Cloud Digital Leader Practice Exam 4 — 20 Questions

Question 1

A company uses Google Cloud across 5 teams, 20 projects, and 3 regions. They want to enforce a standard that all resources include specific labels (e.g., `team`, `environment`, `cost-center`) for cost attribution and governance. What is the most scalable way to enforce this labeling standard?

Accepted Answer

Enforce labeling through IaC templates with required label variables in CI/CD pipelines, and use Cloud Asset Inventory to audit compliance.. Option B is correct because it combines Infrastructure as Code (IaC) templates with required label variables in CI/CD pipelines to enforce labeling at resource creation time, and uses Cloud Asset Inventory to audit and detect non-compliant resources. This approach is scalable across 5 teams, 20 projects, and 3 regions because it automates enforcement and provides continuous compliance monitoring without manual intervention.

Answer

Send monthly reminders to all teams via email to add labels to their resources.

Answer

Manually add labels to all existing and new resources through the Cloud Console.

Answer

Grant only project owners permission to create resources, and rely on them to enforce labeling.

Question 2

What does 'durability' mean for cloud storage services, and how is it different from 'availability'?

Accepted Answer

Durability measures the probability data won't be lost; availability measures the percentage of time data can be accessed — a service can be temporarily unavailable while data remains durable.. Durability measures the probability that stored data will not be lost or corrupted over time, typically expressed as a percentage (e.g., 99.999999999% for Amazon S3). Availability measures the percentage of time a service is operational and accessible, often defined in SLAs (e.g., 99.99% uptime). A service can be temporarily unavailable (e.g., due to maintenance) while the data remains intact and durable, so they are distinct concepts.

Answer

Durability and availability are the same thing — both measure how often data can be accessed.

Answer

Durability refers to network speed; availability refers to storage capacity.

Answer

High availability automatically guarantees high durability, so both terms describe the same SLA.

Question 3

A team uses multiple cloud services and wants to deploy all resources — VPCs, Cloud SQL databases, GKE clusters, and IAM roles — using a declarative, open-source infrastructure-as-code tool that works across multiple cloud providers. Which tool integrates natively with Google Cloud for this purpose?

Accepted Answer

Terraform. Terraform is the correct choice because it is a declarative, open-source infrastructure-as-code tool that supports multiple cloud providers, including Google Cloud, through its provider plugin architecture. It allows you to manage VPCs, Cloud SQL databases, GKE clusters, and IAM roles using HashiCorp Configuration Language (HCL) and integrates natively with Google Cloud via the google provider.

Answer

Cloud Deployment Manager — Google's native IaC service.

Answer

Cloud Build — it builds and deploys application code.

Answer

Ansible — it automates server configuration management.

Question 4

A company wants to allow a third-party security firm to conduct a penetration test against their Google Cloud environment to identify vulnerabilities. What is Google Cloud's policy on penetration testing?

Accepted Answer

Customers are authorized to penetration test their own GCP resources without prior Google approval, within the Acceptable Use Policy.. Google Cloud's policy explicitly authorizes customers to conduct penetration testing on their own GCP resources without prior approval from Google, as long as the testing complies with the Acceptable Use Policy. This is because Google treats the customer's environment as their own responsibility, and the shared responsibility model places security testing under the customer's control. Option B correctly reflects this policy, which is documented in Google Cloud's security testing guidelines.

Answer

Customers must submit a formal request to Google and wait for written approval before any penetration testing.

Answer

Penetration testing is illegal in cloud environments and customers should use vulnerability scanners instead.

Answer

Google automatically performs penetration testing on all customer resources monthly and shares the report.

Question 5

A company hosts a web application that receives requests from users globally. To handle failures, they run three identical copies of their application behind a load balancer. When one copy fails, the load balancer automatically stops sending traffic to it. What load balancing feature enables this?

Accepted Answer

Health checks — the load balancer probes backend instances and removes unhealthy ones from the serving pool.. Health checks are the load balancing feature that proactively monitors the status of backend instances by sending periodic probes (e.g., HTTP GET requests, TCP SYN packets) to a configured endpoint. If a health check fails (e.g., non-2xx response, timeout, or connection refused), the load balancer automatically marks that instance as unhealthy and stops routing new traffic to it, ensuring high availability and fault tolerance.

Answer

Round-robin distribution — traffic cycles evenly across all instances regardless of health.

Answer

SSL termination — decrypting HTTPS traffic before forwarding to backends.

Answer

Session affinity — routing the same user to the same backend instance.

Question 6

An SRE team has a monthly error budget of 43 minutes (99.9% SLO). In the first week of the month, a deployment causes a 50-minute outage. What should the SRE team do for the remainder of the month, and why?

Accepted Answer

Freeze feature deployments for the rest of the month, focus on reliability improvements, and investigate the deployment process that caused the outage.. The team has already consumed more than the entire monthly error budget (50 minutes used vs. 43 minutes allowed). To avoid violating the 99.9% SLO for the rest of the month, they must freeze feature deployments and focus on reliability improvements. This is a core SRE practice: when the error budget is exhausted, the team shifts from feature velocity to stability, investigating the root cause and hardening the deployment process.

Answer

Immediately deploy a hotfix to restore features that were rolled back during the outage.

Answer

Negotiate with stakeholders to increase the SLO to 99.5% to get more error budget.

Answer

Continue deploying features normally — the outage was a one-time event and won't happen again.

Question 7

Which Google Cloud feature provides reports on how Google processes government requests for customer data and how often Google challenges overly broad requests?

Accepted Answer

Google's Transparency Report — publishing data about government requests and legal compliance.. Google's Transparency Report is the correct answer because it specifically publishes data on government requests for user data, including how Google processes these requests and how often it challenges overly broad or legally questionable demands. This report is designed to provide public visibility into government actions, not to log individual API calls or access events.

Answer

Cloud Audit Logs — they record all API calls including government data requests.

Answer

Security Command Center — it alerts when government agencies access customer data.

Answer

Access Transparency logs — they record every time any external entity accesses customer data.

Question 8

A company's engineering organization wants to share operational knowledge across teams using a 'golden path' — a recommended, pre-configured set of tools, services, and templates that makes the easy path also the correct path. Which Google Cloud concept supports this practice?

Accepted Answer

Use Terraform blueprints, organization policies, and Cloud Foundation Toolkit to create pre-configured landing zones that enforce standards automatically.. Option B is correct because the Cloud Foundation Toolkit (CFT) provides Terraform blueprints and pre-configured landing zones that enforce organizational policies and standards automatically. This aligns directly with the 'golden path' concept by making the easy path (using the blueprints) also the correct path (enforcing compliance and best practices through organization policies and automated deployments).

Answer

Create a shared Google Slides presentation documenting best practices for teams to reference.

Answer

Grant all teams Organization Admin access so they can configure resources however they prefer.

Answer

Hire a dedicated cloud architect to review every new project's design before it starts.

Question 9

An organization is planning to adopt cloud services but needs to understand which party is responsible for physical security of the data center. Under the shared responsibility model, who is responsible for physical data center security in a public cloud deployment?

Accepted Answer

The cloud provider, who is entirely responsible for all physical security of data center facilities and hardware. In the cloud shared responsibility model, physical security of data centers — including building access controls, perimeter security, surveillance, and hardware security — is always the sole responsibility of the cloud provider. Customers never have physical access to cloud provider data centers and bear no responsibility for physical security. This is one of the fundamental security benefits of using a public cloud.

Answer

The customer, because they own the data stored in the data center

Answer

A shared responsibility: the cloud provider secures the building exterior while the customer secures the server racks

Answer

A third-party security company contracted by both the customer and the cloud provider

Question 10

A data analyst at a media company needs to run complex SQL queries on petabytes of user engagement data to produce weekly reports. The dataset is stored in Google Cloud. Which Google Cloud product is purpose-built for this type of large-scale analytical SQL workload?

Accepted Answer

BigQuery, Google Cloud's serverless data warehouse for petabyte-scale analytical SQL. BigQuery is Google Cloud's serverless, highly scalable data warehouse specifically designed for petabyte-scale analytical SQL queries. It separates compute from storage and uses a columnar storage format and a distributed query engine to execute complex SQL on massive datasets without provisioning infrastructure, making it the ideal choice for the described workload.

Answer

Cloud SQL, Google Cloud's managed relational database service

Answer

Cloud Bigtable, Google's NoSQL wide-column database

Answer

Firestore, Google Cloud's serverless NoSQL document database

Question 11

A company's security team wants to ensure that only approved corporate devices can access Google Cloud resources, regardless of whether the user has valid credentials. Which Google Cloud security capability enforces device-level access requirements?

Accepted Answer

Access Context Manager, which enforces device-level access requirements as part of context-aware access control policies. Access Context Manager is the correct choice because it allows security teams to define context-aware access policies that include device-level attributes such as device OS type, device ID, and whether the device is managed (e.g., via endpoint verification or third-party EMM). This enforces device-level access requirements even if the user has valid credentials, directly addressing the scenario.

Answer

Cloud Armor, which filters incoming requests based on IP allowlists and denylists

Answer

Identity-Aware Proxy (IAP), which provides application-level authentication but without device checks

Answer

VPC Service Controls, which restrict access to Google APIs based on network perimeter membership

Question 12

A software team deploys microservices using containers and wants Google Cloud to automatically manage the scaling, self-healing, and rollout of their containerized applications. They don't want to provision or manage underlying virtual machines. Which Google Cloud service best meets this need?

Accepted Answer

Google Kubernetes Engine (GKE), which manages containerized applications with automatic scaling, self-healing, and rolling updates. Google Kubernetes Engine (GKE) is the correct choice because it provides a managed Kubernetes environment that automates scaling, self-healing (e.g., automatic pod restarts and node repair), and rollout management (e.g., rolling updates and rollbacks) for containerized applications. This meets the requirement of not provisioning or managing underlying virtual machines, as GKE abstracts the node infrastructure.

Answer

Compute Engine, Google Cloud's virtual machine service

Answer

Cloud Storage, for storing container images and serving them to instances

Answer

Cloud CDN, which distributes containerized applications globally

Question 13

A financial services company is subject to regulations requiring them to demonstrate that their cloud provider's employees cannot access customer data without the customer's explicit approval. Which Google Cloud feature most directly addresses this requirement?

Accepted Answer

Access Transparency and Access Approval, which log and require explicit customer approval for Google personnel access to customer content. Access Transparency and Access Approval directly address the regulatory requirement by providing near real-time logs of Google personnel actions on customer content and requiring explicit customer approval before such access can occur. Access Transparency logs every access attempt by Google employees, while Access Approval allows customers to approve or deny those requests, ensuring no unauthorized access without customer consent.

Answer

Customer-Managed Encryption Keys (CMEK), where the customer controls the encryption key and can revoke access

Answer

Cloud Audit Logs, which record all customer actions within Google Cloud

Answer

VPC Service Controls, which prevent Google employees from accessing resources inside the service perimeter

Question 14

A marketing team wants to create interactive dashboards and reports for business stakeholders using data stored in BigQuery, without writing code. Which Google Cloud product is most appropriate for this self-service business intelligence requirement?

Accepted Answer

Looker Studio, Google's self-service data visualization tool with native BigQuery connectivity and a no-code interface. Looker Studio (formerly Google Data Studio) is the correct choice because it is Google Cloud's self-service business intelligence tool that provides a no-code, drag-and-drop interface for creating interactive dashboards and reports. It has native, built-in connectivity to BigQuery, allowing the marketing team to visualize data without writing any code or SQL queries.

Answer

Cloud Dataflow, Google Cloud's stream and batch data processing service

Answer

BigQuery itself, where the marketing team writes SQL queries to generate reports

Answer

Vertex AI, Google Cloud's unified machine learning platform

Question 15

A logistics company needs to send millions of shipment status updates per day from IoT tracking devices to backend systems for processing and storage. The solution must decouple the tracking devices from the backend and handle traffic spikes without losing messages. Which Google Cloud product best fits this asynchronous messaging requirement?

Accepted Answer

Cloud Pub/Sub, Google's fully managed messaging service that decouples producers from consumers and handles massive message volumes reliably. Cloud Pub/Sub is the correct choice because it is a fully managed, asynchronous messaging service designed to decouple producers (IoT devices) from consumers (backend systems). It can handle millions of messages per second, provides at-least-once delivery, and buffers messages during traffic spikes, ensuring no data loss without requiring the backend to be always available.

Answer

Cloud SQL, to store each tracking update as a row in a relational database as it arrives

Answer

Cloud Storage, to have each device upload a file containing its status update

Answer

Cloud Load Balancing, to distribute incoming tracking requests evenly across backend servers

Question 16

A healthcare provider wants to use AI to analyze unstructured medical records — scanned documents with handwritten notes and printed text — to extract diagnosis codes for billing. Which combination of Google Cloud AI products most directly addresses this document understanding use case?

Accepted Answer

Document AI and Vision API, which together handle OCR, layout understanding, and information extraction from scanned documents with handwritten and printed text. Option B is correct because Document AI is purpose-built for extracting structured information (like diagnosis codes) from unstructured documents, including both handwritten and printed text, using OCR and layout understanding. The Vision API complements this by providing advanced OCR capabilities for scanned images, together forming a direct solution for the healthcare provider's document understanding use case.

Answer

BigQuery ML and Looker Studio, to analyze and visualize the extracted diagnosis codes

Answer

Vertex AI Pipelines and Cloud Dataflow, to orchestrate machine learning training jobs on document data

Answer

Cloud Translation API and Natural Language API, to translate and analyze the text content of medical records

Question 17

A company has employees who use personal (unmanaged) devices to access corporate applications. The security team wants to prevent sensitive Google Workspace documents from being downloaded to personal devices. Which Google control most directly addresses this data loss prevention requirement for device-based scenarios?

Accepted Answer

Google Workspace context-aware access and endpoint management controls that restrict actions (such as downloads) for users accessing from unmanaged personal devices. Option B is correct because Google Workspace context-aware access combined with endpoint management allows administrators to create access level policies that restrict specific actions—such as downloading, printing, or copying—based on device trust signals. When a user accesses Google Workspace from an unmanaged personal device, the policy can block the download of sensitive documents directly, addressing the data loss prevention requirement at the action level rather than just the access level.

Answer

Cloud Armor, by blocking requests from IP addresses associated with personal devices

Answer

Enabling two-factor authentication for all users, which prevents unauthorized access

Answer

Encrypting all Google Drive files so they cannot be read on personal devices

Question 18

A company's security policy requires that all cloud-to-cloud communication between services must be encrypted in transit. An auditor asks how Google Cloud handles encryption for network traffic between Google services within its network. What is Google's default approach to encryption in transit within its infrastructure?

Accepted Answer

Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required. Google Cloud encrypts all network traffic between its data centers and internal services by default, using application-layer (e.g., gRPC with TLS) and link-layer encryption (e.g., MACsec or similar). This is a foundational security measure that requires no customer configuration, ensuring data is protected in transit even within Google's own infrastructure.

Answer

Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication

Answer

Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance

Answer

Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network

Question 19

A CTO explains to her board that moving to cloud reduces the company's 'total cost of ownership' compared to running an on-premises data center. Which cost category is most commonly underestimated in on-premises TCO calculations?

Accepted Answer

IT staff labor costs for ongoing maintenance, patching, hardware replacement, and operations, which are frequently underestimated in on-premises TCO. Option B is correct because on-premises TCO calculations frequently underestimate the labor costs associated with ongoing IT staff tasks such as applying security patches, performing hardware replacements, managing firmware updates, and handling day-to-day operations. These operational expenses (OpEx) accumulate over the lifecycle of the data center and often exceed the initial capital expenditure (CapEx) for hardware, making them a critical but overlooked component in total cost of ownership comparisons with cloud providers like AWS, Azure, or GCP.

Answer

Hardware acquisition costs, which are typically overestimated in on-premises environments

Answer

Software licensing costs, which are always higher on-premises than in the cloud

Answer

Internet bandwidth costs, which are negligible on-premises

Question 20

A company is evaluating whether to adopt a multi-cloud strategy (using two or more cloud providers for different workloads). An engineer lists the following arguments: (1) resilience against a single cloud provider outage, (2) negotiating leverage on pricing, (3) using best-of-breed services from each provider. A cloud architect cautions that multi-cloud also introduces significant challenges. What is the most significant operational challenge of a multi-cloud approach?

Accepted Answer

Significantly increased operational complexity: teams need expertise in multiple providers' tools, security models, and APIs, while governance, monitoring, and cost management must span inconsistent environments. Option B is correct because multi-cloud environments inherently increase operational complexity. Teams must master distinct APIs, security models (e.g., IAM policies differ between AWS and GCP), monitoring tools (e.g., CloudWatch vs. Cloud Monitoring), and cost management consoles. Governance and compliance must be enforced consistently across heterogeneous platforms, which often requires custom tooling or third-party solutions, making day-to-day operations significantly more challenging than a single-cloud approach.

Answer

Multi-cloud requires purchasing separate hardware for each cloud provider's environment

Answer

Cloud providers refuse to allow customers to use competing providers simultaneously

Answer

Multi-cloud makes it impossible to use any managed services because applications must be portable across providers