Cloud Digital Leader Practice Test 22 — 15 Questions

Question 1

A cloud architect is explaining to executives why they should use managed services (like Cloud SQL, Memorystore, Pub/Sub) instead of running self-managed equivalents on VMs (PostgreSQL on VM, Redis on VM, RabbitMQ on VM). Which argument best captures the strategic rationale for preferring managed services?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Managed services transfer undifferentiated operational complexity (patching, backups, HA, scaling) to Google, freeing engineering teams to focus on differentiated business logic rather than infrastructure management. Ly captures the strategic rationale because managed services like Cloud SQL, Memorystore, and Pub/Sub offload undifferentiated heavy lifting—such as automated patching, backup management, high-availability failover, and horizontal scaling—to Google Cloud. This allows engineering teams to focus on building and improving application-specific features rather than spending time on infrastructure tasks that do not provide competitive advantage.

Answer

Managed services are always less expensive than self-managed alternatives on VMs

Answer

Managed services guarantee better performance than self-managed deployments in all scenarios

Answer

Using managed services eliminates the need for any cloud expertise within the engineering team

Question 2

A startup is building an application that sends daily promotional push notifications to millions of mobile users on both iOS and Android devices. Which Google Cloud or Google service most directly provides the infrastructure for sending these mobile push notifications?

Accepted Answer

Firebase Cloud Messaging (FCM), which delivers push notifications to iOS and Android devices through Google's mobile notification infrastructure. Firebase Cloud Messaging (FCM) is Google's dedicated, scalable infrastructure for delivering push notifications to both iOS and Android devices. It handles device registration, message routing, and platform-specific delivery through Apple Push Notification service (APNs) for iOS and Google's own push service for Android, making it the most direct and appropriate service for this use case.

Answer

Cloud Pub/Sub, which delivers messages to subscribed mobile application instances

Answer

Cloud Storage, by writing notification content to buckets that mobile applications poll for new messages

Answer

Cloud Run, by exposing an API that mobile applications call to retrieve their pending notifications

Question 3

A company's application stores sensitive customer information in Cloud Storage. A security audit finds that one bucket has 'allUsers' access granted (making it publicly accessible on the internet). The security team wants to prevent this from happening in the future. Which control prevents public access from being granted to Cloud Storage buckets?

Accepted Answer

Apply the 'storage.publicAccessPrevention' organization policy constraint, which prevents allUsers and allAuthenticatedUsers from being granted in Cloud Storage IAM policies organization-wide. The 'storage.publicAccessPrevention' organization policy constraint is a Google Cloud IAM constraint that, when enforced at the organization, folder, or project level, prevents any IAM policy binding that grants access to 'allUsers' or 'allAuthenticatedUsers' on Cloud Storage buckets. This is a preventive control that blocks the action before it can occur, directly addressing the security team's requirement to prevent public access from being granted in the future.

Answer

Enable Cloud Armor on all Cloud Storage buckets to block public internet access

Answer

Enable VPC Service Controls around Cloud Storage to prevent public internet access

Answer

Configure Cloud Monitoring to alert the security team when a bucket is made public so they can revert it

Question 4

A business leader asks: 'What is the difference between a data center region and an availability zone in Google Cloud?' Which explanation is most accurate?

Accepted Answer

A region is a geographic area containing multiple independent zones; each zone is a distinct facility with independent power, cooling, and networking — failures in one zone don't affect other zones in the region. In Google Cloud, a region is a specific geographic location composed of multiple zones, where each zone is an independent data center with its own power, cooling, and networking infrastructure. This isolation ensures that failures within one zone do not impact other zones in the same region, providing high availability and fault tolerance for applications.

Answer

A region is a single data center building; an availability zone is a floor within that building

Answer

A region is equivalent to an availability zone; both terms refer to a single data center

Answer

An availability zone is larger than a region and spans multiple geographic areas for global redundancy

Question 5

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

Accepted Answer

Access Context Manager with device policy conditions requiring managed, compliant devices.. Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Answer

Cloud Armor — it inspects device fingerprints on incoming requests.

Answer

Cloud Firewall rules that allow only corporate office IP ranges.

Answer

Two-step verification — the second factor proves the device is trusted.

Question 6

A security team is conducting a threat model for their Google Cloud environment. They identify 'insider threat' — a malicious authorized employee who intentionally exfiltrates or destroys data — as a key risk. Which combination of Google Cloud controls most effectively mitigates this risk?

Accepted Answer

Least privilege IAM (limiting access to only necessary resources), comprehensive audit logging (detecting anomalous access), VPC Service Controls (preventing data exfiltration to external projects), and separation of duties for critical actions. It combines least privilege IAM to limit the blast radius, comprehensive audit logging (e.g., Cloud Audit Logs) to detect anomalous access patterns, VPC Service Controls to prevent data exfiltration via VPC perimeter enforcement, and separation of duties (e.g., using Cloud IAM Conditions) to ensure no single insider can perform critical actions alone. This layered defense addresses both prevention and detection of malicious insider activity.

Answer

Strong external firewall rules, because insider threats come from internal network actors who must be blocked at the perimeter

Answer

Encrypting all data at rest with CMEK, since encryption prevents authorized users from reading data

Answer

Requiring all employees to pass annual security training to prevent insider threats

Question 7

A security architect is evaluating Google Cloud's approach to securing customer data against both external attackers and potential internal Google personnel access. She identifies four distinct controls: (1) encryption at rest by default, (2) Access Transparency logs, (3) Customer-Managed Encryption Keys (CMEK), and (4) Access Approval. How do these four controls work together to provide layered data protection?

Accepted Answer

The four controls form complementary layers: default encryption protects physical storage, CMEK gives cryptographic customer control (revocable), Access Transparency provides visibility into Google personnel access, and Access Approval gives customers veto power — together addressing infrastructure attacks, insider threats, and provider access concerns. These four controls form a defense-in-depth strategy for data protection on Google Cloud. Default encryption at rest secures data on physical storage, CMEK provides cryptographic control with the ability to revoke access, Access Transparency logs offer visibility into Google personnel actions, and Access Approval gives customers the ability to veto access requests. Together, they address threats from infrastructure attacks, insider threats, and provider access concerns, creating a layered security model.

Answer

All four controls are redundant and address the same threat — customers only need to enable one of them

Answer

These controls are only relevant for government or military workloads; commercial enterprises don't need this level of protection

Answer

CMEK alone provides complete data protection — the other three controls are unnecessary if customer-managed keys are in use

Question 8

A startup wants to deploy a web application globally and expects traffic to be unpredictable — sometimes very low, sometimes very high. Which cloud characteristic ensures the startup only pays for the compute resources it actually uses?

Accepted Answer

Measured service / pay-per-use pricing, where the startup is billed only for actual resource consumption with no payment for idle capacity. The measured service / pay-per-use pricing model of cloud computing ensures that the startup is billed only for the compute resources it actually consumes, such as CPU hours, memory, or storage, with no charges for idle capacity. This directly addresses the need to handle unpredictable traffic spikes without incurring costs for unused resources during low-traffic periods. In Google Cloud, this is implemented through per-second billing for compute instances and autoscaling, which dynamically adjusts resources based on demand.

Answer

Resource pooling, which allows the startup to share physical hardware with other tenants

Answer

Broad network access, which allows the application to be reached from any device globally

Answer

On-demand self-service, which allows the startup to provision resources through a web interface without calling a sales team

Question 9

A CISO is implementing a Zero Trust security architecture for the company's Google Cloud environment. Under Zero Trust, which fundamental assumption about network traffic changes compared to traditional perimeter-based security?

Accepted Answer

Zero Trust assumes no traffic is trusted by default regardless of network origin — every request must be explicitly authenticated and authorized based on identity, device posture, and context. Zero Trust fundamentally shifts from implicit trust based on network location to explicit verification of every request. In Google Cloud, this means every API call, regardless of whether it originates from within the VPC or the internet, must be authenticated (e.g., using OAuth 2.0 or service account keys) and authorized based on identity, device posture, and context, as enforced by tools like Identity-Aware Proxy (IAP) and VPC Service Controls.

Answer

Zero Trust assumes that internal network traffic is more secure than external traffic because it has passed through the corporate firewall

Answer

Zero Trust assumes all traffic is malicious and blocks all requests by default, requiring explicit allowlisting for each connection

Answer

Zero Trust eliminates the need for encryption since all traffic is assumed to be on secure internal networks

Question 10

A company's cloud environment has grown rapidly and the team is struggling to understand what cloud resources exist across dozens of projects. Which Google Cloud product provides a unified inventory of all cloud assets across an organization's projects and folders?

Accepted Answer

Cloud Asset Inventory, which provides a searchable, unified inventory of all resources and IAM policies across an organization's projects and folders. Cloud Asset Inventory is the correct answer because it is the Google Cloud service specifically designed to provide a unified, searchable inventory of all cloud assets (resources and IAM policies) across an organization's projects, folders, and organization nodes. It supports real-time and historical snapshots, enabling teams to discover and track resources as the environment scales. This directly addresses the need to understand what resources exist across dozens of projects.

Answer

Cloud Billing console, which lists all resources that have incurred charges

Answer

Google Cloud Console project dashboard, which shows resources within a single project

Answer

Security Command Center, which lists security vulnerabilities in cloud resources

Question 11

A retail company needs to process financial transactions requiring strict ACID compliance, serve global customers with consistent low-latency reads and writes, and scale horizontally without downtime for maintenance. Which Google Cloud database service is uniquely designed to meet all three requirements simultaneously?

Accepted Answer

Cloud Spanner, Google's globally distributed relational database with ACID transactions and horizontal scalability. Cloud Spanner is the only Google Cloud database service that simultaneously provides ACID compliance across global transactions, consistent low-latency reads and writes via TrueTime and synchronous replication, and horizontal scaling without downtime through automatic sharding and resharding. It uniquely combines relational database semantics with global distribution, making it the correct choice for the given requirements.

Answer

Cloud SQL with read replicas in multiple regions

Answer

Firestore in Datastore mode with multi-region replication

Answer

BigQuery with streaming inserts for real-time transaction processing

Question 12

A traditional taxi company is losing market share to ride-sharing apps built on cloud platforms. A digital transformation consultant explains that the ride-sharing companies have a fundamental advantage rooted in their technology architecture. Which cloud-enabled capability most directly explains the ride-sharing companies' competitive advantage?

Accepted Answer

Cloud-enabled real-time matching, dynamic ML-driven pricing, and elastic mobile platforms create an operating model that taxi companies' legacy systems cannot replicate. Ride-sharing companies leverage cloud-native architectures—specifically real-time matching algorithms, machine learning (ML) for dynamic pricing, and elastic mobile platforms—to create an operating model that scales instantly with demand. This cloud-enabled capability allows them to optimize driver-rider pairing and pricing in milliseconds, a level of agility that traditional taxi companies with on-premises legacy systems cannot replicate. The fundamental advantage is not about asset ownership or tax structure but about the architectural ability to process massive real-time data streams and adjust operations dynamically.

Answer

Ride-sharing companies own more vehicles than taxi companies, giving them greater fleet capacity

Answer

Ride-sharing companies pay lower taxes, giving them a cost advantage over regulated taxi companies

Answer

Ride-sharing apps are available on smartphones, while taxis require phone calls

Question 13

A company's SRE team sets an SLO of 99.5% monthly availability for a non-critical internal tool. A business stakeholder argues the target should be 99.99%. The SRE team pushes back. Which SRE argument best supports keeping the 99.5% target?

Accepted Answer

For a non-critical internal tool, 99.99% reliability requires disproportionate engineering investment (redundancy, 24/7 on-call, chaos testing) compared to its business value; 99.5% matches the actual reliability need while preserving engineering capacity for higher-value work. Ly applies the SRE principle of aligning SLOs with business value. For a non-critical internal tool, the cost of achieving 99.99% availability—including redundant infrastructure, 24/7 on-call rotations, and chaos engineering—far exceeds the marginal benefit over 99.5%. This preserves engineering capacity for higher-value work, which is a core tenet of Google's SRE approach to error budgets and cost-benefit analysis.

Answer

Higher SLOs are always more expensive to achieve and the company cannot afford cloud infrastructure that provides 99.99% availability

Answer

Google Cloud cannot provide 99.99% availability for any service, so the SLO must be kept lower

Answer

The team should set 99.5% now and plan to increase it to 99.99% next quarter when the tool becomes more popular

Question 14

A company has migrated sensitive customer data to Google Cloud. The legal team asks: 'If Google is hosting our data, who is responsible for ensuring that data is not improperly accessed by unauthorized users through our application?' Under the shared responsibility model, how should the CTO answer?

Accepted Answer

The customer is responsible for application access controls, authentication, and IAM policies that protect data from unauthorized application-layer access, while Google secures the underlying infrastructure. Under the Google Cloud shared responsibility model, the customer is responsible for securing access to their application and data, including authentication, authorization, and IAM policies, while Google is responsible for the security of the underlying infrastructure (physical security, network, hypervisor). The legal team's question specifically asks about unauthorized access through the customer's application, which falls under the customer's responsibility for application-layer controls.

Answer

Google is fully responsible because they host the data and control the infrastructure

Answer

Both Google and the customer share equal 50/50 responsibility for all data access controls

Answer

No one is responsible because cloud computing inherently cannot prevent unauthorized access

Question 15

A company is comparing the total cost of keeping its data center versus moving to public cloud. An analyst argues that the comparison should include not just hardware costs but also facility costs. What facility costs should be included in the on-premises total cost of ownership calculation?

Accepted Answer

Physical space/rent, electricity (for servers and cooling), cooling system maintenance, physical security, and fire suppression — all of which are real costs borne by the organization for operating its own data center. A comprehensive on-premises total cost of ownership (TCO) must include all facility-related costs that are directly incurred to operate a data center. These include physical space/rent, electricity for servers and cooling, cooling system maintenance, physical security, and fire suppression. Excluding these costs would understate the true cost of running an on-premises environment, which is a key consideration when comparing to public cloud models like IaaS.

Answer

Only the cost of the servers themselves, since other costs are shared across the organization

Answer

Internet connectivity costs only, since data centers require high-bandwidth connections

Answer

Data center facility costs do not need to be included since they are fixed costs that don't change whether servers are present or not