256 to prevent tampering

Question 17

A business user asks what makes cloud storage different from simply buying a larger external hard drive for the office. Which characteristic most clearly differentiates cloud storage from local storage devices?

Accepted Answer

Cloud storage is accessible from anywhere via the internet, scales elastically without hardware purchases, and provides built-in redundancy across multiple physical locations. Cloud storage is fundamentally different from local storage because it provides internet-based accessibility, elastic scalability without requiring hardware procurement, and built-in redundancy across geographically distributed data centers. These characteristics enable on-demand resource provisioning and high availability, which a single external hard drive cannot offer. The correct answer, B, captures these core differentiators that align with the NIST definition of cloud computing.

Answer

Cloud storage is faster than local storage for all types of data access

Answer

Cloud storage cannot be used for backup, while external hard drives are purpose-built for backup

Answer

Cloud storage requires specialized hardware on the customer's side to access data

Question 18

A company exports all their Google Cloud logs to Cloud Storage for long-term retention required by their compliance policy (7-year log retention). Which Cloud Logging feature enables routing logs to Cloud Storage?

Accepted Answer

Configure a Cloud Logging sink (log router) that routes logs to a Cloud Storage bucket.. Cloud Logging uses sinks (log routers) to export logs to supported destinations, including Cloud Storage. A sink defines a filter and a destination; when configured, it routes matching log entries to the specified Cloud Storage bucket for long-term retention. This is the only native mechanism for continuous, automated log export without custom scripting.

Answer

Cloud Logging automatically archives all logs to Cloud Storage with no configuration needed.

Answer

Enable log streaming in Cloud Storage settings to receive logs from Cloud Logging.

Answer

Use the Cloud Logging API to periodically download logs and upload them to Cloud Storage.

Question 19

A product manager wants to understand what 'latency' means for her company's cloud-hosted e-commerce application. Her developer explains that latency is critical for user experience. Which definition of latency is most accurate in this context?

Accepted Answer

Latency is the time elapsed between a user action (click, page load) and receiving the server's response — directly affecting how fast and responsive the application feels. Latency in the context of a cloud-hosted e-commerce application specifically measures the round-trip time from a user action (such as a click or page load) to the receipt of the server's response. This directly impacts perceived responsiveness and user experience, as higher latency leads to noticeable delays in interactions like adding items to a cart or checking out.

Answer

Latency is the total amount of data that can be transferred per second between the user and the application

Answer

Latency is the percentage of time the application is available versus unavailable

Answer

Latency is the number of requests the server can handle simultaneously before performance degrades

Question 20

A cloud team wants to understand their current Google Cloud resource inventory — specifically, which VMs are running in each region, their machine types, and whether they have public IP addresses. Which approach most efficiently provides this across all projects?

Accepted Answer

Use Cloud Asset Inventory to run a single org-wide query that returns all VM instances, their regions, machine types, and network configurations across all projects. Cloud Asset Inventory provides a single, unified API to query resources across all projects in an organization. By using the `gcloud asset search-all-resources` command with the `--asset-types=compute.googleapis.com/Instance` filter, you can retrieve all VM instances along with their regions, machine types, and network configurations (including public IP addresses) in one operation, without needing to access each project individually.

Answer

Log into each Google Cloud project individually through the Console and manually record VM details in a spreadsheet

Answer

Check the Cloud Billing reports, which list all resources that have incurred charges by resource type

Answer

Enable VPC flow logs in each project to capture VM network activity