Cloud Digital Leader Practice Test 2 — 25 Questions

Question 1

A company uses Google Cloud and wants to understand their monthly cloud spend before the invoice arrives, track spending trends, and identify the top cost drivers across all services. Which built-in Google Cloud tool provides this visibility?

Accepted Answer

Cloud Billing reports and cost breakdown in the Billing console.. Cloud Billing reports and cost breakdown in the Billing console provide built-in, out-of-the-box visibility into monthly spend before the invoice arrives, spending trends, and top cost drivers across all services. This tool aggregates billing data from all projects and services, allowing you to filter by time range, project, service, or SKU, and view cost trends and breakdowns without additional configuration.

Answer

Cloud Monitoring dashboards with cost metrics.

Answer

Cloud Asset Inventory — it lists all resources and their costs.

Answer

Google Cloud pricing calculator — it shows estimated costs.

Question 2

A company stores customer data in Google Cloud and wants to ensure data confidentiality in the event that hardware is decommissioned and returned by Google. How does Google protect customer data when storage hardware reaches end of life?

Accepted Answer

Google uses approved data erasure and physical destruction processes (shredding, degaussing) for decommissioned storage media before hardware leaves its facilities.. Option B is correct because Google Cloud follows strict data destruction policies for decommissioned storage media. Before any hardware leaves Google's facilities, it undergoes approved data erasure (e.g., NIST SP 800-88 compliant wiping) followed by physical destruction (e.g., shredding, degaussing) to ensure customer data cannot be recovered. This process guarantees data confidentiality even if the hardware is returned or recycled.

Answer

Google transfers customer data to new hardware first, then ships the old hardware to the customer for self-destruction.

Answer

Customer data on decommissioned hardware is automatically encrypted, making it safe to discard without wiping.

Answer

Customers must pay a data destruction fee to ensure their data is wiped from decommissioned hardware.

Question 3

A company runs workloads across Google Cloud and on-premises environments. They want a single management plane to deploy and manage containerized applications consistently across both environments using the same tooling and policies. Which Google Cloud product provides this unified hybrid/multi-cloud management?

Accepted Answer

Anthos — Google's hybrid and multi-cloud application management platform.. Anthos is Google Cloud's hybrid and multi-cloud application management platform that provides a single control plane for deploying and managing containerized applications consistently across on-premises and cloud environments. It uses GKE on-prem and Anthos Config Management to enforce uniform policies, service mesh, and CI/CD pipelines, enabling the unified management described in the scenario.

Answer

Cloud Interconnect — it connects on-premises to Google Cloud.

Answer

Google Distributed Cloud — runs Google Cloud services inside the customer's data center.

Answer

Cloud Deployment Manager — deploys resources via infrastructure-as-code templates.

Question 4

A company exports all their Google Cloud logs to Cloud Storage for long-term retention required by their compliance policy (7-year log retention). Which Cloud Logging feature enables routing logs to Cloud Storage?

Accepted Answer

Configure a Cloud Logging sink (log router) that routes logs to a Cloud Storage bucket.. Cloud Logging uses sinks (log routers) to export logs to supported destinations, including Cloud Storage. A sink defines a filter and a destination; when configured, it routes matching log entries to the specified Cloud Storage bucket for long-term retention. This is the only native mechanism for continuous, automated log export without custom scripting.

Answer

Cloud Logging automatically archives all logs to Cloud Storage with no configuration needed.

Answer

Enable log streaming in Cloud Storage settings to receive logs from Cloud Logging.

Answer

Use the Cloud Logging API to periodically download logs and upload them to Cloud Storage.

Question 5

A company's monolithic application is difficult to update because any change requires testing and redeploying the entire application, causing multi-hour downtime during updates. The team is considering a microservices architecture. What is the primary benefit of microservices in this context?

Accepted Answer

Each service can be updated and deployed independently, enabling teams to release changes faster with lower risk and without full-application downtime.. Microservices architecture decomposes a monolithic application into small, independently deployable services. Each service can be updated, scaled, and deployed without affecting other services. This eliminates the 'entire-application-redeploy' problem — updating the payment service doesn't require redeploying the catalog or user management services. Cloud platforms support microservices with containers (GKE), serverless functions (Cloud Run), and managed messaging (Pub/Sub) for service communication.

Answer

Microservices always cost less than monolithic applications to run.

Answer

Microservices eliminate the need for testing because each service is small enough to be bug-free.

Answer

Microservices allow applications to run on any hardware without modification.

Question 6

After a major production outage, the engineering team conducts a review of what happened, why it happened, and how to prevent it in the future. This document is shared with all engineering teams. What is this practice called, and why does Google's SRE culture emphasize it?

Accepted Answer

Blameless postmortem — documenting the incident, root causes, and preventive actions to drive systemic learning without individual blame.. Option B is correct because a blameless postmortem is a core SRE practice that focuses on documenting incidents, root causes, and preventive actions without assigning individual blame. Google's SRE culture emphasizes this to foster psychological safety, enabling teams to openly share failures and drive systemic improvements, which is essential for maintaining high reliability in large-scale distributed systems.

Answer

Performance review — identifying which engineers caused the outage for disciplinary action.

Answer

Capacity planning review — ensuring enough servers are provisioned to prevent future outages.

Answer

Change advisory board (CAB) review — approving that the outage fix is safe to deploy.

Question 7

Google Cloud's infrastructure is designed to be highly available across multiple failure domains. What are 'availability zones' in Google Cloud, and how do they differ from 'regions'?

Accepted Answer

A region is a geographic area containing multiple isolated zones; zones have independent failure domains but low-latency connectivity within the region.. Option B is correct because in Google Cloud, a region is a specific geographic location composed of multiple zones, each of which is an isolated failure domain with independent power, cooling, and networking. Zones within the same region are connected by low-latency, high-bandwidth links, enabling high availability and fault tolerance for applications. This design ensures that a failure in one zone does not affect resources in another zone within the same region.

Answer

Zones are continents; regions are individual countries within a continent.

Answer

Zones and regions are different terms for the same thing — Google uses them interchangeably.

Answer

A zone is a global resource; a region is a local data center.

Question 8

A company's application traffic is served by a Google Cloud global HTTP load balancer. They want to understand how request traffic distributes across backend instances in different regions. Which metric best represents this distribution?

Accepted Answer

`loadbalancing/https/request_count` filtered by backend service and region.. The `loadbalancing/https/request_count` metric, when filtered by backend service and region, directly shows the number of requests handled by each regional backend. This allows you to see how traffic is distributed across regions, which is exactly what the question asks for.

Answer

`compute/instance/cpu/utilization` per instance group.

Answer

`networking/vm_flow/egress_bytes_count` per VM.

Answer

`logging/log_entry_count` filtered by region.

Question 9

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

Accepted Answer

Customers can schedule tours of Google data centers to verify security practices directly.. Option C is correct because Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Answer

Biometric authentication and badge access controls at multiple security perimeters.

Answer

24/7 on-site security personnel who monitor the facility continuously.

Answer

Secure hardware destruction procedures for decommissioned storage devices.

Question 10

What is the difference between a Service Level Indicator (SLI), a Service Level Objective (SLO), and a Service Level Agreement (SLA)?

Accepted Answer

SLI is the measured metric; SLO is the internal target for that metric; SLA is the contractual customer commitment.. Option B is correct because it accurately defines the relationship: an SLI is a specific metric (e.g., request latency at the 99th percentile), an SLO is the internal target for that metric (e.g., 99.9% of requests under 200ms), and an SLA is the contractual commitment to a customer (e.g., 99.9% uptime with financial penalties). This aligns with Google Cloud's Site Reliability Engineering (SRE) practices, where SLIs are measured, SLOs are internal goals, and SLAs are legal agreements.

Answer

SLI is the contract with customers; SLO is the internal target; SLA is the measurement.

Answer

SLI, SLO, and SLA are all the same thing — different names for uptime guarantees.

Answer

SLA is measured in milliseconds; SLO is measured in percentage; SLI has no unit.

Question 11

A company wants to proactively identify underutilized Compute Engine VMs (high provisioned capacity but low actual usage) to reduce costs. Which Google Cloud tool provides recommendations for right-sizing VMs?

Accepted Answer

Active Assist Recommender — ML-based VM rightsizing recommendations.. Google Cloud's Active Assist provides intelligent recommendations including VM rightsizing recommendations. These are powered by ML analysis of actual VM CPU and memory utilization over the past 8 days. The recommendations appear in the Cloud Console (Compute Engine → VM instances → Recommendations) and in the Recommender API. Rightsizing recommendations suggest optimal machine types based on observed usage, often identifying VMs that can be downsized to save significant costs.

Answer

Cloud Monitoring — set alerts for low CPU utilization.

Answer

Cloud Asset Inventory — lists all VMs and their configurations.

Answer

Cloud Billing budgets — set spending limits to prevent overspend.

Question 12

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

Accepted Answer

Access Context Manager with device policy conditions requiring managed, compliant devices.. Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Answer

Cloud Armor — it inspects device fingerprints on incoming requests.

Answer

Cloud Firewall rules that allow only corporate office IP ranges.

Answer

Two-step verification — the second factor proves the device is trusted.

Question 13

A city government deploys thousands of IoT sensors (traffic, air quality, energy usage, waste levels) and analyzes the data in real time to optimize traffic signals, dispatch waste collection vehicles proactively, and adjust street lighting automatically. What concept describes this use of cloud and IoT?

Accepted Answer

Smart city — using cloud, IoT, and AI to optimize city operations and resource utilization in real time.. A smart city uses digital technology — IoT sensors, cloud analytics, AI, and connectivity — to optimize city operations, improve resident quality of life, and use resources more efficiently. Cloud platforms receive sensor data via IoT Core or Pub/Sub, process it with Dataflow, analyze patterns with BigQuery and AI, and trigger automated responses (traffic signal changes, dispatch notifications). This is one of the most impactful applications of cloud transformation at city scale.

Answer

E-government — providing digital access to government services online.

Answer

Digital twin — creating virtual replicas of city infrastructure.

Answer

Edge computing — processing data locally at each sensor to reduce cloud bandwidth.

Question 14

A company uses service accounts to allow their application running on a Compute Engine VM to access Cloud Storage. Which is the most secure way to configure this service account access?

Accepted Answer

Attach the service account to the Compute Engine VM; the application obtains credentials automatically via the metadata server with no key files needed.. Option B is correct because attaching a service account to a Compute Engine VM allows the application to automatically obtain short-lived OAuth 2.0 access tokens from the instance metadata server (http://169.254.169.254). This eliminates the need to download, store, or manage any long-lived service account key files, which are a significant security risk. The metadata server provides credentials that are automatically rotated and scoped to the service account's IAM roles, making this the most secure method for accessing Cloud Storage from a VM.

Answer

Download the service account key JSON file and store it in the application's source code repository.

Answer

Grant all users the Storage Admin role so the application can access Cloud Storage through their credentials.

Answer

Create a shared service account key file accessible to all VMs via a Cloud Storage bucket.

Question 15

A company's cloud costs have increased by 40% over the past quarter. The operations team wants to identify and address the root causes. Which cost optimization strategies should they investigate first?

Accepted Answer

Identify idle and underutilized resources (oversized VMs, unused disks, unattached IPs), apply lifecycle policies to storage, and commit to CUDs for stable workloads.. Option B is correct because the first step in cloud cost optimization is to identify and eliminate waste from idle or oversized resources, which is the most common source of cost inefficiency. Applying lifecycle policies to storage and committing to Committed Use Discounts (CUDs) for stable workloads are proven strategies to reduce costs without compromising performance. This approach aligns with Google Cloud's recommended FinOps practices, focusing on immediate, high-impact savings before considering architectural changes.

Answer

Immediately upgrade all infrastructure to the latest generation hardware for better efficiency.

Answer

Migrate all workloads to Spot VMs immediately to reduce costs by 90%.

Answer

Switch cloud providers to whoever has the lowest advertised list price.

Question 16

A company stores encryption keys in Cloud KMS to protect sensitive data. What does Cloud KMS provide that standard application-layer encryption does not?

Accepted Answer

Centralized key lifecycle management with IAM-controlled access, audit logs, rotation policies, and optional HSM-backed key protection.. Cloud KMS provides centralized key lifecycle management, including IAM-based access control, audit logging, automatic key rotation, and optional HSM-backed key protection. Standard application-layer encryption typically embeds keys within the application code or configuration, lacking these governance and security controls. This separation of key management from application logic is a core security best practice.

Answer

Faster encryption performance because Google's hardware is optimized for cryptographic operations.

Answer

The ability to encrypt data without any performance impact on the application.

Answer

Free unlimited encryption for all data stored in Google Cloud.

Question 17

A company's PostgreSQL database has grown to 50 TB and their application requires near-zero downtime, automatic failover, and the ability to scale reads horizontally without the migration complexity of switching to Spanner. Which Google Cloud database product is specifically designed as a fully managed, highly scalable PostgreSQL-compatible database?

Accepted Answer

AlloyDB for PostgreSQL. AlloyDB for PostgreSQL is a fully managed, PostgreSQL-compatible database service designed for high scalability, near-zero downtime, and automatic failover. It separates compute and storage to enable horizontal read scaling with read pools, and it uses a columnar engine for analytical acceleration, making it ideal for large workloads like 50 TB without the migration complexity of Spanner.

Answer

Cloud SQL (PostgreSQL)

Answer

Cloud Spanner

Answer

Bare metal PostgreSQL on Compute Engine

Question 18

A Virtual Private Cloud (VPC) in Google Cloud provides network isolation. What does 'network isolation' mean in this context, and why is it important?

Accepted Answer

VPC provides a logically isolated private network where resources are separated from other customers' networks by default, preventing unauthorized cross-customer traffic.. Option B is correct because a Google Cloud VPC provides a logically isolated private network within the shared Google Cloud infrastructure. This isolation ensures that resources in one customer's VPC cannot directly communicate with resources in another customer's VPC by default, preventing unauthorized cross-customer traffic. This is achieved through software-defined networking (SDN) constructs like virtual firewalls and routing tables, not through physical separation.

Answer

Network isolation means the VPC blocks all internet access — resources cannot communicate with external services.

Answer

Network isolation means all traffic within the VPC is automatically encrypted.

Answer

A VPC requires dedicated physical hardware separate from other customers to ensure isolation.

Question 19

A company uses Google Cloud across 5 teams, 20 projects, and 3 regions. They want to enforce a standard that all resources include specific labels (e.g., `team`, `environment`, `cost-center`) for cost attribution and governance. What is the most scalable way to enforce this labeling standard?

Accepted Answer

Enforce labeling through IaC templates with required label variables in CI/CD pipelines, and use Cloud Asset Inventory to audit compliance.. Option B is correct because it combines Infrastructure as Code (IaC) templates with required label variables in CI/CD pipelines to enforce labeling at resource creation time, and uses Cloud Asset Inventory to audit and detect non-compliant resources. This approach is scalable across 5 teams, 20 projects, and 3 regions because it automates enforcement and provides continuous compliance monitoring without manual intervention.

Answer

Send monthly reminders to all teams via email to add labels to their resources.

Answer

Manually add labels to all existing and new resources through the Cloud Console.

Answer

Grant only project owners permission to create resources, and rely on them to enforce labeling.

Question 20

A team uses multiple cloud services and wants to deploy all resources — VPCs, Cloud SQL databases, GKE clusters, and IAM roles — using a declarative, open-source infrastructure-as-code tool that works across multiple cloud providers. Which tool integrates natively with Google Cloud for this purpose?

Accepted Answer

Terraform. Terraform is the correct choice because it is a declarative, open-source infrastructure-as-code tool that supports multiple cloud providers, including Google Cloud, through its provider plugin architecture. It allows you to manage VPCs, Cloud SQL databases, GKE clusters, and IAM roles using HashiCorp Configuration Language (HCL) and integrates natively with Google Cloud via the google provider.

Answer

Cloud Deployment Manager — Google's native IaC service.

Answer

Cloud Build — it builds and deploys application code.

Answer

Ansible — it automates server configuration management.