Cloud Digital Leader Practice Test 3 — 25 Questions

Question 1

A company's security team wants to ensure that only approved corporate devices can access Google Cloud resources, regardless of whether the user has valid credentials. Which Google Cloud security capability enforces device-level access requirements?

Accepted Answer

Access Context Manager, which enforces device-level access requirements as part of context-aware access control policies. Access Context Manager is the correct choice because it allows security teams to define context-aware access policies that include device-level attributes such as device OS type, device ID, and whether the device is managed (e.g., via endpoint verification or third-party EMM). This enforces device-level access requirements even if the user has valid credentials, directly addressing the scenario.

Answer

Cloud Armor, which filters incoming requests based on IP allowlists and denylists

Answer

Identity-Aware Proxy (IAP), which provides application-level authentication but without device checks

Answer

VPC Service Controls, which restrict access to Google APIs based on network perimeter membership

Question 2

A software team deploys microservices using containers and wants Google Cloud to automatically manage the scaling, self-healing, and rollout of their containerized applications. They don't want to provision or manage underlying virtual machines. Which Google Cloud service best meets this need?

Accepted Answer

Google Kubernetes Engine (GKE), which manages containerized applications with automatic scaling, self-healing, and rolling updates. Google Kubernetes Engine (GKE) is the correct choice because it provides a managed Kubernetes environment that automates scaling, self-healing (e.g., automatic pod restarts and node repair), and rollout management (e.g., rolling updates and rollbacks) for containerized applications. This meets the requirement of not provisioning or managing underlying virtual machines, as GKE abstracts the node infrastructure.

Answer

Compute Engine, Google Cloud's virtual machine service

Answer

Cloud Storage, for storing container images and serving them to instances

Answer

Cloud CDN, which distributes containerized applications globally

Question 3

A marketing team wants to create interactive dashboards and reports for business stakeholders using data stored in BigQuery, without writing code. Which Google Cloud product is most appropriate for this self-service business intelligence requirement?

Accepted Answer

Looker Studio, Google's self-service data visualization tool with native BigQuery connectivity and a no-code interface. Looker Studio (formerly Google Data Studio) is the correct choice because it is Google Cloud's self-service business intelligence tool that provides a no-code, drag-and-drop interface for creating interactive dashboards and reports. It has native, built-in connectivity to BigQuery, allowing the marketing team to visualize data without writing any code or SQL queries.

Answer

Cloud Dataflow, Google Cloud's stream and batch data processing service

Answer

BigQuery itself, where the marketing team writes SQL queries to generate reports

Answer

Vertex AI, Google Cloud's unified machine learning platform

Question 4

A healthcare provider wants to use AI to analyze unstructured medical records — scanned documents with handwritten notes and printed text — to extract diagnosis codes for billing. Which combination of Google Cloud AI products most directly addresses this document understanding use case?

Accepted Answer

Document AI and Vision API, which together handle OCR, layout understanding, and information extraction from scanned documents with handwritten and printed text. Option B is correct because Document AI is purpose-built for extracting structured information (like diagnosis codes) from unstructured documents, including both handwritten and printed text, using OCR and layout understanding. The Vision API complements this by providing advanced OCR capabilities for scanned images, together forming a direct solution for the healthcare provider's document understanding use case.

Answer

BigQuery ML and Looker Studio, to analyze and visualize the extracted diagnosis codes

Answer

Vertex AI Pipelines and Cloud Dataflow, to orchestrate machine learning training jobs on document data

Answer

Cloud Translation API and Natural Language API, to translate and analyze the text content of medical records

Question 5

A company has employees who use personal (unmanaged) devices to access corporate applications. The security team wants to prevent sensitive Google Workspace documents from being downloaded to personal devices. Which Google control most directly addresses this data loss prevention requirement for device-based scenarios?

Accepted Answer

Google Workspace context-aware access and endpoint management controls that restrict actions (such as downloads) for users accessing from unmanaged personal devices. Option B is correct because Google Workspace context-aware access combined with endpoint management allows administrators to create access level policies that restrict specific actions—such as downloading, printing, or copying—based on device trust signals. When a user accesses Google Workspace from an unmanaged personal device, the policy can block the download of sensitive documents directly, addressing the data loss prevention requirement at the action level rather than just the access level.

Answer

Cloud Armor, by blocking requests from IP addresses associated with personal devices

Answer

Enabling two-factor authentication for all users, which prevents unauthorized access

Answer

Encrypting all Google Drive files so they cannot be read on personal devices

Question 6

A company's security policy requires that all cloud-to-cloud communication between services must be encrypted in transit. An auditor asks how Google Cloud handles encryption for network traffic between Google services within its network. What is Google's default approach to encryption in transit within its infrastructure?

Accepted Answer

Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required. Google Cloud encrypts all network traffic between its data centers and internal services by default, using application-layer (e.g., gRPC with TLS) and link-layer encryption (e.g., MACsec or similar). This is a foundational security measure that requires no customer configuration, ensuring data is protected in transit even within Google's own infrastructure.

Answer

Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication

Answer

Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance

Answer

Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network

Question 7

A CTO explains to her board that moving to cloud reduces the company's 'total cost of ownership' compared to running an on-premises data center. Which cost category is most commonly underestimated in on-premises TCO calculations?

Accepted Answer

IT staff labor costs for ongoing maintenance, patching, hardware replacement, and operations, which are frequently underestimated in on-premises TCO. Option B is correct because on-premises TCO calculations frequently underestimate the labor costs associated with ongoing IT staff tasks such as applying security patches, performing hardware replacements, managing firmware updates, and handling day-to-day operations. These operational expenses (OpEx) accumulate over the lifecycle of the data center and often exceed the initial capital expenditure (CapEx) for hardware, making them a critical but overlooked component in total cost of ownership comparisons with cloud providers like AWS, Azure, or GCP.

Answer

Hardware acquisition costs, which are typically overestimated in on-premises environments

Answer

Software licensing costs, which are always higher on-premises than in the cloud

Answer

Internet bandwidth costs, which are negligible on-premises

Question 8

A company is evaluating whether to adopt a multi-cloud strategy (using two or more cloud providers for different workloads). An engineer lists the following arguments: (1) resilience against a single cloud provider outage, (2) negotiating leverage on pricing, (3) using best-of-breed services from each provider. A cloud architect cautions that multi-cloud also introduces significant challenges. What is the most significant operational challenge of a multi-cloud approach?

Accepted Answer

Significantly increased operational complexity: teams need expertise in multiple providers' tools, security models, and APIs, while governance, monitoring, and cost management must span inconsistent environments. Option B is correct because multi-cloud environments inherently increase operational complexity. Teams must master distinct APIs, security models (e.g., IAM policies differ between AWS and GCP), monitoring tools (e.g., CloudWatch vs. Cloud Monitoring), and cost management consoles. Governance and compliance must be enforced consistently across heterogeneous platforms, which often requires custom tooling or third-party solutions, making day-to-day operations significantly more challenging than a single-cloud approach.

Answer

Multi-cloud requires purchasing separate hardware for each cloud provider's environment

Answer

Cloud providers refuse to allow customers to use competing providers simultaneously

Answer

Multi-cloud makes it impossible to use any managed services because applications must be portable across providers

Question 9

A software team wants to host their container images securely within Google Cloud and integrate with Cloud Build for CI/CD pipelines and GKE for deployments. Which Google Cloud product serves as the managed repository for storing and managing container images?

Accepted Answer

Artifact Registry, Google Cloud's managed repository for container images and build artifacts with native CI/CD integration. Artifact Registry is Google Cloud's fully managed, next-generation repository for storing, managing, and securing container images and build artifacts. It natively integrates with Cloud Build for CI/CD pipelines and GKE for deployments, providing features like vulnerability scanning, access control via IAM, and support for multiple formats (Docker, Maven, npm, etc.). This makes it the correct choice for the team's requirements.

Answer

Cloud Storage, by storing container images as objects in a bucket

Answer

Container Registry (gcr.io), the legacy Google container image service

Answer

Cloud Source Repositories, for storing source code and container build files

Question 10

An organization wants to ensure that Google Cloud services used by its employees cannot be used to exfiltrate data to a competitor's Google Cloud project. For example, they want to prevent copying data from their Cloud Storage bucket to a Storage bucket owned by a competitor. Which Google Cloud security control most directly prevents this type of insider data exfiltration?

Accepted Answer

VPC Service Controls, which create a security perimeter around Google Cloud APIs so data cannot be moved to projects outside the defined perimeter. VPC Service Controls (C) directly prevent data exfiltration by creating a security perimeter around Google Cloud APIs. This perimeter blocks any data movement to resources outside the defined perimeter, such as a competitor's Cloud Storage bucket, regardless of the user's IAM permissions. It works at the API layer, intercepting requests that attempt to copy data to an unauthorized project.

Answer

IAM permissions that restrict users from accessing competitor projects

Answer

Cloud DLP, by scanning and redacting sensitive data before it can be stored

Answer

Organization Policy constraints that prevent resource creation in competitor accounts

Question 11

A company's cloud environment has grown rapidly and the team is struggling to understand what cloud resources exist across dozens of projects. Which Google Cloud product provides a unified inventory of all cloud assets across an organization's projects and folders?

Accepted Answer

Cloud Asset Inventory, which provides a searchable, unified inventory of all resources and IAM policies across an organization's projects and folders. Cloud Asset Inventory is the correct answer because it is the Google Cloud service specifically designed to provide a unified, searchable inventory of all cloud assets (resources and IAM policies) across an organization's projects, folders, and organization nodes. It supports real-time and historical snapshots, enabling teams to discover and track resources as the environment scales. This directly addresses the need to understand what resources exist across dozens of projects.

Answer

Cloud Billing console, which lists all resources that have incurred charges

Answer

Google Cloud Console project dashboard, which shows resources within a single project

Answer

Security Command Center, which lists security vulnerabilities in cloud resources

Question 12

A DevOps team wants to implement a release process where a new application version is first deployed to 5% of production traffic, monitored for errors, then gradually increased to 100% if metrics remain healthy. Which deployment strategy does this describe?

Accepted Answer

Canary deployment, where a new version receives a small percentage of traffic first and is progressively rolled out as metrics confirm it is healthy. This describes a canary deployment, where the new version is initially exposed to a small subset of users (e.g., 5% of traffic) and then gradually rolled out to 100% only if key metrics (latency, error rate, CPU usage) remain within acceptable thresholds. Google Cloud's Deployment Manager and GKE support canary deployments via traffic splitting with services like Istio or native GKE ingress, allowing fine-grained control over the rollout percentage.

Answer

Blue/green deployment, where two identical environments run simultaneously and traffic is switched atomically

Answer

Rolling deployment, where instances are updated sequentially one at a time until all run the new version

Answer

Recreate deployment, where the old version is terminated before the new version is deployed

Question 13

A media company stores video files, images, and static website assets that must be served globally with low latency. They want an object storage solution that is highly durable, accessible via standard HTTPS, and can be configured to make specific assets publicly accessible. Which Google Cloud storage product is most appropriate?

Accepted Answer

Cloud Storage, Google Cloud's object storage for unstructured data accessible via HTTPS with configurable public access. Cloud Storage is Google Cloud's object storage service designed for unstructured data such as video files, images, and static website assets. It provides global accessibility via standard HTTPS, offers 99.999999999% (11 9's) durability, and supports granular access control through IAM and ACLs, allowing specific assets to be made publicly accessible. This directly matches all the requirements in the question.

Answer

Filestore, Google Cloud's managed NFS file storage service

Answer

Persistent Disk, Google Cloud's block storage for virtual machine instances

Answer

Cloud SQL, Google Cloud's managed relational database service

Question 14

Two competing retail companies adopt cloud at the same time. Company A uses cloud to run its existing applications more cheaply (lift-and-shift). Company B uses cloud to build new personalized customer experiences, real-time inventory optimization, and a mobile-first shopping platform. Five years later, Company B significantly outperforms Company A. What does this outcome illustrate?

Accepted Answer

Cloud adoption creates competitive advantage only when used to transform business models and customer experiences, not just to reduce infrastructure costs. This scenario illustrates the critical distinction between cloud as cost reduction versus cloud as business enablement. Both companies 'adopted cloud,' but Company A treated it as infrastructure cost optimization (digitization) while Company B used it to fundamentally change customer experiences and business operations (digital transformation). The competitive divergence confirms that transformation, not mere migration, is the source of cloud's competitive value.

Answer

Company B must have spent more on cloud than Company A, proving that higher cloud investment always produces better outcomes

Answer

Company A made a mistake by moving to cloud; it should have stayed on-premises to avoid disruption

Answer

Company B succeeded because it used a different cloud provider with superior technology

Question 15

A startup's web application is being targeted by a denial-of-service attack that is flooding its servers with millions of fake requests per second. Which Google Cloud product provides automatic DDoS protection for the application?

Accepted Answer

Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application. Cloud Armor is the correct answer because it is Google Cloud's managed DDoS protection and Web Application Firewall (WAF) service. It uses Google's global infrastructure to absorb and filter volumetric attacks (e.g., SYN floods, UDP reflection attacks) at the edge, before traffic reaches the application. It integrates with Cloud Load Balancing to inspect and drop malicious requests based on pre-configured or adaptive rules.

Answer

Cloud Storage, by distributing the static content of the application across multiple storage regions

Answer

Cloud IAM, by revoking permissions for the IP addresses generating attack traffic

Answer

Cloud Monitoring, by alerting the team so they can manually scale up servers to absorb the attack

Question 16

A cloud team performs a quarterly review of its Compute Engine instances and discovers 15 VMs that have had zero CPU utilization for over 90 days. What is the recommended operational response to these idle resources?

Accepted Answer

Investigate whether each VM is still needed; delete confirmed unused VMs to eliminate wasted spend, potentially saving thousands per month. Option B is correct because the recommended operational response to idle Compute Engine instances is to investigate their necessity and delete them if unused. Idle VMs with zero CPU utilization for over 90 days incur ongoing costs for persistent disks, static IPs, and other attached resources, even if the CPU is idle. Deleting confirmed unused VMs eliminates this wasted spend, potentially saving thousands per month, aligning with Google Cloud's cost optimization best practices.

Answer

Leave the VMs running in case they are needed for future workloads — storage costs are minimal for idle VMs

Answer

Upgrade the idle VMs to larger machine types so they can handle future workloads if needed

Answer

Apply committed use discounts to the idle VMs to reduce their cost while keeping them available

Question 17

A security audit finds that a company's application service accounts have been granted broad IAM roles (e.g., Storage Admin on the entire project) when they only need to read specific Cloud Storage buckets. The auditor recommends following the principle of least privilege. What is the most precise way to implement this for the Cloud Storage use case?

Accepted Answer

Grant Storage Object Viewer (read-only) at the specific bucket level for each service account that needs read access — not at the project level. Option B is correct because it grants the minimal required permission (Storage Object Viewer) at the specific bucket level, adhering to the principle of least privilege. This ensures the service account can only read objects in that bucket and cannot perform any other storage operations, even accidentally. Granting roles at the resource level (bucket) rather than the project level eliminates unnecessary broad access.

Answer

Grant the Storage Admin role at the project level but add a condition that limits it to specific operations

Answer

Create a custom IAM role that combines all permissions from all predefined roles but removes the most dangerous ones

Answer

Use the same broad Storage Admin role but rotate the service account key every 90 days to reduce the window of exposure

Question 18

A company's security team wants to be alerted when someone with administrative permissions changes an IAM policy in their Google Cloud organization. Which Google Cloud capability enables this detection?

Accepted Answer

Admin Activity audit logs combined with Cloud Monitoring log-based alerting, which records and alerts on IAM policy modifications by any principal. Admin Activity audit logs record all changes to IAM policies and other configuration changes in Google Cloud. By combining these logs with Cloud Monitoring log-based alerting, the security team can create a specific alert that triggers whenever an IAM policy is modified by a principal with administrative permissions, enabling real-time detection of unauthorized changes.

Answer

Data Access audit logs, which record when data is read from Cloud Storage buckets

Answer

Cloud Armor, which blocks unauthorized IAM policy changes at the network layer

Answer

VPC flow logs, which capture all network traffic including IAM API calls

Question 19

A bank's innovation team proposes building a new digital lending product using cloud services. The risk team objects, citing regulatory concerns about data sovereignty and auditability in cloud environments. What is the most effective way for the innovation team to address these concerns?

Accepted Answer

Demonstrate that Google Cloud provides the specific regulatory controls needed: data residency configuration, comprehensive audit logging, compliance certifications, and contractual frameworks that satisfy the bank's regulatory requirements. Regulatory concerns about cloud are real but addressable. Cloud providers offer compliance certifications (SOC 2, ISO 27001, banking-specific standards), data residency controls, comprehensive audit logging, and contractual frameworks (BAAs, DPAs). The innovation team should demonstrate that the specific controls required by regulators exist and are configurable, rather than treating cloud as incompatible with regulation.

Answer

Avoid cloud entirely for the new product and build on-premises to eliminate regulatory concerns

Answer

Ignore the risk team's concerns and proceed with cloud development, as regulators have approved cloud for all banking applications globally

Answer

Commission a multi-year study to determine whether cloud regulation will change before proceeding

Question 20

A CISO asks why Google Cloud's security model is described as a 'defense-in-depth' approach. Which explanation best describes this concept in the context of Google Cloud's infrastructure security?

Accepted Answer

Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system. Option B is correct because Google Cloud's defense-in-depth model implements security at multiple independent layers: physical security (e.g., tamper-evident cages), hardware attestation (e.g., Titan chips verifying boot integrity), network encryption (e.g., mTLS between all services), hypervisor isolation (e.g., gVisor or KVM-based sandboxing), and application-level IAM (e.g., Cloud IAM policies). This layered approach ensures that if an attacker bypasses one layer, other layers remain intact to protect the system, aligning with the core principle of defense in depth.

Answer

Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data

Answer

Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary

Answer

Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure