Cloud Digital Leader Practice Test 4 — 25 Questions

Question 1

A machine learning team wants to train, evaluate, deploy, and monitor ML models in a unified platform without managing infrastructure, and with built-in support for experiment tracking, model versioning, and A/B testing between model versions. Which Google Cloud product provides this end-to-end managed ML platform?

Accepted Answer

Vertex AI, Google Cloud's unified ML platform covering training, experiment tracking, model registry, deployment, and monitoring in a single managed service. Vertex AI is Google Cloud's unified ML platform that provides an end-to-end managed service for training, evaluating, deploying, and monitoring ML models without requiring infrastructure management. It includes built-in experiment tracking, a model registry for versioning, and supports A/B testing between model versions, directly matching the question's requirements.

Answer

BigQuery ML, for training and deploying ML models using SQL within BigQuery

Answer

Cloud Dataproc, for running distributed Spark ML jobs on managed Hadoop clusters

Answer

Cloud Functions, for deploying ML inference code as serverless functions

Question 2

A company's compliance team asks what evidence they can provide to regulators to demonstrate that Google Cloud services meet industry security standards. Which type of documentation most directly provides this evidence?

Accepted Answer

Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager, which provide independent verification of security controls. Compliance reports and audit certifications from independent third parties (SOC 2 Type II reports, ISO 27001 certificates, PCI DSS attestation) are the most credible evidence for regulators. These documents represent independent auditors certifying that specific controls were in place and operating effectively during the audit period. Google Cloud makes these reports available to customers through the Compliance Reports Manager.

Answer

Google Cloud's marketing materials and product documentation describing security features

Answer

The company's own internal security policies that reference using Google Cloud

Answer

A Google Cloud support ticket confirming that the company's account is in good standing

Question 3

A company is planning a cloud architecture and needs to decide between a monolithic application design and a microservices architecture. What is the most significant operational trade-off between these two approaches in a cloud environment?

Accepted Answer

Microservices enable independent deployment and scaling per component but introduce distributed systems complexity (network overhead, distributed tracing, service discovery, consistency challenges); monoliths are simpler to operate but scale and deploy as a unit. Monoliths are simpler to develop, test, and deploy initially but scale as a unit and create tight coupling — a change to one part requires deploying the whole application. Microservices enable independent deployment and scaling of components but introduce distributed systems complexity (network calls, service discovery, distributed tracing, eventual consistency). Neither is universally better — the trade-off depends on team size, domain complexity, and operational maturity.

Answer

Monoliths can only run on-premises, while microservices were designed specifically for cloud environments

Answer

Microservices are always cheaper to operate in the cloud because each service uses fewer resources than a monolith

Answer

Monolithic applications cannot be scaled horizontally in cloud environments

Question 4

A cloud team wants to understand their current Google Cloud resource inventory — specifically, which VMs are running in each region, their machine types, and whether they have public IP addresses. Which approach most efficiently provides this across all projects?

Accepted Answer

Use Cloud Asset Inventory to run a single org-wide query that returns all VM instances, their regions, machine types, and network configurations across all projects. Cloud Asset Inventory provides a single, unified API to query resources across all projects in an organization. By using the `gcloud asset search-all-resources` command with the `--asset-types=compute.googleapis.com/Instance` filter, you can retrieve all VM instances along with their regions, machine types, and network configurations (including public IP addresses) in one operation, without needing to access each project individually.

Answer

Log into each Google Cloud project individually through the Console and manually record VM details in a spreadsheet

Answer

Check the Cloud Billing reports, which list all resources that have incurred charges by resource type

Answer

Enable VPC flow logs in each project to capture VM network activity

Question 5

A company is building a new application that needs to send transactional emails (order confirmations, password resets, account notifications) to customers. Google Cloud does not provide a native SMTP email service. Which approach is standard for sending transactional emails from Google Cloud applications?

Accepted Answer

Integrating a third-party transactional email service (such as SendGrid, Mailgun, or Postmark) via API from the Cloud Run or Cloud Functions application. Option B is correct because Google Cloud does not offer a native SMTP service for sending transactional emails. The standard approach is to integrate a third-party transactional email service (e.g., SendGrid, Mailgun, Postmark) via API from serverless compute services like Cloud Run or Cloud Functions. These services handle deliverability, reputation, and compliance with email standards (SPF, DKIM, DMARC) that are critical for transactional email.

Answer

Using Cloud Storage to store email templates and delivering them directly to customers' inboxes

Answer

Running a self-managed SMTP server on a Compute Engine VM and configuring MX records to deliver email

Answer

Using Gmail directly by authenticating the application with a corporate Gmail account and sending through Gmail SMTP

Question 6

An organization wants to use Google Cloud for processing healthcare data subject to HIPAA regulations in the United States. Which contractual document must the organization obtain from Google before storing Protected Health Information (PHI) in Google Cloud?

Accepted Answer

A Business Associate Agreement (BAA), which is legally required by HIPAA before any covered entity can process Protected Health Information with a cloud provider. Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Answer

A Non-Disclosure Agreement (NDA) to prevent Google from disclosing the existence of the healthcare application

Answer

A Data Processing Agreement (DPA) as required under GDPR for European data subjects

Answer

An ISO 27001 certificate issued by Google Cloud demonstrating information security compliance

Question 7

A CISO is designing an identity strategy for Google Cloud that follows Zero Trust principles. She proposes that no long-lived credentials (API keys, service account keys) should be used for any automated workloads. What Google Cloud mechanism replaces service account keys for authenticating workloads running on Google Cloud infrastructure?

Accepted Answer

Attaching a service account to the Compute Engine VM or GKE workload, allowing the workload to obtain short-lived access tokens from the metadata server automatically — no key files required. Option B is correct because Google Cloud's default service account attached to Compute Engine VMs or GKE nodes uses the metadata server to automatically obtain short-lived OAuth 2.0 access tokens (typically valid for 1 hour). This eliminates the need for any long-lived key files, aligning with Zero Trust principles by reducing credential exposure and enabling automatic rotation.

Answer

Using long-lived API keys stored in Secret Manager instead of environment variables — the keys are the same but stored more securely

Answer

Rotating service account keys every 24 hours to minimize the exposure window

Answer

Using OAuth 2.0 user accounts instead of service accounts for all automated workloads

Question 8

A cloud team wants to automatically enforce that all new Compute Engine VMs are created with a specific label (environment: production) and that no VMs are created with external IP addresses in the production project. Which Google Cloud capability enforces these organizational policies at resource creation time?

Accepted Answer

Organization Policy Service constraints that enforce no external IPs and required labels at resource creation time, blocking non-compliant VMs before they are created. Organization Policy Service constraints, specifically `compute.vmExternalIpAccess` and `compute.requireOsLogin` or custom constraints for labels, are evaluated at resource creation time. They block non-compliant VM creation before the API call succeeds, enforcing policies like 'no external IPs' and 'required labels' without relying on post-creation detection or IAM permissions.

Answer

Cloud Monitoring alerting policies that detect and notify when non-compliant VMs are created

Answer

Cloud IAM roles that prevent developers from creating VMs without the proper labels

Answer

Cloud Billing budget alerts that detect when VM spending exceeds expected amounts for labeled resources

Question 9

A company's security policy requires that when an employee is terminated, their access to all cloud resources must be revoked immediately — including any active sessions. Which approach most comprehensively achieves this in a Google Cloud environment integrated with Google Workspace?

Accepted Answer

Disabling the employee's Google Workspace account (which immediately invalidates all active sessions and prevents new authentication), then auditing for and revoking any service account keys they created. Disabling the Google Workspace account immediately invalidates all active sessions and prevents new authentication because Google Cloud IAM relies on the Workspace identity for user-based access. This single action revokes access across all Google Cloud projects and services that use that identity, including Cloud Console, gcloud CLI, and API sessions. Auditing and revoking service account keys the user created is necessary because those keys are not tied to the user's Workspace account and remain valid until explicitly deleted.

Answer

Manually reviewing and removing the employee's IAM bindings across all Google Cloud projects one by one

Answer

Changing the employee's password immediately — they can no longer log in with the old password

Answer

Waiting until the end of the business day to revoke access to avoid disrupting active workflows

Question 10

A company wants to connect its on-premises data center to Google Cloud with a reliable, lower-latency connection that doesn't traverse the public internet, but doesn't need the bandwidth of a full Dedicated Interconnect. Which Google Cloud connectivity product is most appropriate?

Accepted Answer

Partner Interconnect, which provides private connectivity through a service provider partner's network — supporting lower bandwidth tiers without requiring a direct physical fiber connection. Partner Interconnect is the correct choice because it provides private connectivity between an on-premises data center and Google Cloud via a service provider partner's network, offering lower bandwidth tiers (e.g., 50 Mbps to 10 Gbps) without requiring a direct physical fiber connection. This meets the requirements for a reliable, lower-latency connection that avoids the public internet, while Dedicated Interconnect would be overkill for bandwidth needs below 10 Gbps.

Answer

Cloud VPN, which creates an encrypted IPsec tunnel over the public internet

Answer

Dedicated Interconnect, which requires provisioning a 10 Gbps or 100 Gbps dedicated physical fiber connection

Answer

Cloud CDN, which caches content at edge locations close to the on-premises data center

Question 11

A company's risk management team wants to understand Google Cloud's approach to supply chain security — specifically, how Google ensures that the hardware and firmware running in its data centers have not been tampered with. Which Google security initiative addresses hardware supply chain integrity?

Accepted Answer

Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance. Option B is correct because Google's Titan security chip is a dedicated hardware root of trust that cryptographically verifies the boot firmware integrity and machine identity at every startup. This ensures that only Google-signed firmware runs on servers, preventing tampering during manufacturing, shipping, or deployment. Titan provides a hardware-anchored attestation chain that validates the entire supply chain from chip fabrication to rack installation.

Answer

Google uses third-party antivirus software to scan all hardware components for tampering before installation

Answer

Google relies on hardware manufacturers' security certifications to ensure supply chain integrity

Answer

Google encrypts all hardware components with AES-256 to prevent tampering

Question 12

A company's cloud operations team is implementing a tagging strategy for cost allocation. They want to ensure that the 'cost-center' label is present on every Compute Engine VM and Cloud Storage bucket created in their Google Cloud organization. Currently, some resources are created without this label. Which combination of controls best enforces and remediates this requirement?

Accepted Answer

Organization Policy custom constraint to prevent creation of resources without the 'cost-center' label (preventive), plus Cloud Asset Inventory to identify existing unlabeled resources for remediation (detective). A preventive control (org policy custom constraint requiring the label) stops future non-compliant resources. A detective/corrective control (Cloud Asset Inventory + Cloud Functions or Security Command Center) finds and remediates existing unlabeled resources. Both are needed for comprehensive enforcement.

Answer

Only organization policy — once new resources are blocked, existing unlabeled resources don't matter

Answer

Only Cloud Asset Inventory monitoring — alerting on unlabeled resources is sufficient without preventing their creation

Answer

Grant all engineers the 'Labels Admin' role to encourage them to add labels voluntarily

Question 13

A telecommunications company has completed a cloud migration but finds that its business agility — the speed at which it can launch new products — has not improved. An analysis reveals that while the infrastructure is now cloud-based, the software development and release processes remain unchanged: quarterly release cycles, lengthy change approval boards, and manual testing. What does this situation illustrate?

Accepted Answer

Cloud infrastructure adoption without modernizing software delivery practices (CI/CD, automated testing, continuous deployment) does not unlock agility; the delivery process is the bottleneck. This illustrates that cloud infrastructure adoption without changing software delivery practices provides limited agility benefits. Cloud's agility potential is unlocked by complementary practices: CI/CD pipelines, automated testing, trunk-based development, and feature flags that enable continuous delivery. Quarterly release cycles with manual testing create the same bottleneck regardless of whether the infrastructure is on-premises or in the cloud.

Answer

The company chose the wrong cloud provider; a different provider's infrastructure would enable faster releases

Answer

Quarterly release cycles are appropriate for telecommunications products that require extensive regulatory testing, and the lack of agility is not a problem

Answer

The company must rebuild all applications as microservices before cloud can provide agility benefits

Question 14

A company's production database is running on a Compute Engine VM with a 500 GB Persistent Disk. The operations team wants to create a backup they can restore from in case of data corruption or accidental deletion. Which Google Cloud capability provides point-in-time backup for Persistent Disks?

Accepted Answer

Persistent Disk Snapshots, which capture the disk state at a point in time and enable restoration or creation of new disks from that snapshot. Persistent Disk Snapshots are the correct Google Cloud feature for creating point-in-time backups of Persistent Disks. They capture the disk's data and configuration at a specific moment, allowing you to restore the disk or create new disks from that snapshot. This is the native, recommended method for backup and disaster recovery of Compute Engine VM disks.

Answer

Cloud Storage bucket replication, by continuously copying the database files to a storage bucket

Answer

Cloud SQL automated backups, which protect databases running on Compute Engine VMs

Answer

VM live migration, which moves the running VM between physical hosts, automatically creating a backup in the process

Question 15

A non-technical manager asks what a 'virtual machine' is and how it differs from the physical servers the company used to run in its own data center. Which explanation is most accurate and accessible?

Accepted Answer

A virtual machine is a complete software-defined computer that runs on shared physical hardware, providing the same capabilities as a dedicated server but created and managed through software in minutes. Option B is correct because a virtual machine (VM) is a software-based emulation of a physical computer that runs on shared physical hardware via a hypervisor. It provides the same capabilities as a dedicated server (CPU, memory, storage, networking) but can be provisioned, cloned, and managed in minutes through software, which is the core difference from traditional on-premises physical servers that require manual setup and are tied to specific hardware.

Answer

A virtual machine is a web-based application that runs in a browser and replaces traditional desktop software

Answer

A virtual machine is a physical server located in the cloud provider's data center that is reserved exclusively for one customer

Answer

A virtual machine is a type of database that stores data virtually rather than on physical disk

Question 16

A company's finance director asks: 'If we move to cloud, do we need to buy fewer servers?' An IT architect responds that the answer depends on whether the company is adopting IaaS, PaaS, or SaaS. How does the service model affect hardware ownership?

Accepted Answer

In all three models, the cloud provider owns and manages the physical hardware, eliminating the need for customer-owned servers for those workloads — with IaaS requiring the most customer management (VMs) and SaaS requiring the least (just use the application). Option B is correct because in IaaS, PaaS, and SaaS, the cloud provider owns and manages the physical hardware in their data centers. The customer's hardware ownership decreases as the service model abstracts more layers: IaaS provides virtual machines (VMs) that the customer manages, PaaS provides a managed platform (runtime, middleware) without customer control over the underlying OS or hardware, and SaaS delivers a fully managed application where the customer only uses the software. Thus, moving to any of these models reduces or eliminates the need for customer-owned servers for those specific workloads.

Answer

All three models (IaaS, PaaS, SaaS) require the same amount of customer-owned hardware since cloud supplements rather than replaces on-premises systems

Answer

Only SaaS eliminates the need for customer servers; IaaS and PaaS still require on-premises hardware for hybrid connectivity

Answer

The service model doesn't affect hardware ownership — hardware purchase decisions are independent of whether the company uses cloud services

Question 17

An organization's security team reviews their Google Cloud environment and finds that several Cloud Storage buckets have `allAuthenticatedUsers` bindings, and multiple service accounts have the Owner role. Which Google Cloud tool automatically identifies these types of high-risk IAM configurations?

Accepted Answer

Security Command Center (SCC) with IAM Recommender and Security Health Analytics.. Security Command Center (SCC) with Security Health Analytics and IAM Recommender is the correct tool because it automatically scans for high-risk IAM configurations, such as `allAuthenticatedUsers` bindings on Cloud Storage buckets and service accounts with the Owner role. Security Health Analytics detects misconfigurations against CIS benchmarks and Google Cloud best practices, while IAM Recommender provides actionable recommendations to reduce excessive permissions. This combination proactively identifies and helps remediate these specific security risks without requiring manual log review or billing analysis.

Answer

Cloud Audit Logs — reviewing all recent IAM changes.

Answer

Cloud Billing reports — they flag expensive configurations that indicate security issues.

Answer

Cloud Monitoring — it alerts when IAM policies are modified.

Question 18

Drag and drop the steps to configure a load balancer for an HTTP application on Compute Engine into the correct order.

Question 19

Drag and drop the steps to set up a Cloud Storage bucket with uniform bucket-level access into the correct order.

Question 20

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) into the correct order.