Cloud Digital Leader Practice Test 21 — 15 Questions

Question 1

A startup wants to run a Node.js web application with zero server management and automatic scaling. They expect unpredictable traffic and want to minimise costs. Which Google Cloud service should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

App Engine Standard Environment. App Engine Standard Environment is a PaaS that automatically scales, manages the runtime, and can scale to zero. App Engine Flexible runs in VMs, does not scale to zero, and costs more. Compute Engine requires manual scaling. Cloud Run is also serverless but for containers; App Engine Standard is simpler for code-based apps.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine Flexible Environment

Question 2

A company wants to implement a hybrid cloud architecture connecting their on-premises data center to Google Cloud. They need high bandwidth (10 Gbps), low latency, and a service-level agreement (SLA). Which TWO services can provide dedicated connectivity? (Choose two.)

Accepted Answer

Cloud Interconnect (Partner). Cloud Interconnect (dedicated or partner) provides high-bandwidth, low-latency connections with SLAs. HA VPN is a VPN alternative but does not offer dedicated bandwidth or SLA for throughput. So the two correct are Cloud Interconnect (Dedicated Interconnect) and Cloud Interconnect (Partner Interconnect). However, the question asks for services that provide dedicated connectivity with SLA. Both Dedicated Interconnect and Partner Interconnect offer SLAs. HA VPN does not. So I'll include both types of Interconnect, but since they are the same service, I need to differentiate. Let's list options: A. Cloud VPN, B. HA VPN, C. Cloud Interconnect (Dedicated), D. Cloud Interconnect (Partner), E. Cloud CDN. So C and D are correct.

Answer

HA VPN

Answer

Cloud CDN

Answer

Cloud VPN

Question 3

An engineer needs to store database passwords and API keys securely. The secrets must be encrypted at rest with a customer-managed key and automatically rotated every 90 days. Which service should they use?

Accepted Answer

Cloud Secret Manager. Secret Manager is designed for storing secrets like API keys and passwords, with built-in rotation and integration with Cloud KMS for CMEK.

Answer

Cloud KMS

Answer

Datastore

Answer

Cloud Storage with encryption

Question 4

A media company needs to store and serve video files globally with high availability and low latency. They also need to process these videos using transcoding. Which THREE Google Cloud services should they use? (Choose 3)

Accepted Answer

Cloud Storage. Cloud Storage stores the video files. Cloud CDN caches content at edge locations. Transcoder API processes video transcoding. Compute Engine is for general compute; BigQuery is for analytics; Cloud Run is for serverless apps.

Answer

Compute Engine

Answer

BigQuery

Question 5

A company wants to implement a data pipeline that ingests streaming events from a global user base, processes them in real-time to detect anomalies, and stores the results in a database for low-latency querying. The solution must be fully managed. Which THREE services should they use? (Choose 3)

Accepted Answer

Dataflow. Pub/Sub ingests streaming events with global scalability. Dataflow processes events in real-time with exactly-once semantics. Bigtable provides low-latency access for storing and querying processed results. Cloud Storage is for object storage, not low-latency queries. Cloud SQL is for relational OLTP but may not match Bigtable's throughput for anomaly detection results. Cloud Functions is not suited for continuous stream processing.

Answer

Cloud Storage

Answer

Cloud Functions

Question 6

Which TWO statements about committed use discounts (CUDs) are true? (Choose two.)

Accepted Answer

CUDs can be purchased for specific resources such as vCPUs and memory.. CUDs require a commitment of 1 or 3 years and provide a discount in exchange. They apply to specific resource usage like vCPUs and memory.

Answer

CUDs provide a discount for sustained usage without any upfront commitment.

Answer

CUDs can be applied to any Google Cloud service automatically.

Answer

CUDs are applied automatically without any action from the user.

Question 7

Which TWO statements about encryption in transit in Google Cloud are correct? (Choose 2)

Accepted Answer

Google Cloud uses TLS for all external traffic to its APIs.. Google Cloud uses TLS for all external and internal traffic by default between data centers. Encryption is applied automatically. The question asks for correct statements.

Answer

Users must configure TLS certificates for all Google Cloud services.

Answer

Data in transit between Google Cloud and the internet is encrypted by default for all services.

Answer

Encryption in transit uses AES-256.

Question 8

A company is building a real-time leaderboard for an online game using Google Cloud. They need a database that can handle millions of updates per second with low latency and serve the current top scores. Which TWO services should they use together? (Choose 2)

Accepted Answer

Cloud Bigtable. Cloud Bigtable can ingest high-velocity score updates, and Memorystore (Redis) can maintain a sorted set for the leaderboard. BigQuery is too slow for real-time updates; Firestore is not designed for millions of writes per second.

Answer

Cloud SQL

Answer

Firestore

Answer

BigQuery

Question 9

A company is migrating a legacy monolithic application to Google Cloud. The application has variable traffic and requires a relational database. They want to minimize operational overhead. Which TWO Google Cloud services should they choose? (Choose TWO.)

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that minimizes operational overhead by automatically scaling. Cloud SQL is a fully managed relational database service, reducing database management tasks.

Answer

Compute Engine

Answer

Google Kubernetes Engine

Answer

BigQuery

Question 10

A financial company wants to run sensitive workloads on Google Cloud while ensuring data never leaves a specific geographic boundary and meets strict compliance requirements. Which THREE Google Cloud services should they combine?

Accepted Answer

Assured Workloads for Government. VPC Service Controls create security perimeters to prevent data exfiltration. Assured Workloads provides compliance controls for regulated industries (e.g., FedRAMP). Cloud HSM with CMEK ensures customer-managed keys in hardware for encryption compliance.

Answer

Cloud VPN

Answer

Cloud NAT

Question 11

A company's finance director asks: 'If we move to cloud, do we need to buy fewer servers?' An IT architect responds that the answer depends on whether the company is adopting IaaS, PaaS, or SaaS. How does the service model affect hardware ownership?

Accepted Answer

In all three models, the cloud provider owns and manages the physical hardware, eliminating the need for customer-owned servers for those workloads — with IaaS requiring the most customer management (VMs) and SaaS requiring the least (just use the application). In IaaS, PaaS, and SaaS, the cloud provider owns and manages the physical hardware in their data centers. The customer's hardware ownership decreases as the service model abstracts more layers: IaaS provides virtual machines (VMs) that the customer manages, PaaS provides a managed platform (runtime, middleware) without customer control over the underlying OS or hardware, and SaaS delivers a fully managed application where the customer only uses the software. Thus, moving to any of these models reduces or eliminates the need for customer-owned servers for those specific workloads.

Answer

All three models (IaaS, PaaS, SaaS) require the same amount of customer-owned hardware since cloud supplements rather than replaces on-premises systems

Answer

Only SaaS eliminates the need for customer servers; IaaS and PaaS still require on-premises hardware for hybrid connectivity

Answer

The service model doesn't affect hardware ownership — hardware purchase decisions are independent of whether the company uses cloud services

Question 12

A healthcare company needs to run a large batch processing job that analyzes patient records using Apache Spark, transforming data from Cloud Storage and writing results to BigQuery. The job runs once daily and requires a large cluster that should exist only during the job. Which Google Cloud product best handles this ephemeral large-batch Spark workload?

Accepted Answer

Cloud Dataproc, which runs managed Apache Spark clusters that can be created for the job and deleted on completion — paying only during the processing window. Cloud Dataproc is the correct choice because it provides managed Apache Spark clusters that can be created on demand for the batch job and automatically deleted upon completion, ensuring you only pay for the processing time. This ephemeral cluster model perfectly matches the requirement of a large cluster that exists only during the daily job, without manual infrastructure management.

Answer

Cloud Dataflow, for running the Apache Spark code as a streaming pipeline

Answer

Compute Engine VMs, by manually installing Apache Spark on a cluster of VMs each day before the job

Answer

BigQuery, by running the Spark transformation directly within BigQuery's execution engine

Question 13

A company has employees who use personal (unmanaged) devices to access corporate applications. The security team wants to prevent sensitive Google Workspace documents from being downloaded to personal devices. Which Google control most directly addresses this data loss prevention requirement for device-based scenarios?

Accepted Answer

Google Workspace context-aware access and endpoint management controls that restrict actions (such as downloads) for users accessing from unmanaged personal devices. Google Workspace context-aware access combined with endpoint management allows administrators to create access level policies that restrict specific actions—such as downloading, printing, or copying—based on device trust signals. When a user accesses Google Workspace from an unmanaged personal device, the policy can block the download of sensitive documents directly, addressing the data loss prevention requirement at the action level rather than just the access level.

Answer

Cloud Armor, by blocking requests from IP addresses associated with personal devices

Answer

Enabling two-factor authentication for all users, which prevents unauthorized access

Answer

Encrypting all Google Drive files so they cannot be read on personal devices

Question 14

A company runs a mission-critical PostgreSQL database on Google Cloud that must support automatic failover to a standby instance within 60 seconds if the primary instance fails, with minimal data loss. Which Cloud SQL configuration satisfies this high availability requirement?

Accepted Answer

Cloud SQL High Availability configuration with a synchronously replicated standby instance that automatically promotes to primary within approximately 60 seconds of primary failure. Cloud SQL's High Availability (HA) configuration uses a synchronous replication mechanism between the primary and standby instances. This ensures that transactions are committed on both instances before being acknowledged, meeting the requirement for minimal data loss. In the event of a primary failure, the standby is automatically promoted to primary within approximately 60 seconds, satisfying the failover time requirement.

Answer

Cloud SQL with automated daily backups, restoring from backup if the primary fails

Answer

Cloud SQL read replicas in another region, manually promoted if the primary fails

Answer

Running a self-managed PostgreSQL cluster on Compute Engine VMs with a custom pacemaker/corosync HA setup

Question 15

A company's SRE team is debating whether to automate a frequently performed manual operational task. The automation would take 4 weeks of engineering time to build. The manual task takes 30 minutes per occurrence and happens approximately 20 times per month. Using the SRE concept of 'toil,' how should the team approach this decision?

Accepted Answer

Build the automation: eliminating toil permanently is a core SRE principle, and the 4-week investment pays back within approximately 16 months while freeing engineers for higher-value reliability work indefinitely. Automating toil aligns with the core SRE principle of eliminating repetitive, manual work to free engineers for higher-value reliability tasks. The 4-week build cost is justified: 20 occurrences/month × 0.5 hours = 10 hours/month, so the payback period is 4 weeks × 40 hours/week ÷ 10 hours/month = 16 months, after which the team gains indefinite time savings. This decision does not require exact salary data, as the primary goal is reducing toil, not purely cost optimization.

Answer

Do not automate — the manual task is only 10 hours per month and the 4-week build cost is too high to justify

Answer

Hire an additional junior engineer to perform the manual task more efficiently instead of automating

Answer

The team cannot make this decision without knowing the exact annual salary cost of the engineers who perform the manual task