Cloud Digital Leader Practice Test 5 — 25 Questions

Question 1

Drag and drop the steps to set up a Cloud NAT for private Compute Engine instances to access the internet in the correct order.

Question 2

A team needs to process and analyze streaming data in real-time as it arrives from IoT sensors. The pipeline must apply transformations, filter events, and write results to BigQuery. Which Google Cloud service is designed for this stream processing use case?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is the correct choice because it is a fully managed, serverless service designed specifically for stream and batch data processing. It uses Apache Beam as its programming model, enabling you to apply transformations, filter events, and write results to BigQuery in real-time, exactly matching the described pipeline requirements.

Answer

Cloud Dataproc

Answer

Cloud Composer

Answer

BigQuery Streaming Insert

Question 3

A company's security team wants to control which resources on the internet can communicate with their virtual machines in Google Cloud. Which fundamental cloud networking concept provides this control?

Accepted Answer

VPC firewall rules that control inbound and outbound network traffic to VMs based on IP ranges, protocols, and ports. Option A is correct because VPC firewall rules are the fundamental cloud networking construct that controls network traffic to and from virtual machine instances in Google Cloud. These rules operate at the network layer, filtering traffic based on source/destination IP ranges, protocols (e.g., TCP, UDP, ICMP), and port numbers, thereby governing which internet resources can communicate with the VMs.

Answer

Cloud IAM policies that grant or deny permissions for external systems to access VM resources

Answer

Cloud Storage bucket policies that restrict access to VM storage volumes

Answer

DNS records that determine which internet addresses can resolve the VM's hostname

Question 4

A logistics company collects GPS data from 50,000 trucks every 30 seconds. Previously they sampled only 1% of this data due to storage costs. In the cloud, they store and analyze 100% of the data and discover route optimization patterns that reduce fuel costs by 12%. Which concept does this illustrate about cloud and data?

Accepted Answer

Cloud scale removes data storage and analysis constraints, enabling companies to derive business insights from complete datasets that were previously too costly to collect and process.. Option B is correct because it directly captures the core transformation that cloud computing enables: the removal of data storage and processing constraints. By moving from sampling 1% of GPS data to analyzing 100%, the company could identify route optimization patterns that were invisible in the sampled subset, leading to a 12% fuel cost reduction. This illustrates how cloud elasticity and pay-as-you-go pricing allow businesses to process complete datasets, unlocking insights that were previously economically infeasible with on-premises or limited storage.

Answer

Cloud storage is cheaper per GB than on-premises — the only benefit is cost reduction.

Answer

GPS data is only useful when analyzed by Google's AI — the company's own analytics wouldn't find patterns.

Answer

The company should have used data sampling more aggressively to reduce cloud costs further.

Question 5

A security team wants to get a comprehensive, organization-wide view of security misconfigurations (such as publicly accessible storage buckets, VMs without firewalls, and IAM overprivilege), vulnerabilities in container images, and active threats across all Google Cloud projects. Which Google Cloud service provides this unified security posture management?

Accepted Answer

Security Command Center (SCC) — unified security posture management across all GCP projects.. Security Command Center (SCC) is the correct answer because it is Google Cloud's native, unified security and risk management platform that provides continuous monitoring for misconfigurations (e.g., publicly accessible storage buckets, VMs without firewalls, IAM overprivilege), vulnerability scanning for container images, and threat detection across all projects in an organization. It aggregates findings from services like Cloud Asset Inventory, Web Security Scanner, and Event Threat Detection into a single dashboard, enabling comprehensive security posture management.

Answer

Cloud Monitoring — it detects security anomalies through metric analysis.

Answer

Cloud Audit Logs — they show all API calls that could indicate security issues.

Answer

Cloud DLP — it scans all resources for sensitive data exposure.

Question 6

A financial services firm's board asks the CTO to quantify the business value of the company's three-year cloud transformation program. The CTO presents metrics including: 40% faster product launches, 60% reduction in unplanned downtime, and 25% reduction in infrastructure cost. Which framework best describes what these metrics collectively represent?

Accepted Answer

A balanced view of transformation value spanning speed-to-market, operational resilience, and cost efficiency — collectively representing total business value delivered. Option B is correct because the three metrics collectively provide a balanced view of business value from a cloud transformation: speed-to-market (40% faster product launches), operational resilience (60% reduction in unplanned downtime), and cost efficiency (25% reduction in infrastructure cost). This aligns with the GCDL framework's emphasis on measuring total business value beyond just financial ROI, capturing how cloud enables agility, reliability, and cost optimization simultaneously.

Answer

Return on investment calculated purely from infrastructure cost reduction

Answer

A technical benchmark comparing on-premises versus cloud infrastructure performance

Answer

Compliance metrics demonstrating that the transformation met regulatory requirements

Question 7

When a company moves from maintaining its own data center to using Google Cloud, which operational responsibility does Google assume that the company previously managed?

Accepted Answer

Physical hardware maintenance, data center facilities, and network equipment management. When a company migrates from an on-premises data center to Google Cloud, Google assumes responsibility for the physical infrastructure, including hardware maintenance, facility management (power, cooling, security), and network equipment. This is the core of the cloud provider's shared responsibility model, where the provider manages the 'cloud' while the customer manages what is 'in' the cloud. Option B correctly identifies these operational responsibilities that shift to Google.

Answer

Writing and maintaining application code

Answer

Defining which users can access the company's applications

Answer

Backing up the company's application data

Question 8

A developer wants to deploy a containerized web application without managing servers, clusters, or Kubernetes configuration. The application should automatically scale to zero when not in use and handle bursts of traffic. Which Google Cloud service is the best fit?

Accepted Answer

Cloud Run. Cloud Run is the best fit because it is a fully managed serverless container platform that automatically scales to zero when idle and scales up to handle traffic bursts, without requiring any server, cluster, or Kubernetes configuration. The developer simply deploys a container image, and Cloud Run handles all infrastructure management, including scaling and load balancing.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine Standard

Question 9

A team uses Google Workspace (Gmail, Docs, Sheets) for their daily work. They do not manage any servers or software installation — Google maintains everything. Which cloud service model does Google Workspace represent?

Accepted Answer

Software as a Service (SaaS). Google Workspace is a classic example of Software as a Service (SaaS) because users access applications like Gmail, Docs, and Sheets via a web browser without managing the underlying infrastructure, operating systems, or software installations. Google handles all maintenance, security patching, and uptime, which aligns with the SaaS model where the provider delivers fully functional software over the internet. Unlike IaaS or PaaS, the end-user does not control the runtime environment or deploy custom code on the platform.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Database as a Service (DBaaS)

Question 10

A company is planning a cloud migration and wants to understand the difference between 'lift and shift' and 'cloud-native' approaches. Which statement correctly distinguishes these two migration strategies?

Accepted Answer

Lift and shift moves applications to the cloud with minimal changes; cloud-native re-architects applications to leverage cloud-specific features and managed services.. Option B is correct because 'lift and shift' (rehosting) involves moving applications to the cloud with minimal or no changes, often using Infrastructure as a Service (IaaS) to replicate the on-premises environment. In contrast, 'cloud-native' (re-architecting) redesigns applications to use cloud-specific features like auto-scaling, managed databases, and serverless compute, fully leveraging the cloud's elasticity and pay-as-you-go model.

Answer

Lift and shift uses containers; cloud-native uses virtual machines.

Answer

Lift and shift is only possible for new applications; cloud-native is for existing applications.

Answer

Lift and shift costs more long-term; cloud-native costs more short-term due to licensing.

Question 11

A traditional bank processes loan applications using manual paper-based workflows that take 2 weeks per application. The bank wants to use cloud technology to reduce this to under 24 hours. Which cloud-enabled capability primarily drives this transformation?

Accepted Answer

Cloud-based AI/ML services and workflow automation that process applications end-to-end without manual steps.. Option B is correct because cloud-based AI/ML services combined with workflow automation can process loan applications end-to-end without manual intervention, reducing processing time from 2 weeks to under 24 hours. This transformation is driven by the ability to automate document extraction, validation, and decision-making using services like Google Cloud Document AI and Workflows, which eliminate the bottleneck of manual paper-based workflows.

Answer

Lower storage costs for paper documents by digitizing them in Cloud Storage.

Answer

Moving the bank's email system to a cloud-based provider.

Answer

Using Cloud SQL instead of on-premises Oracle database.

Question 12

A CEO asks why the company should invest in a cloud migration when the existing on-premises infrastructure 'still works fine.' Which business case arguments are MOST relevant to present? (Select the best answer.)

Accepted Answer

Cloud enables faster innovation and time-to-market, reduces total cost of ownership, and provides access to advanced capabilities (AI, analytics) that improve competitive positioning.. Option B is correct because it directly addresses the CEO's strategic concerns by highlighting cloud's ability to accelerate innovation and time-to-market, reduce total cost of ownership (TCO) through pay-as-you-go pricing and elimination of hardware lifecycle costs, and provide access to advanced capabilities like AI and analytics that on-premises infrastructure cannot easily match. These arguments frame cloud migration as a competitive necessity rather than a mere technology upgrade, which is the core of the business case.

Answer

The cloud uses newer hardware and newer versions of Linux, which are technically superior.

Answer

Cloud providers have more IT staff than the company, so IT headcount can be reduced immediately.

Answer

The current infrastructure will eventually fail, so proactive migration avoids future risk.

Question 13

A company wants to ensure that sensitive data (credit card numbers, SSNs) stored in BigQuery is automatically identified and protected. They also want ongoing scanning to detect if any new data violates their data governance policies. Which Google Cloud service provides these capabilities?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.. Cloud DLP with BigQuery inspection jobs is the correct choice because it provides both automated identification of sensitive data (such as credit card numbers and SSNs) within BigQuery tables and ongoing scanning capabilities via scheduled inspection jobs. Cloud DLP uses built-in infoType detectors to match patterns like credit card numbers (Luhn check) and SSNs, and can trigger actions or alerts when new data violates governance policies.

Answer

Security Command Center — it scans BigQuery for sensitive data automatically.

Answer

Cloud Monitoring custom dashboards with SQL queries that search for PII patterns.

Answer

Cloud Audit Logs — they record all BigQuery queries and can identify when sensitive columns are accessed.

Question 14

A company has deployed a critical application on Google Cloud and wants to understand what happens to their workloads during a Google Cloud data center maintenance event (e.g., host system upgrades). What Google Compute Engine feature handles this automatically for most VMs?

Accepted Answer

Live migration transparently moves VMs to healthy hosts during maintenance with no VM downtime.. Google Compute Engine uses Live Migration to automatically move running VMs from a host undergoing maintenance (e.g., host system upgrades) to a healthy host without interrupting the VM. This process preserves the VM's memory, network connections, and disk state, resulting in zero VM downtime. It is enabled by default for most VM instances, except those with GPUs or certain machine types that explicitly opt out.

Answer

VMs are terminated and restarted automatically on new hardware, causing a few minutes of downtime.

Answer

VMs are snapshotted, the snapshot is restored on new hardware, and the VM is restarted.

Answer

Customers must subscribe to Google Cloud support to receive advance notice and schedule their own maintenance windows.

Question 15

A company wants to use pre-trained Google AI models to add vision capabilities to their application — specifically to detect objects in images and extract text from scanned documents — without training their own models. Which Google Cloud APIs provide these capabilities?

Accepted Answer

Cloud Vision API for object detection and OCR; Cloud Document AI for structured document extraction.. Option A is correct because Cloud Vision API provides pre-trained models for object detection and OCR (Optical Character Recognition) to extract text from images, while Cloud Document AI specializes in extracting structured data (e.g., fields, tables) from scanned documents. Both services require no custom training, aligning with the company's requirement to use pre-trained Google AI models.

Answer

BigQuery ML for both use cases — it trains vision models on image data stored in BigQuery.

Answer

Vertex AI AutoML Vision — train a custom model on your own images.

Answer

Cloud Natural Language API for text extraction from images.

Question 16

A company's on-premises IT team spends 70% of their time on routine maintenance tasks: patching servers, replacing failed hardware, and upgrading storage. After migrating to Google Cloud managed services, which operational outcome should they expect?

Accepted Answer

The IT team can redirect time from maintenance to higher-value activities like innovation and feature development.. By migrating to Google Cloud managed services like Compute Engine with sole-tenant nodes or fully managed services such as Cloud SQL and Google Kubernetes Engine, the cloud provider handles routine maintenance tasks (patching, hardware replacement, storage upgrades). This frees the IT team from approximately 70% of their previous workload, allowing them to focus on higher-value activities like application innovation, feature development, and optimizing cloud architecture. Option B correctly identifies this shift from operational overhead to strategic work.

Answer

The IT team will need to hire more staff to manage additional cloud infrastructure.

Answer

The IT team will still perform the same tasks but remotely via the Cloud Console.

Answer

The IT team will be fully automated out of their roles by Google's AI.

Question 17

A company's application experiences traffic spikes every weekday morning when employees log in at 9 AM. The team wants their infrastructure to automatically handle these spikes without manual intervention and without over-provisioning resources all day. Which Google Cloud capability addresses this?

Accepted Answer

Configure autoscaling on the application's infrastructure to automatically scale up for load and scale down during off-peak hours.. Option B is correct because Google Cloud's managed instance groups (MIGs) with autoscaling can automatically adjust the number of VM instances based on load metrics (e.g., CPU utilization, requests per second). This handles the 9 AM traffic spike without manual intervention and avoids over-provisioning during off-peak hours by scaling down when demand decreases.

Answer

Purchase reserved capacity for peak load and configure it to be active only on weekdays.

Answer

Deploy additional VMs manually each weekday morning and terminate them at night.

Answer

Use Cloud Monitoring to send an email alert when CPU exceeds 80% so the team can manually scale.

Question 18

A company runs a mission-critical application that must be available 24/7. They want to ensure that if a Google Cloud region becomes unavailable (e.g., due to a natural disaster), the application automatically continues to serve users from another region. Which architecture pattern achieves this?

Accepted Answer

Deploy the application in multiple regions with a Global Load Balancer for automated failover.. Option B is correct because deploying the application in multiple regions behind a Global Load Balancer (GLB) enables automated failover. The GLB uses health checks to detect regional failures and routes traffic only to healthy backends, ensuring continuous availability even if an entire region goes down. This aligns with the requirement for a multi-region active-passive or active-active architecture for disaster recovery.

Answer

Deploy in a single region with a Managed Instance Group using 3 availability zones.

Answer

Enable Cloud Armor on the load balancer to protect against regional failures.

Answer

Use Cloud Storage multi-region buckets for application data.

Question 19

A healthcare company needs to store patient data in Google Cloud and must comply with HIPAA (Health Insurance Portability and Accountability Act). Which statement correctly describes how Google Cloud helps them achieve HIPAA compliance?

Accepted Answer

Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.. Option B is correct because Google Cloud provides HIPAA-eligible services and offers a Business Associate Agreement (BAA) to covered entities, but compliance is a shared responsibility. Customers must configure their own technical safeguards, such as access controls, audit logging, and encryption key management, to meet HIPAA requirements. Google Cloud does not automatically make an application compliant; the customer must implement the necessary controls.

Answer

Storing data in Google Cloud automatically makes an application HIPAA-compliant.

Answer

HIPAA compliance is impossible on public cloud; healthcare data must stay on-premises.

Answer

Google Cloud's automatic data encryption fully satisfies all HIPAA technical safeguard requirements.

Question 20

A company currently spends $200,000 annually on data center costs (hardware, power, cooling, staff). After migrating to Google Cloud, their cloud bill is $120,000 annually, but they also save $50,000 in data center costs they no longer pay. What is their net annual savings from the migration?

Accepted Answer

$80,000 annual savings ($200,000 previous cost minus $120,000 cloud cost). Option B is correct because the net annual savings are calculated as the difference between the previous total cost ($200,000) and the new total cost after migration. The new total cost is the cloud bill ($120,000) plus any remaining data center costs. Since the company saves $50,000 in data center costs they no longer pay, the remaining data center costs are $200,000 - $50,000 = $150,000. However, the question states they 'save $50,000 in data center costs they no longer pay,' meaning those costs are eliminated entirely, so the new total cost is just the cloud bill of $120,000. Thus, savings = $200,000 - $120,000 = $80,000.

Answer

$30,000 (cloud cost increase of $120K minus the $50K DC savings)

Answer

$50,000 (only the data center cost savings count)

Answer

$120,000 (the entire cloud bill is savings)