Cloud Digital Leader Practice Test 27 — 15 Questions

Question 1

A development team is building a microservices-based application and wants to use a service mesh to secure and observe inter-service communication. They are using Google Kubernetes Engine (GKE). Which Google Cloud service should they integrate with GKE to provide service mesh capabilities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Service Mesh (Anthos Service Mesh). Anthos Service Mesh (ASM) is a fully managed service mesh that provides traffic management, security (mTLS), and observability for microservices running on GKE and other environments.

Answer

Apigee

Answer

Cloud Traffic Director

Answer

Cloud Endpoints

Question 2

An engineer is deploying a globally distributed application that requires strong consistency across multiple continents with a 99.999% uptime SLA. The data model is relational with SQL queries. Which database service should they use?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that provides globally distributed, strongly consistent relational data with a 99.999% SLA.

Answer

Firestore in multi-region mode

Answer

Cloud SQL with cross-region replication

Answer

Bigtable with replication

Question 3

A startup wants to run a containerized web application on Google Cloud without managing the underlying servers or Kubernetes clusters. They expect traffic to vary significantly, and they want to only pay for the resources consumed during request processing. Which Google Cloud compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that runs containers in response to events or HTTP requests, scales to zero, and charges only for resources used during request processing. It abstracts away all infrastructure management.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard

Question 4

Which Google Cloud service is a fully managed, serverless data warehouse for analytics with built-in ML capabilities (e.g., BigQuery ML)?

Accepted Answer

BigQuery. BigQuery is a serverless data warehouse that supports standard SQL, scales automatically, and includes BigQuery ML for creating ML models using SQL.

Answer

Cloud SQL

Answer

Firestore

Answer

Cloud Spanner

Question 5

A financial services company is required to keep all data within a specific geographic region for regulatory compliance. They plan to deploy a globally distributed application using Cloud Spanner. How should they configure Cloud Spanner to meet this compliance requirement?

Accepted Answer

Use a single-region configuration in the required region. Cloud Spanner allows you to choose specific regions for your instance, and replicas are placed only within that region. Multi-region configurations span multiple geographic areas and would violate the data residency requirement. Therefore, a single-region configuration is required.

Answer

Use a multi-region configuration with a write region in the required region

Answer

Use a multi-region configuration but restrict access to only one region

Answer

Use a dual-region configuration

Question 6

A company wants to store archived data that must be retained for 10 years. They expect to access it less than once a year. Which Cloud Storage class is the MOST cost-effective?

Accepted Answer

Archive. Archive storage is designed for data accessed less than once a year, with the lowest storage cost but higher retrieval fees and a 365-day minimum storage duration. Coldline has a 90-day minimum and higher cost. Nearline and Standard are more expensive and have shorter minimums.

Answer

Standard

Answer

Coldline

Answer

Nearline

Question 7

A data analytics team needs to run complex SQL queries on a large dataset stored in Cloud Storage (CSV files). They want a serverless solution that does not require managing infrastructure. Which Google Cloud service should they use?

Accepted Answer

BigQuery. BigQuery is a serverless data warehouse that can query data in Cloud Storage via external tables or direct loading. Cloud Dataproc is managed Hadoop/Spark, not serverless for SQL. Cloud Dataflow is for stream/batch processing. Cloud SQL is a managed relational database.

Answer

Cloud Dataflow

Answer

Cloud Dataproc

Answer

Cloud SQL

Question 8

An organisation needs to block common web attacks like SQL injection and cross-site scripting (XSS) at the edge of Google's network, before traffic reaches their applications. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's web application firewall (WAF) service that protects against web attacks at the edge. It integrates with Cloud Load Balancing and Cloud CDN. Cloud CDN caches content, Cloud Load Balancing distributes traffic, and Cloud IDS is for network threat detection.

Answer

Cloud CDN

Answer

Cloud IDS

Answer

Cloud Load Balancing

Question 9

A company runs a batch processing workload every night that can tolerate interruptions. The workload runs on Compute Engine VMs and takes 2 hours to complete. They want to reduce costs. Which VM pricing model should they use?

Accepted Answer

Preemptible VMs. Preemptible VMs offer significant cost savings (up to 80% discount) but can be terminated at any time. Since the workload is batch and can tolerate interruptions, this is the most cost-effective choice.

Answer

Committed use discounts

Answer

Sole-tenant nodes

Answer

Sustained use discounts

Question 10

An organization needs to enforce that developers can only create Compute Engine instances in the us-central1 region. Which IAM approach should they use?

Accepted Answer

Grant the Compute Instance Admin role with an IAM condition on resource.location. IAM conditions allow setting regional constraints on roles, such as granting the Compute Instance Admin role with a condition on resource.location == 'us-central1'.

Answer

Use Organization Policy to restrict allowed regions

Answer

Create a custom role with permission restricted to us-central1

Answer

Create a separate project for each region

Question 11

A company wants to implement a zero-trust security model to replace its legacy VPN for accessing internal web applications. Employees use both company-managed and personal devices. Which Google Cloud service provides context-aware access based on user identity and device posture?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) verifies user identity and context (device security, location, etc.) before granting access to applications, enabling zero-trust without a VPN.

Answer

Cloud VPN

Answer

Cloud Armor

Answer

VPC Service Controls

Question 12

An e-commerce company is experiencing traffic spikes during flash sales. They need their application to automatically scale up and down based on CPU utilization, without manual intervention. Their application runs on a managed platform. Which feature should they enable?

Accepted Answer

Enable autoscaling. Autoscaling is the correct feature to automatically adjust the number of instances based on metrics like CPU utilization. Load balancing distributes traffic, snapshots are for backups, and VPC peering connects networks.

Answer

Schedule regular snapshots

Answer

Set up VPC peering

Answer

Configure a load balancer

Question 13

A company is migrating a legacy monolithic application to Google Cloud. They want to reduce operational overhead by eliminating server management while keeping the ability to run containers. The application has unpredictable traffic patterns and needs to scale to zero when idle. Which compute option is the best fit?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that automatically scales to zero when idle, eliminating server management and cost during idle periods. GKE requires cluster management, Compute Engine is not serverless, and App Engine Flex requires VMs always running.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Flexible Environment

Answer

Compute Engine with managed instance groups

Question 14

A developer wants to deploy a containerized web application that can automatically scale to zero when there are no requests, and charges only for resources used during request processing. Which Google Cloud compute service should they use?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero and charges per request. Google Kubernetes Engine and Compute Engine require running instances, and App Engine Standard is a platform as a service but not container-based.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard Environment

Question 15

An organization wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they control and rotate periodically. They also need to audit key usage. Which approach should they take?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow customers to control and rotate keys and audit usage via Cloud Audit Logs.

Answer

Use Customer-Supplied Encryption Keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use Cloud External Key Manager (Cloud EKM)