Cloud Digital Leader Practice Test 25 — 15 Questions

Question 1

A company's data strategy lead explains that their digital transformation is built on a 'data-first culture.' A manager asks what this means practically. Which description best captures what a data-first culture looks like in a cloud-transformed organization?

Accepted Answer

All business decisions — from executive strategy to daily operational choices — are informed by data evidence, enabled by self-service analytics tools that make data accessible organization-wide, with governance ensuring data quality and trust. Option B is correct because a data-first culture in a cloud-transformed organization means that every decision, from strategic to operational, is driven by data evidence. This is enabled by cloud-native self-service analytics tools (e.g., Amazon QuickSight, Google Looker) that democratize access to data across the organization, while cloud governance frameworks (e.g., AWS Lake Formation, Azure Purview) ensure data quality, lineage, and trust. This contrasts with siloed or hoarding approaches, leveraging cloud elasticity and pay-as-you-go models to make data accessible and actionable.

Answer

Only the data science team accesses data, and all business decisions are escalated to them for analysis before action

Answer

The company collects as much data as possible and stores it indefinitely in cloud storage, regardless of whether it is used

Answer

All data is kept confidential from business users to protect privacy, with only the CTO having access to analytics

Question 2

A cloud architect is explaining to executives why they should use managed services (like Cloud SQL, Memorystore, Pub/Sub) instead of running self-managed equivalents on VMs (PostgreSQL on VM, Redis on VM, RabbitMQ on VM). Which argument best captures the strategic rationale for preferring managed services?

Accepted Answer

Managed services transfer undifferentiated operational complexity (patching, backups, HA, scaling) to Google, freeing engineering teams to focus on differentiated business logic rather than infrastructure management. Option B correctly captures the strategic rationale because managed services like Cloud SQL, Memorystore, and Pub/Sub offload undifferentiated heavy lifting—such as automated patching, backup management, high-availability failover, and horizontal scaling—to Google Cloud. This allows engineering teams to focus on building and improving application-specific features rather than spending time on infrastructure tasks that do not provide competitive advantage.

Answer

Managed services are always less expensive than self-managed alternatives on VMs

Answer

Managed services guarantee better performance than self-managed deployments in all scenarios

Answer

Using managed services eliminates the need for any cloud expertise within the engineering team

Question 3

A company's employees use Google Workspace for email, documents, and collaboration. The IT team wants to require all employees to use a physical security key (like a YubiKey) as their second authentication factor when signing in — eliminating phishing-vulnerable SMS and authenticator app codes. Which Google Workspace security capability supports this requirement?

Accepted Answer

Google Workspace 2-Step Verification policy configured to require hardware security keys (FIDO2/WebAuthn) for all employees, making it impossible to sign in without a physical key. Option B is correct because Google Workspace's 2-Step Verification policy allows administrators to enforce the use of hardware security keys (FIDO2/WebAuthn) as the sole second factor. This policy can be configured to require a physical security key for all employees, effectively blocking sign-ins that use SMS or authenticator app codes, which are vulnerable to phishing. The policy directly meets the IT team's requirement to eliminate phishing-vulnerable authentication methods.

Answer

Google Workspace Advanced Protection Program, which enforces hardware security key requirements for high-risk users

Answer

Google Cloud Identity-Aware Proxy, which enforces hardware key authentication for all Google Workspace apps

Answer

Cloud Armor, which blocks sign-in attempts that don't come from corporate IP addresses, eliminating the need for 2FA

Question 4

A company's cloud costs have grown faster than its business. The FinOps team is implementing cloud cost governance. Which practice most effectively ensures that individual teams are accountable for their cloud spending?

Accepted Answer

Implementing consistent resource labeling and chargeback reporting so each team's cloud spending is visible and attributed to them. Option B is correct because implementing consistent resource labeling and chargeback reporting directly enables cost attribution to individual teams. In Google Cloud, labels are key-value pairs attached to resources, and when combined with billing export to BigQuery, they allow granular cost breakdowns per team. This creates clear accountability by making each team's spending visible and chargeable back to their budget, which is the core principle of cloud cost governance.

Answer

Requiring all teams to use only the cheapest available cloud service options regardless of technical requirements

Answer

Consolidating all cloud accounts under a single centralized IT team that controls all cloud resource creation

Answer

Disabling all non-production environments to eliminate spending outside of production

Question 5

A reliability engineering team wants to proactively identify weaknesses in their distributed system by deliberately injecting failures — killing random instances, introducing network latency, and cutting off database connections — to observe how the system responds. What is this practice called?

Accepted Answer

Chaos engineering — deliberately injecting controlled failures to discover system weaknesses and build resilience confidence.. Option B is correct because chaos engineering is the practice of deliberately injecting controlled failures—such as killing instances, introducing latency, or cutting database connections—into a distributed system to proactively identify weaknesses and build resilience confidence. This approach aligns with Google Cloud's reliability principles, where tools like Chaos Monkey (part of the Simian Army) or Google's internal DiRT (Disaster Recovery Testing) are used to test system behavior under failure conditions.

Answer

Destructive testing — deliberately breaking the system to determine the breaking point.

Answer

Penetration testing — simulating attacks to find security vulnerabilities.

Answer

Load testing — verifying the system handles expected traffic volumes.

Question 6

The principle of least privilege is a fundamental security concept applied to IAM in Google Cloud. Which statement best describes this principle?

Accepted Answer

Users and services should be granted only the minimum permissions required for their specific function, nothing more.. Option B is correct because the principle of least privilege in Google Cloud IAM dictates that identities (users, groups, or service accounts) should be granted only the permissions necessary to perform their intended tasks. This minimizes the attack surface and limits the blast radius of a compromised credential. In Google Cloud, this is implemented by assigning predefined or custom roles with the exact set of permissions required, rather than using broad roles like Owner or Editor.

Answer

All users should have read-only access to prevent accidental changes.

Answer

Administrators should have full access so they can respond to any emergency quickly.

Answer

All employees should share the same IAM role to simplify permission management.

Question 7

Which Google Cloud service provides a centralized view of an application's performance metrics, logs, and traces — enabling teams to monitor system health, set up alerts, and diagnose issues from a single platform?

Accepted Answer

Cloud Monitoring (part of Google Cloud's operations suite). Cloud Monitoring (part of Google Cloud's operations suite) is the correct answer because it provides a unified platform for collecting and visualizing metrics, logs, and traces from applications and infrastructure. It enables teams to set up alerting policies, create dashboards, and diagnose performance issues using a single interface, integrating with services like Cloud Logging and Cloud Trace for end-to-end observability.

Answer

Cloud Security Command Center

Answer

BigQuery

Answer

Cloud Asset Inventory

Question 8

A manufacturing company deploys sensors in its factories that send data to cloud platforms for real-time analysis. The cloud-based system predicts equipment failures 48 hours in advance, enabling maintenance before failures occur. What operational model shift does this represent?

Accepted Answer

A shift from reactive (break-fix) maintenance to predictive maintenance, enabled by IoT sensor data and cloud AI/ML.. Option B is correct because the scenario describes a shift from reactive maintenance (fixing equipment after it fails) to predictive maintenance, where IoT sensors collect real-time data and cloud-based AI/ML models analyze it to forecast failures 48 hours in advance. This transformation leverages cloud computing's scalability and advanced analytics to prevent downtime, rather than simply automating existing processes or replacing human roles.

Answer

The company is automating its accounting system using cloud software.

Answer

The company is replacing human maintenance workers with robots.

Answer

The factory is migrating its ERP system to the cloud to improve supply chain visibility.

Question 9

An organization uses Security Command Center (SCC) premium tier and wants to automatically remediate a specific finding type by disabling public access to Cloud Storage buckets. What is the recommended approach?

Accepted Answer

Set up a Cloud Function triggered by SCC findings to remove public access. Option C is correct because Security Command Center (SCC) premium tier can publish findings to Cloud Pub/Sub, which can trigger a Cloud Function via a push subscription. The Cloud Function can then use the Google Cloud Storage API (specifically, the `storage.buckets.setIamPolicy` method) to remove the `allUsers` or `allAuthenticatedUsers` bindings that grant public access, enabling automated, event-driven remediation without manual intervention.

Answer

Use Cloud Pub/Sub alone to listen for SCC findings and then manually remediate

Answer

Use IAM to deny all users except project owners from making buckets public

Answer

Configure a Cloud Scheduler job to run a script that checks and removes public access

Question 10

A large hospital network wants to move patient records to the cloud and enable doctors to access records from any device. The Chief Medical Officer is supportive, but the legal department raises data privacy concerns, and the IT department fears job losses. Which aspect of digital transformation does this scenario highlight?

Accepted Answer

Digital transformation requires aligning technology with people and culture — managing stakeholder concerns and change resistance is often harder than the technical migration.. Option B is correct because digital transformation is not solely about technology adoption; it critically involves managing the human and cultural aspects of change. In this scenario, the legal department's privacy concerns and the IT department's fear of job losses represent stakeholder resistance that must be addressed through communication, retraining, and policy alignment. Successful cloud migration in healthcare requires balancing technical migration with change management to ensure adoption and compliance.

Answer

The primary challenge is selecting the correct cloud database for patient records.

Answer

The hospital should delay cloud adoption until quantum computing makes it more secure.

Answer

The legal department's concerns prove that healthcare organizations cannot use public cloud.

Question 11

A traditional bank is considering adopting open banking — exposing its financial data and transaction capabilities as APIs to third-party developers (with customer consent). This enables FinTech startups to build new financial products on top of the bank's infrastructure. What cloud capability is most essential to safely and scalably implement open banking?

Accepted Answer

A managed API platform (like Apigee) that provides authentication, rate limiting, developer portal, and usage monitoring for third-party API consumers.. Option B is correct because open banking requires secure, scalable, and controlled exposure of APIs to third-party developers. A managed API platform like Apigee provides essential capabilities such as OAuth 2.0 authentication, rate limiting, developer portal, and usage monitoring, which are critical for ensuring safe and scalable API consumption. Without these controls, the bank cannot enforce security policies, manage access, or monitor usage effectively.

Answer

A large data warehouse (BigQuery) to store all transaction data for developer access.

Answer

A dedicated cloud region in each country where the bank operates to minimize latency for API consumers.

Answer

A blockchain infrastructure to create an immutable record of all API transactions.

Question 12

An organization wants to ensure business continuity by replicating critical data to a different region. Which Google Cloud feature should they use?

Accepted Answer

Cloud Storage dual-region or multi-region. Cloud Storage dual-region or multi-region configuration is the correct choice because it provides built-in, asynchronous replication of data across geographically separated locations, ensuring business continuity through high availability and durability. This feature automatically stores redundant copies of objects in multiple zones within a region or across regions, protecting against regional failures without requiring additional infrastructure or manual intervention.

Answer

Cloud Dataflow

Answer

Compute Engine instance groups

Answer

Cloud VPN

Question 13

A company is designing a disaster recovery plan for its critical application running on Google Kubernetes Engine (GKE) in us-central1. The application uses Cloud SQL (MySQL) as its database. Which TWO actions should the company take to achieve a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 1 hour in the event of a regional outage? (Choose two.)

Accepted Answer

Configure Cloud SQL for cross-region replication using a read replica in a different region.. Option C is correct because Cloud SQL cross-region replication using a read replica in a different region provides asynchronous replication with a typical lag of under 5 minutes, enabling an RPO of less than 5 minutes. In a regional outage, you can promote the read replica to a primary instance in the other region, achieving an RTO of under 1 hour by failing over the application's database connection.

Answer

Use Cloud SQL's automated backups with a backup schedule every 4 hours.

Answer

Store container images in a regional registry in the same region.

Answer

Use Cloud CDN to cache static content.

Question 14

A healthcare organization needs to store and analyze large volumes of patient diagnostic imaging data (e.g., DICOM files) in Google Cloud. The data must be stored in a cost-effective manner for long-term retention, with the ability to query metadata and run analytics using SQL-like queries. Which combination of Google Cloud services best meets these requirements?

Accepted Answer

Cloud Storage (Nearline) for images, BigQuery for metadata analytics. Option C is correct because Cloud Storage Nearline provides cost-effective long-term storage for large imaging files with retrieval flexibility, while BigQuery enables SQL-based analytics on metadata extracted from DICOM headers, meeting both retention and query requirements without the cost of standard storage or the complexity of transactional databases.

Answer

Cloud Storage (Standard) for images, Datastore for metadata

Answer

Cloud Storage (Archive) for images, Cloud Spanner for metadata

Answer

Cloud Filestore for images, Cloud SQL for metadata

Question 15

A team wants to set up alerts for when the error budget of their service is exhausted. The service has an SLO of 99.9% availability over a 30-day rolling window. Which condition should they use in Cloud Monitoring alerting?

Accepted Answer

error budget remaining < 10%. Option A is correct because the error budget is the amount of allowable downtime over the 30-day window (0.1% of total time). Setting an alert when the remaining budget drops below 10% gives the team early warning before the budget is fully exhausted, allowing proactive remediation. Cloud Monitoring alerting policies can use the `error_budget_remaining` metric to trigger on a threshold like < 10%.

Answer

burn rate > 1 over 1 hour

Answer

latency > 100ms

Answer

SLI < 99.9%