Cloud Digital Leader Practice Test 23 — 15 Questions

Question 1

A CISO is designing an identity strategy for Google Cloud that follows Zero Trust principles. She proposes that no long-lived credentials (API keys, service account keys) should be used for any automated workloads. What Google Cloud mechanism replaces service account keys for authenticating workloads running on Google Cloud infrastructure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attaching a service account to the Compute Engine VM or GKE workload, allowing the workload to obtain short-lived access tokens from the metadata server automatically — no key files required. Google Cloud's default service account attached to Compute Engine VMs or GKE nodes uses the metadata server to automatically obtain short-lived OAuth 2.0 access tokens (typically valid for 1 hour). This eliminates the need for any long-lived key files, aligning with Zero Trust principles by reducing credential exposure and enabling automatic rotation.

Answer

Using long-lived API keys stored in Secret Manager instead of environment variables — the keys are the same but stored more securely

Answer

Rotating service account keys every 24 hours to minimize the exposure window

Answer

Using OAuth 2.0 user accounts instead of service accounts for all automated workloads

Question 2

A company wants to reduce its Google Cloud costs without reducing its workload capacity. The team identifies that several production VMs consistently use less than 30% of their allocated CPU and memory. What is the most straightforward cost optimization action?

Accepted Answer

Right-size the VMs by migrating to smaller machine types that match actual CPU and memory consumption, reducing costs proportionally. Right-sizing VMs by migrating to smaller machine types that match actual CPU and memory consumption directly reduces the cost per hour while maintaining the same workload capacity. Since the VMs are consistently under-utilized, this approach eliminates wasted resources without affecting performance or availability.

Answer

Delete the under-utilized VMs since low utilization indicates they are no longer needed

Answer

Purchase Committed Use Discounts for the over-provisioned VMs to reduce their per-hour cost

Answer

Enable sustained use discounts by ensuring VMs run continuously throughout the month

Question 3

An enterprise's security team is implementing a strategy to protect against 'credential stuffing' attacks — where attackers use lists of username/password combinations from previous data breaches to try to log in to the company's applications. Which authentication control most effectively mitigates this threat?

Accepted Answer

Multi-Factor Authentication (MFA/2SV), which requires a second verification factor beyond the password that attackers don't have even when they possess the stolen credentials. Multi-Factor Authentication (MFA/2SV) is the most effective control against credential stuffing because it requires an additional verification factor (e.g., a one-time code from an authenticator app, a hardware token, or a biometric) that the attacker does not possess, even if they have valid username/password pairs from a breach. This renders the stolen credentials useless for authentication, as the attacker cannot complete the second factor challenge. In Google Cloud, this is commonly enforced via Identity Platform or Cloud Identity with security keys or TOTP.

Answer

Requiring longer, more complex passwords to make credentials harder to guess

Answer

Encrypting passwords in the company's database using bcrypt to prevent the stolen passwords from being usable

Answer

Implementing HTTPS on the login page to prevent credentials from being intercepted in transit

Question 4

A financial services company needs a managed data warehouse that can ingest streaming transaction data in real time AND support complex SQL analytics across years of historical data — all without managing any infrastructure. Which Google Cloud product meets both streaming ingest and analytical query requirements in a single serverless service?

Accepted Answer

BigQuery, which supports real-time streaming ingest via its Storage Write API and large-scale analytical SQL queries across petabytes of data in a single fully managed, serverless service. BigQuery is a fully managed, serverless data warehouse that supports real-time streaming ingest via the Storage Write API and enables complex SQL analytics across petabytes of historical data. This single service meets both requirements without any infrastructure management, unlike the other options that require separate services or manual orchestration.

Answer

Cloud Bigtable for streaming ingest and BigQuery for historical analytics — two separate services

Answer

Cloud SQL with read replicas — one instance for streaming writes, read replicas for analytical queries

Answer

Cloud Dataflow running continuously to process the stream and load to Persistent Disk for SQL queries

Question 5

A company needs to run containerized workloads but wants to avoid managing Kubernetes cluster infrastructure (node pools, cluster upgrades, node autoscaling) entirely. They want to simply deploy container images and have Google Cloud manage all underlying infrastructure automatically. Which Google Cloud product best fits this fully managed container execution requirement?

Accepted Answer

Cloud Run, which executes container images on fully managed serverless infrastructure with automatic scaling and no cluster or node management. Cloud Run is the correct choice because it provides a fully managed serverless platform that executes container images without any cluster or node management. It automatically handles scaling, infrastructure provisioning, and maintenance, aligning perfectly with the requirement to avoid managing Kubernetes cluster infrastructure entirely.

Answer

Google Kubernetes Engine (GKE) Standard mode, where the team manages node pools and cluster configuration

Answer

Compute Engine with a startup script that pulls and runs the container image from Artifact Registry

Answer

App Engine Flexible, which runs containers on managed virtual machines

Question 6

A DevOps team wants to implement a release process where a new application version is first deployed to 5% of production traffic, monitored for errors, then gradually increased to 100% if metrics remain healthy. Which deployment strategy does this describe?

Accepted Answer

Canary deployment, where a new version receives a small percentage of traffic first and is progressively rolled out as metrics confirm it is healthy. This describes a canary deployment, where the new version is initially exposed to a small subset of users (e.g., 5% of traffic) and then gradually rolled out to 100% only if key metrics (latency, error rate, CPU usage) remain within acceptable thresholds. Google Cloud's Deployment Manager and GKE support canary deployments via traffic splitting with services like Istio or native GKE ingress, allowing fine-grained control over the rollout percentage.

Answer

Blue/green deployment, where two identical environments run simultaneously and traffic is switched atomically

Answer

Rolling deployment, where instances are updated sequentially one at a time until all run the new version

Answer

Recreate deployment, where the old version is terminated before the new version is deployed

Question 7

A fashion retailer wants to use cloud to better understand customer preferences and launch trend-responsive product lines faster. Which capability most directly enables the retailer to sense market trends earlier and respond faster than competitors?

Accepted Answer

Real-time analytics on social media, search trends, and purchase signals to detect emerging preferences earlier, combined with cloud-integrated supply chain APIs for faster product launches. It directly addresses the retailer's goal of sensing market trends earlier and responding faster. Real-time analytics on social media, search trends, and purchase signals enable early detection of emerging preferences, while cloud-integrated supply chain APIs allow for rapid product launches by automating and accelerating the procurement and production processes. This combination of sensing and response capabilities is the most direct enabler of competitive advantage in trend-responsive retail.

Answer

Moving the ERP system to a cloud-hosted VM to reduce infrastructure management overhead

Answer

Training the design team on cloud-based graphic design software for faster product visualization

Answer

Storing all historical sales data in cloud object storage for cheaper archival

Question 8

A cloud team performs a quarterly review of its Compute Engine instances and discovers 15 VMs that have had zero CPU utilization for over 90 days. What is the recommended operational response to these idle resources?

Accepted Answer

Investigate whether each VM is still needed; delete confirmed unused VMs to eliminate wasted spend, potentially saving thousands per month. The recommended operational response to idle Compute Engine instances is to investigate their necessity and delete them if unused. Idle VMs with zero CPU utilization for over 90 days incur ongoing costs for persistent disks, static IPs, and other attached resources, even if the CPU is idle. Deleting confirmed unused VMs eliminates this wasted spend, potentially saving thousands per month, aligning with Google Cloud's cost optimization best practices.

Answer

Leave the VMs running in case they are needed for future workloads — storage costs are minimal for idle VMs

Answer

Upgrade the idle VMs to larger machine types so they can handle future workloads if needed

Answer

Apply committed use discounts to the idle VMs to reduce their cost while keeping them available

Question 9

A solutions architect is designing a system that must remain available even if an entire Google Cloud region becomes unavailable due to a major disaster. Which deployment approach achieves this goal?

Accepted Answer

Deploying the application across multiple Google Cloud regions so that if one region fails, other regions continue serving traffic. Deploying across multiple Google Cloud regions ensures that if an entire region becomes unavailable, traffic can be rerouted to healthy regions, achieving disaster recovery across regional failures. This approach leverages Google Cloud's global load balancing (e.g., External HTTPS Load Balancer with backend services in multiple regions) and regional managed instance groups to maintain availability even when a complete region is lost.

Answer

Deploying the application across multiple zones within the same Google Cloud region

Answer

Using a single zone but enabling automatic VM restart policies

Answer

Enabling Cloud Backup for all VMs in the deployment to allow rapid restoration after a regional failure

Question 10

A startup is building a read-heavy mobile backend. They want a database that can scale out reads without downtime. Which database service should they choose?

Accepted Answer

Cloud SQL with read replicas.. Cloud SQL with read replicas is the correct choice because it allows you to offload read traffic to one or more read replicas, scaling out reads without downtime. Read replicas are asynchronous replicas of the primary instance, and you can promote them to standalone instances if needed, making this ideal for a read-heavy mobile backend that requires high availability.

Answer

Cloud Firestore.

Answer

Cloud Spanner.

Answer

Cloud Bigtable.

Question 11

Which term best describes when an organization uses cloud-based tools (video conferencing, cloud document collaboration, project management platforms) to enable employees to work productively from any location?

Accepted Answer

Cloud-enabled distributed work / remote work — employees collaborate productively from any location using cloud tools.. The scenario explicitly describes employees using cloud-based tools (video conferencing, cloud document collaboration, project management platforms) to work productively from any location. This is the definition of cloud-enabled distributed work or remote work, where cloud infrastructure provides the connectivity, storage, and collaboration capabilities that decouple work from a fixed physical office. The key enabler is the cloud's ability to deliver real-time synchronization and access to shared resources over the internet, which is the core technical mechanism here.

Answer

Outsourcing — moving work to contractors in lower-cost locations.

Answer

Digital transformation — the company is changing its business model.

Answer

Automation — replacing human work with AI and robotics.

Question 12

A company uses committed use discounts (CUDs) for its production workload baseline. An engineer proposes also using sustained use discounts (SUDs) for the same VMs. Why is this incorrect?

Accepted Answer

CUDs and SUDs are mutually exclusive: VMs already covered by committed use discounts don't accrue sustained use discounts — you receive only the CUD, not both. Committed use discounts (CUDs) and sustained use discounts (SUDs) are mutually exclusive on the same VM. When a VM is covered by a CUD, it does not accrue SUDs; only the CUD discount is applied. This prevents double-discounting and ensures billing consistency.

Answer

CUDs and SUDs can be combined on the same VMs — applying both gives the maximum possible discount

Answer

SUDs cannot be applied to production workloads — they are only available for development environments

Answer

Applying both CUDs and SUDs creates a billing conflict that could result in Google charging the company more than on-demand pricing

Question 13

A company's security policy requires that all cloud-to-cloud communication between services must be encrypted in transit. An auditor asks how Google Cloud handles encryption for network traffic between Google services within its network. What is Google's default approach to encryption in transit within its infrastructure?

Accepted Answer

Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required. Google Cloud encrypts all network traffic between its data centers and internal services by default, using application-layer (e.g., gRPC with TLS) and link-layer encryption (e.g., MACsec or similar). This is a foundational security measure that requires no customer configuration, ensuring data is protected in transit even within Google's own infrastructure.

Answer

Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication

Answer

Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance

Answer

Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network

Question 14

A security team wants to get a comprehensive, organization-wide view of security misconfigurations (such as publicly accessible storage buckets, VMs without firewalls, and IAM overprivilege), vulnerabilities in container images, and active threats across all Google Cloud projects. Which Google Cloud service provides this unified security posture management?

Accepted Answer

Security Command Center (SCC) — unified security posture management across all GCP projects.. Security Command Center (SCC) is the correct answer because it is Google Cloud's native, unified security and risk management platform that provides continuous monitoring for misconfigurations (e.g., publicly accessible storage buckets, VMs without firewalls, IAM overprivilege), vulnerability scanning for container images, and threat detection across all projects in an organization. It aggregates findings from services like Cloud Asset Inventory, Web Security Scanner, and Event Threat Detection into a single dashboard, enabling comprehensive security posture management.

Answer

Cloud Monitoring — it detects security anomalies through metric analysis.

Answer

Cloud Audit Logs — they show all API calls that could indicate security issues.

Answer

Cloud DLP — it scans all resources for sensitive data exposure.

Question 15

A company's cloud team is asked to demonstrate that their infrastructure changes are repeatable and auditable. They use Terraform configuration files committed to a Git repository to define all cloud resources. Which operational practice does this exemplify?

Accepted Answer

Infrastructure as Code (IaC) managed through version control, providing repeatable and auditable infrastructure changes. By storing Terraform configuration files in a Git repository, the team treats infrastructure definitions as code, enabling version control, peer review, and a complete audit trail of changes. This is the core principle of Infrastructure as Code (IaC), which ensures that every infrastructure change is repeatable because the exact same configuration can be applied multiple times, and auditable because Git history records who changed what and when.

Answer

Manual change management, where each infrastructure change is recorded in a spreadsheet for audit purposes

Answer

Disaster recovery planning, using configuration files to document what needs to be rebuilt after a failure

Answer

Cost optimization, by defining infrastructure in code to enable automatic right-sizing of resources