Cloud Digital Leader Practice Test 27 — 15 Questions

Question 1

Refer to the exhibit. What level of access does this IAM policy grant to the members?

Accepted Answer

Read-only access to objects in the bucket.. The IAM policy shown grants the `s3:GetObject` action, which provides read-only access to objects in the bucket. It does not include any write or delete permissions, so members can only read existing objects. This matches option D.

Answer

Permission to create new objects and read existing ones.

Answer

Full control over objects including create, read, update, and delete.

Answer

Full control over the bucket including listing and deleting.

Question 2

A data analytics company uses BigQuery for large-scale queries. They notice that some queries are very expensive due to scanning large amounts of data. They want to reduce costs without changing query logic. Which feature should they use?

Accepted Answer

Partitioning and clustering tables. Partitioning and clustering tables in BigQuery physically organize data into smaller, manageable segments based on specified columns (e.g., date or timestamp). This allows queries to use partition pruning and clustering-based block pruning to scan only the relevant data, drastically reducing the amount of data processed and thus lowering costs without altering the query logic.

Answer

Query caching

Answer

Authorized views

Answer

Flat-rate pricing with reservations

Question 3

A multinational corporation needs to establish a private, low-latency connection between their on-premises data center and Google Cloud. The connection must be consistent, reliable, and support at least 10 Gbps throughput. Which solution should they use?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between an on-premises network and Google Cloud, offering consistent, reliable, low-latency connectivity with throughput options of 10 Gbps or 100 Gbps per link. This meets the requirement for a private, low-latency connection with at least 10 Gbps throughput, as it bypasses the public internet entirely and provides a Service Level Agreement (SLA) for uptime and performance.

Answer

Cloud NAT with static IP addresses

Answer

Partner Interconnect via a service provider

Answer

Cloud VPN using IPsec tunnels over the public internet

Question 4

A company is planning to migrate a legacy monolithic Linux application to Google Cloud. They want to minimize changes initially but have the flexibility to modernize later. Which three approaches should they consider?

Accepted Answer

Use Cloud Run for stateless containers. Option A is correct because Cloud Run allows you to deploy stateless containers without modifying the application code, minimizing initial changes while providing serverless scalability and the flexibility to modernize later by refactoring into microservices. This approach supports containerized workloads from a legacy monolithic app with minimal lift-and-shift effort.

Answer

Replatform to App Engine Flexible Environment

Answer

Refactor to microservices on GKE

Question 5

A team uses Terraform to create a VPC as shown. They now need to add a Compute Engine instance in the subnet. Which of the following correctly references the subnet?

Accepted Answer

Set `subnetwork = google_compute_subnetwork.subnet.self_link`. Option B is correct because when adding a Compute Engine instance to a subnet in Terraform, you must use the `subnetwork` argument (not `network`) and reference the subnet's `self_link` attribute. The `google_compute_subnetwork` resource's `self_link` provides the full URI required by the instance resource to attach to the correct subnet within the VPC.

Answer

Set `network = google_compute_subnetwork.subnet.self_link`

Answer

Set `subnetwork = google_compute_subnetwork.subnet.name`

Answer

Set `network = google_compute_network.vpc.name` and `subnetwork = google_compute_network.vpc.self_link`

Question 6

Refer to the exhibit. A user receives this error when trying to SSH into a Compute Engine instance. Which IAM role should be granted to the user?

Accepted Answer

roles/compute.instanceAdmin.v1. The error indicates the user lacks SSH access to the Compute Engine instance. The `roles/compute.instanceAdmin.v1` role includes the `compute.instances.setMetadata` permission, which allows the user to add their SSH public key to the instance's metadata, enabling SSH access. This role also provides broader instance management capabilities, making it the correct choice for resolving SSH connectivity issues.

Answer

roles/compute.osLogin

Answer

roles/iam.serviceAccountUser

Answer

roles/compute.admin

Question 7

A company uses Cloud Storage to store backup files. The files are accessed on average once per year. To minimize storage costs while complying with a 365-day retention policy, which storage class should they use?

Accepted Answer

Archive. Archive storage class is the correct choice because it offers the lowest storage cost for data that is accessed less than once per year, while still meeting the 365-day retention policy. Archive has a 365-day minimum storage duration, which aligns perfectly with the retention requirement, and its retrieval costs are acceptable given the infrequent access pattern.

Answer

Coldline

Answer

Nearline

Answer

Standard

Question 8

A company uses Cloud Functions (2nd gen) to process events from Pub/Sub. During traffic spikes, function instances scale but latency increases. They want to maximize throughput per instance. What should they configure?

Accepted Answer

Increase the concurrency setting.. Increasing the concurrency setting allows each Cloud Functions (2nd gen) instance to handle multiple requests simultaneously, maximizing throughput per instance during traffic spikes. By default, concurrency is 1, meaning each instance processes one event at a time; raising this value enables parallel processing within a single instance, reducing the need to scale out and lowering latency.

Answer

Allocate more memory.

Answer

Increase the max instances limit.

Answer

Increase the function timeout.

Question 9

An organization has multiple projects and wants to aggregate logs from all projects into a single bucket for long-term retention and compliance. What should they do?

Accepted Answer

Use log sinks to route logs to a Cloud Storage bucket in a central project. Option D is correct because log sinks in Cloud Logging can route logs from multiple source projects to a centralized Cloud Storage bucket in a separate project. This meets the requirement for long-term retention and compliance, as Cloud Storage provides durable, cost-effective archival storage with lifecycle management policies.

Answer

Use log sinks to route logs to a BigQuery dataset

Answer

Enable VPC Flow Logs

Answer

Use Cloud Logging's aggregation view

Question 10

A site reliability engineer is implementing SRE practices in Google Cloud. Which TWO of the following are key principles of SRE? (Choose TWO.)

Accepted Answer

Using error budgets to balance reliability and feature velocity. Option A is correct because error budgets are a core SRE principle that define the acceptable level of failure (e.g., 99.9% uptime allows 0.1% errors). This budget is used to balance the tension between releasing new features (velocity) and maintaining system reliability, allowing teams to halt deployments when the budget is exhausted.

Answer

Measuring everything with SLIs, SLOs, and SLAs

Answer

Centralizing all operations in a single team

Answer

Deploying changes only during maintenance windows

Question 11

A startup is building a read-heavy mobile backend. They want a database that can scale out reads without downtime. Which database service should they choose?

Accepted Answer

Cloud SQL with read replicas.. Cloud SQL with read replicas is the correct choice because it allows you to offload read traffic to one or more read replicas, scaling out reads without downtime. Read replicas are asynchronous replicas of the primary instance, and you can promote them to standalone instances if needed, making this ideal for a read-heavy mobile backend that requires high availability.

Answer

Cloud Firestore.

Answer

Cloud Spanner.

Answer

Cloud Bigtable.

Question 12

A company wants to enforce that all Cloud Storage buckets in a project have uniform bucket-level access enabled. Which Google Cloud tool should they use?

Accepted Answer

Define an Organization Policy with a constraint on uniform bucket-level access.. Organization Policies in Google Cloud allow administrators to enforce constraints across the entire resource hierarchy. The constraint `constraints/storage.uniformBucketLevelAccess` can be applied at the project, folder, or organization level to require uniform bucket-level access on all Cloud Storage buckets, preventing any bucket from being created or updated without it.

Answer

Use Cloud Audit Logs to monitor and alert on non-compliant buckets.

Answer

Set an IAM policy to deny access to buckets without uniform access.

Answer

Use Cloud Key Management Service to rotate keys.

Question 13

Which TWO statements correctly describe Cloud Run scaling behavior?

Accepted Answer

You can define a target concurrency to control how many requests each container instance handles.. Option C is correct because Cloud Run allows you to set a target concurrency (the number of simultaneous requests a single container instance can handle). This is a key scaling parameter that controls how many requests are routed to each instance before Cloud Run spins up additional instances. By default, concurrency is set to 80, but you can adjust it up to 1000 or set it to 1 for sequential processing.

Answer

The maximum number of instances can be set to 'default' which is unlimited.

Answer

You can set a minimum number of instances to ensure zero cold starts.

Answer

Autoscaling uses CPU and memory utilization to make decisions.

Question 14

Refer to the exhibit. The autoscaler is configured to maintain a target CPU utilization of 0.6. Currently the group has 10 instances, but the autoscaler is not scaling up even though CPU utilization is above 0.8. What is the most likely reason?

Accepted Answer

The maximum number of instances is set to 10. The autoscaler is configured to maintain a target CPU utilization of 0.6, but the current CPU utilization is above 0.8. Despite this, the autoscaler is not scaling up. The most likely reason is that the maximum number of instances is set to 10, and the group has already reached that limit. In Google Cloud, the autoscaler will not create new instances beyond the configured maximum, even if the target utilization is exceeded.

Answer

The autoscaler is disabled

Answer

The instance template is misconfigured

Answer

The autoscaler cooldown period is preventing new instances

Question 15

Which THREE are required to achieve HIPAA compliance on Google Cloud?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google. Option A is correct because HIPAA requires covered entities and their business associates to have a written agreement that establishes the permitted and required uses of protected health information (PHI). Google Cloud provides a standard Business Associate Agreement (BAA) that customers must sign to contractually bind Google to HIPAA obligations, including safeguarding ePHI and reporting breaches. Without a signed BAA, Google is not legally liable as a business associate under HIPAA, making this a foundational requirement for compliance.

Answer

Use a dedicated project for all PHI workloads

Answer

Configure multi-factor authentication for all users

Cloud Digital Leader Practice Test 27 — 15 Questions

Exhibit

Cloud Digital Leader Practice Test 27 — 15 Questions

Exhibit