Cloud Digital Leader Practice Exam 3 — 20 Questions

Question 1

A company exports all their Google Cloud logs to Cloud Storage for long-term retention required by their compliance policy (7-year log retention). Which Cloud Logging feature enables routing logs to Cloud Storage?

Accepted Answer

Configure a Cloud Logging sink (log router) that routes logs to a Cloud Storage bucket.. Cloud Logging uses sinks (log routers) to export logs to supported destinations, including Cloud Storage. A sink defines a filter and a destination; when configured, it routes matching log entries to the specified Cloud Storage bucket for long-term retention. This is the only native mechanism for continuous, automated log export without custom scripting.

Answer

Cloud Logging automatically archives all logs to Cloud Storage with no configuration needed.

Answer

Enable log streaming in Cloud Storage settings to receive logs from Cloud Logging.

Answer

Use the Cloud Logging API to periodically download logs and upload them to Cloud Storage.

Question 2

A company's monolithic application is difficult to update because any change requires testing and redeploying the entire application, causing multi-hour downtime during updates. The team is considering a microservices architecture. What is the primary benefit of microservices in this context?

Accepted Answer

Each service can be updated and deployed independently, enabling teams to release changes faster with lower risk and without full-application downtime.. Microservices architecture decomposes a monolithic application into small, independently deployable services. Each service can be updated, scaled, and deployed without affecting other services. This eliminates the 'entire-application-redeploy' problem — updating the payment service doesn't require redeploying the catalog or user management services. Cloud platforms support microservices with containers (GKE), serverless functions (Cloud Run), and managed messaging (Pub/Sub) for service communication.

Answer

Microservices always cost less than monolithic applications to run.

Answer

Microservices eliminate the need for testing because each service is small enough to be bug-free.

Answer

Microservices allow applications to run on any hardware without modification.

Question 3

After a major production outage, the engineering team conducts a review of what happened, why it happened, and how to prevent it in the future. This document is shared with all engineering teams. What is this practice called, and why does Google's SRE culture emphasize it?

Accepted Answer

Blameless postmortem — documenting the incident, root causes, and preventive actions to drive systemic learning without individual blame.. Option B is correct because a blameless postmortem is a core SRE practice that focuses on documenting incidents, root causes, and preventive actions without assigning individual blame. Google's SRE culture emphasizes this to foster psychological safety, enabling teams to openly share failures and drive systemic improvements, which is essential for maintaining high reliability in large-scale distributed systems.

Answer

Performance review — identifying which engineers caused the outage for disciplinary action.

Answer

Capacity planning review — ensuring enough servers are provisioned to prevent future outages.

Answer

Change advisory board (CAB) review — approving that the outage fix is safe to deploy.

Question 4

Google Cloud's infrastructure is designed to be highly available across multiple failure domains. What are 'availability zones' in Google Cloud, and how do they differ from 'regions'?

Accepted Answer

A region is a geographic area containing multiple isolated zones; zones have independent failure domains but low-latency connectivity within the region.. Option B is correct because in Google Cloud, a region is a specific geographic location composed of multiple zones, each of which is an isolated failure domain with independent power, cooling, and networking. Zones within the same region are connected by low-latency, high-bandwidth links, enabling high availability and fault tolerance for applications. This design ensures that a failure in one zone does not affect resources in another zone within the same region.

Answer

Zones are continents; regions are individual countries within a continent.

Answer

Zones and regions are different terms for the same thing — Google uses them interchangeably.

Answer

A zone is a global resource; a region is a local data center.

Question 5

A company's application traffic is served by a Google Cloud global HTTP load balancer. They want to understand how request traffic distributes across backend instances in different regions. Which metric best represents this distribution?

Accepted Answer

`loadbalancing/https/request_count` filtered by backend service and region.. The `loadbalancing/https/request_count` metric, when filtered by backend service and region, directly shows the number of requests handled by each regional backend. This allows you to see how traffic is distributed across regions, which is exactly what the question asks for.

Answer

`compute/instance/cpu/utilization` per instance group.

Answer

`networking/vm_flow/egress_bytes_count` per VM.

Answer

`logging/log_entry_count` filtered by region.

Question 6

A company currently uses Hadoop and Spark for batch data processing on a large on-premises cluster. They want to migrate these workloads to Google Cloud with minimal rewriting of existing Spark and Hadoop jobs. Which Google Cloud service is the best fit?

Accepted Answer

Cloud Dataproc — managed Apache Spark and Hadoop with minimal code changes.. Cloud Dataproc is a managed service for running Apache Spark and Hadoop clusters on Google Cloud. It supports the same open-source versions of Spark and Hadoop that the company currently uses, allowing them to migrate their existing batch processing workloads with minimal code changes. This makes it the best fit for the stated requirement of minimal rewriting.

Answer

Cloud Dataflow — it runs all Spark and Hadoop jobs natively.

Answer

BigQuery — it runs Spark SQL queries via BigQuery Spark stored procedures.

Answer

Google Kubernetes Engine — deploy Spark clusters on Kubernetes.

Question 7

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

Accepted Answer

Customers can schedule tours of Google data centers to verify security practices directly.. Option C is correct because Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Answer

Biometric authentication and badge access controls at multiple security perimeters.

Answer

24/7 on-site security personnel who monitor the facility continuously.

Answer

Secure hardware destruction procedures for decommissioned storage devices.

Question 8

What is the difference between a Service Level Indicator (SLI), a Service Level Objective (SLO), and a Service Level Agreement (SLA)?

Accepted Answer

SLI is the measured metric; SLO is the internal target for that metric; SLA is the contractual customer commitment.. Option B is correct because it accurately defines the relationship: an SLI is a specific metric (e.g., request latency at the 99th percentile), an SLO is the internal target for that metric (e.g., 99.9% of requests under 200ms), and an SLA is the contractual commitment to a customer (e.g., 99.9% uptime with financial penalties). This aligns with Google Cloud's Site Reliability Engineering (SRE) practices, where SLIs are measured, SLOs are internal goals, and SLAs are legal agreements.

Answer

SLI is the contract with customers; SLO is the internal target; SLA is the measurement.

Answer

SLI, SLO, and SLA are all the same thing — different names for uptime guarantees.

Answer

SLA is measured in milliseconds; SLO is measured in percentage; SLI has no unit.

Question 9

A company wants to proactively identify underutilized Compute Engine VMs (high provisioned capacity but low actual usage) to reduce costs. Which Google Cloud tool provides recommendations for right-sizing VMs?

Accepted Answer

Active Assist Recommender — ML-based VM rightsizing recommendations.. Google Cloud's Active Assist provides intelligent recommendations including VM rightsizing recommendations. These are powered by ML analysis of actual VM CPU and memory utilization over the past 8 days. The recommendations appear in the Cloud Console (Compute Engine → VM instances → Recommendations) and in the Recommender API. Rightsizing recommendations suggest optimal machine types based on observed usage, often identifying VMs that can be downsized to save significant costs.

Answer

Cloud Monitoring — set alerts for low CPU utilization.

Answer

Cloud Asset Inventory — lists all VMs and their configurations.

Answer

Cloud Billing budgets — set spending limits to prevent overspend.

Question 10

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

Accepted Answer

Access Context Manager with device policy conditions requiring managed, compliant devices.. Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Answer

Cloud Armor — it inspects device fingerprints on incoming requests.

Answer

Cloud Firewall rules that allow only corporate office IP ranges.

Answer

Two-step verification — the second factor proves the device is trusted.

Question 11

An enterprise needs advanced business intelligence capabilities: governed semantic models that business users query with natural language, embedded analytics in their customer-facing application, and centralized data access controls. Which Google Cloud analytics product is purpose-built for these enterprise BI requirements?

Accepted Answer

Looker (enterprise BI platform with LookML semantic layer). Looker is purpose-built for enterprise BI with its LookML semantic modeling layer, which governs data definitions and access controls. It supports natural language querying through Looker's 'Ask Looker' feature and enables embedded analytics via its API and SDK, directly matching the requirements for governed semantic models, natural language queries, and embedded analytics.

Answer

Looker Studio (free BI dashboards)

Answer

BigQuery — it provides natural language querying via BQML.

Answer

Vertex AI — it builds ML models that answer business questions.

Question 12

A city government deploys thousands of IoT sensors (traffic, air quality, energy usage, waste levels) and analyzes the data in real time to optimize traffic signals, dispatch waste collection vehicles proactively, and adjust street lighting automatically. What concept describes this use of cloud and IoT?

Accepted Answer

Smart city — using cloud, IoT, and AI to optimize city operations and resource utilization in real time.. A smart city uses digital technology — IoT sensors, cloud analytics, AI, and connectivity — to optimize city operations, improve resident quality of life, and use resources more efficiently. Cloud platforms receive sensor data via IoT Core or Pub/Sub, process it with Dataflow, analyze patterns with BigQuery and AI, and trigger automated responses (traffic signal changes, dispatch notifications). This is one of the most impactful applications of cloud transformation at city scale.

Answer

E-government — providing digital access to government services online.

Answer

Digital twin — creating virtual replicas of city infrastructure.

Answer

Edge computing — processing data locally at each sensor to reduce cloud bandwidth.

Question 13

A healthcare organization wants to build an application that ingests FHIR-formatted patient records from multiple hospital systems, normalizes them, and makes them queryable by clinical researchers. Which Google Cloud service is purpose-built for healthcare data interoperability?

Accepted Answer

Cloud Healthcare API with FHIR store support.. The Cloud Healthcare API with FHIR store support is purpose-built for healthcare data interoperability because it natively handles FHIR (Fast Healthcare Interoperability Resources) standards, including resource validation, versioning, and search. It provides a managed service that ingests, normalizes, and stores FHIR-formatted patient records from multiple hospital systems, enabling secure querying by clinical researchers without requiring custom ETL pipelines.

Answer

BigQuery — store FHIR JSON records and query them with SQL.

Answer

Cloud SQL — store patient records in a relational schema.

Answer

Google Forms — collect patient data directly from hospitals via web forms.

Question 14

A company uses service accounts to allow their application running on a Compute Engine VM to access Cloud Storage. Which is the most secure way to configure this service account access?

Accepted Answer

Attach the service account to the Compute Engine VM; the application obtains credentials automatically via the metadata server with no key files needed.. Option B is correct because attaching a service account to a Compute Engine VM allows the application to automatically obtain short-lived OAuth 2.0 access tokens from the instance metadata server (http://169.254.169.254). This eliminates the need to download, store, or manage any long-lived service account key files, which are a significant security risk. The metadata server provides credentials that are automatically rotated and scoped to the service account's IAM roles, making this the most secure method for accessing Cloud Storage from a VM.

Answer

Download the service account key JSON file and store it in the application's source code repository.

Answer

Grant all users the Storage Admin role so the application can access Cloud Storage through their credentials.

Answer

Create a shared service account key file accessible to all VMs via a Cloud Storage bucket.

Question 15

A company's application is called 'stateless' because it doesn't store any user session data in the application server's memory. Each request contains all necessary information. Why is statelessness important for cloud scalability?

Accepted Answer

Stateless applications can be scaled horizontally without session loss because any instance can handle any request — enabling easy addition/removal of instances.. Statelessness is critical for cloud scalability because it enables horizontal scaling: any instance can process any request without needing to recall previous interactions. Since no session data is stored locally, new instances can be added or removed dynamically without risk of session loss, allowing the application to handle fluctuating loads efficiently. This aligns with the cloud's elasticity model, where resources are provisioned on demand.

Answer

Stateless applications use less storage because they don't store any data.

Answer

Stateless applications are more secure because they don't remember who the user is.

Answer

Stateless applications eliminate the need for databases since no data is stored.

Question 16

A company's cloud costs have increased by 40% over the past quarter. The operations team wants to identify and address the root causes. Which cost optimization strategies should they investigate first?

Accepted Answer

Identify idle and underutilized resources (oversized VMs, unused disks, unattached IPs), apply lifecycle policies to storage, and commit to CUDs for stable workloads.. Option B is correct because the first step in cloud cost optimization is to identify and eliminate waste from idle or oversized resources, which is the most common source of cost inefficiency. Applying lifecycle policies to storage and committing to Committed Use Discounts (CUDs) for stable workloads are proven strategies to reduce costs without compromising performance. This approach aligns with Google Cloud's recommended FinOps practices, focusing on immediate, high-impact savings before considering architectural changes.

Answer

Immediately upgrade all infrastructure to the latest generation hardware for better efficiency.

Answer

Migrate all workloads to Spot VMs immediately to reduce costs by 90%.

Answer

Switch cloud providers to whoever has the lowest advertised list price.

Question 17

A company stores encryption keys in Cloud KMS to protect sensitive data. What does Cloud KMS provide that standard application-layer encryption does not?

Accepted Answer

Centralized key lifecycle management with IAM-controlled access, audit logs, rotation policies, and optional HSM-backed key protection.. Cloud KMS provides centralized key lifecycle management, including IAM-based access control, audit logging, automatic key rotation, and optional HSM-backed key protection. Standard application-layer encryption typically embeds keys within the application code or configuration, lacking these governance and security controls. This separation of key management from application logic is a core security best practice.

Answer

Faster encryption performance because Google's hardware is optimized for cryptographic operations.

Answer

The ability to encrypt data without any performance impact on the application.

Answer

Free unlimited encryption for all data stored in Google Cloud.

Question 18

A company's PostgreSQL database has grown to 50 TB and their application requires near-zero downtime, automatic failover, and the ability to scale reads horizontally without the migration complexity of switching to Spanner. Which Google Cloud database product is specifically designed as a fully managed, highly scalable PostgreSQL-compatible database?

Accepted Answer

AlloyDB for PostgreSQL. AlloyDB for PostgreSQL is a fully managed, PostgreSQL-compatible database service designed for high scalability, near-zero downtime, and automatic failover. It separates compute and storage to enable horizontal read scaling with read pools, and it uses a columnar engine for analytical acceleration, making it ideal for large workloads like 50 TB without the migration complexity of Spanner.

Answer

Cloud SQL (PostgreSQL)

Answer

Cloud Spanner

Answer

Bare metal PostgreSQL on Compute Engine

Question 19

Google Cloud runs its own infrastructure operations using the Site Reliability Engineering (SRE) model, which Google invented. What is the core principle that distinguishes SRE from traditional IT operations?

Accepted Answer

SRE applies software engineering principles to operations — automating toil, using quantitative SLOs, and treating reliability as an engineered system property.. Option B is correct because the core principle of SRE is applying software engineering practices to operations work. This means automating manual toil, defining quantitative Service Level Objectives (SLOs) to measure reliability, and treating reliability as an engineered property of the system — not as an afterthought. This contrasts with traditional IT operations, which often rely on manual processes and reactive troubleshooting.

Answer

SRE teams never allow production deployments to ensure maximum stability.

Answer

SRE relies entirely on external monitoring vendors to detect and respond to all incidents.

Answer

SRE means development and operations teams are separate departments that communicate only via ticketing systems.

Question 20

A Virtual Private Cloud (VPC) in Google Cloud provides network isolation. What does 'network isolation' mean in this context, and why is it important?

Accepted Answer

VPC provides a logically isolated private network where resources are separated from other customers' networks by default, preventing unauthorized cross-customer traffic.. Option B is correct because a Google Cloud VPC provides a logically isolated private network within the shared Google Cloud infrastructure. This isolation ensures that resources in one customer's VPC cannot directly communicate with resources in another customer's VPC by default, preventing unauthorized cross-customer traffic. This is achieved through software-defined networking (SDN) constructs like virtual firewalls and routing tables, not through physical separation.

Answer

Network isolation means the VPC blocks all internet access — resources cannot communicate with external services.

Answer

Network isolation means all traffic within the VPC is automatically encrypted.

Answer

A VPC requires dedicated physical hardware separate from other customers to ensure isolation.