Cloud Digital Leader Practice Test 27 — 15 Questions

Question 1

A company is migrating its on-premises applications to Google Cloud. The security team requires that all data be encrypted both in transit and at rest. Which approach meets these requirements with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use HTTPS for all traffic and enable default encryption at rest with Google-managed keys.. HTTPS provides encryption in transit using TLS, and default encryption at rest with Google-managed keys encrypts data stored in Google Cloud services like Cloud Storage and Compute Engine disks without requiring any manual key management. This approach meets the security requirements with minimal operational overhead since Google handles key rotation and lifecycle management automatically.

Answer

Implement a third-party encryption tool for both transit and at rest.

Answer

Set up a VPN between on-premises and Google Cloud and rely on that for encryption.

Answer

Restrict physical access to Google Cloud data centers.

Question 2

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

Accepted Answer

Customers can schedule tours of Google data centers to verify security practices directly.. Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Answer

Biometric authentication and badge access controls at multiple security perimeters.

Answer

24/7 on-site security personnel who monitor the facility continuously.

Answer

Secure hardware destruction procedures for decommissioned storage devices.

Question 3

A regional grocery chain wants to compete with national chains that have larger marketing budgets. A consultant argues that cloud adoption can help level the playing field. Which cloud advantage most directly supports this argument?

Accepted Answer

Pay-per-use cloud services give the regional chain access to the same advanced analytics, personalization, and demand forecasting capabilities as national chains without requiring equivalent capital investment. Pay-per-use cloud services enable the regional chain to leverage advanced analytics, personalization, and demand forecasting tools that are typically available only to large enterprises with significant capital budgets. This directly addresses the core challenge of competing with national chains by providing access to sophisticated data-driven marketing capabilities without the upfront investment in infrastructure and software licenses.

Answer

The regional chain can use cloud object storage to store marketing images, matching the storage capacity of national chains

Answer

Cloud providers offer free unlimited compute to smaller businesses to help them compete

Answer

The regional chain can hire fewer IT staff because cloud providers manage all aspects of their business operations

Question 4

A company needs to send messages between different microservices in a decoupled way. When one service publishes an event, multiple downstream services should receive and process it independently. Which Google Cloud service enables this publish-subscribe messaging pattern?

Accepted Answer

Cloud Pub/Sub. Cloud Pub/Sub is the correct choice because it is Google Cloud's fully managed, asynchronous messaging service designed specifically for the publish-subscribe pattern. It allows a publisher service to emit events to a topic, and multiple subscriber services can independently pull or push those messages from that topic, ensuring decoupled and reliable communication.

Answer

Cloud Tasks

Answer

Cloud Scheduler

Answer

Eventarc

Question 5

What is horizontal scaling, and how does it differ from vertical scaling?

Accepted Answer

Horizontal scaling adds more instances to distribute load; vertical scaling increases the size of existing instances.. Horizontal scaling (scale-out) adds more instances (e.g., additional virtual machines or containers) to distribute the workload across multiple nodes, improving fault tolerance and capacity. Vertical scaling (scale-up) increases the resources (CPU, RAM, storage) of an existing instance, often hitting hardware limits and requiring downtime. Option B correctly captures this distinction.

Answer

Horizontal scaling adds CPU/memory to existing servers; vertical scaling adds more servers.

Answer

Horizontal scaling is for databases only; vertical scaling is for web servers.

Answer

Horizontal scaling requires application downtime; vertical scaling is always online.

Question 6

A company uses Cloud Functions (2nd gen) to process events from Pub/Sub. During traffic spikes, function instances scale but latency increases. They want to maximize throughput per instance. What should they configure?

Accepted Answer

Increase the concurrency setting.. Increasing the concurrency setting allows each Cloud Functions (2nd gen) instance to handle multiple requests simultaneously, maximizing throughput per instance during traffic spikes. By default, concurrency is 1, meaning each instance processes one event at a time; raising this value enables parallel processing within a single instance, reducing the need to scale out and lowering latency.

Answer

Allocate more memory.

Answer

Increase the max instances limit.

Answer

Increase the function timeout.

Question 7

A global e-commerce company serves customers from multiple continents. They want to guarantee fast page load times and minimize latency. Which Google Cloud service is most suitable for this transformation?

Accepted Answer

Cloud CDN with global external HTTP(S) load balancing. Cloud CDN with global external HTTP(S) load balancing is the most suitable solution because it caches static and dynamic content at edge locations worldwide, reducing latency for users across multiple continents. The global load balancer provides anycast IP addresses that route traffic to the nearest healthy backend, while Cloud CDN serves cached content directly from the edge, minimizing round-trip time and improving page load times.

Answer

Cloud SQL for data caching

Answer

Cloud Storage multi-regional buckets

Answer

Compute Engine with large VMs

Question 8

A small business wants to host a low-traffic website with a single-page application. They have limited budget and no IT staff. Which Google Cloud solution is most cost-effective and easy to manage?

Accepted Answer

Host the static files on Cloud Storage and use Cloud CDN. Hosting static files (HTML, CSS, JS) on Cloud Storage with Cloud CDN provides a serverless, highly scalable, and low-cost solution for a low-traffic single-page application. Cloud Storage serves static content directly without provisioning any virtual machines, and Cloud CDN caches content at edge locations to reduce latency and egress costs. This eliminates the need for any server management, making it ideal for a business with no IT staff.

Answer

Use App Engine Standard Environment

Answer

Deploy a virtual machine on Compute Engine with a web server

Answer

Set up Google Kubernetes Engine cluster

Question 9

Refer to the exhibit. A user receives this error when trying to SSH into a Compute Engine instance. Which IAM role should be granted to the user?

Accepted Answer

roles/compute.instanceAdmin.v1. The error indicates the user lacks SSH access to the Compute Engine instance. The `roles/compute.instanceAdmin.v1` role includes the `compute.instances.setMetadata` permission, which allows the user to add their SSH public key to the instance's metadata, enabling SSH access. This role also provides broader instance management capabilities, making it the correct choice for resolving SSH connectivity issues.

Answer

roles/compute.osLogin

Answer

roles/iam.serviceAccountUser

Answer

roles/compute.admin

Question 10

A company wants to grant a data analyst read-only access to specific BigQuery datasets, but only if the request comes from within the corporate network. Which two Google Cloud tools should they combine to enforce this?

Accepted Answer

IAM and VPC Service Controls. IAM defines the read-only role (e.g., roles/bigquery.dataViewer) for the data analyst, while VPC Service Controls create a security perimeter that restricts access to the BigQuery API from only the corporate network IP range. Together, they ensure the request is both authorized by IAM and originates from within the allowed VPC perimeter, blocking any access from outside the corporate network even if the IAM role is granted.

Answer

IAM and Cloud IAP

Answer

Cloud Armor and IAM

Answer

Organization Policies and Cloud Audit Logs

Question 11

A company uses Cloud SQL for MySQL and wants to ensure that data is encrypted at rest using customer-managed keys. They also need to rotate the key every 90 days. What should they do?

Accepted Answer

Enable CMEK on the Cloud SQL instance and rotate the key in Cloud KMS. Cloud SQL supports Customer-Managed Encryption Keys (CMEK) via integration with Cloud KMS. By enabling CMEK on the Cloud SQL instance, you can use a key you create and manage in Cloud KMS, and you can set a rotation period (e.g., 90 days) on that key in Cloud KMS. This ensures data at rest is encrypted with a key you control and that is automatically rotated according to your schedule.

Answer

Use customer-supplied encryption keys (CSEK) with Cloud SQL

Answer

Use default Google-managed encryption and rotate the key using Cloud KMS

Answer

Bring your own key (BYOK) without using Cloud KMS

Question 12

Refer to the exhibit. The autoscaler is configured to maintain a target CPU utilization of 0.6. Currently the group has 10 instances, but the autoscaler is not scaling up even though CPU utilization is above 0.8. What is the most likely reason?

Accepted Answer

The maximum number of instances is set to 10. The autoscaler is configured to maintain a target CPU utilization of 0.6, but the current CPU utilization is above 0.8. Despite this, the autoscaler is not scaling up. The most likely reason is that the maximum number of instances is set to 10, and the group has already reached that limit. In Google Cloud, the autoscaler will not create new instances beyond the configured maximum, even if the target utilization is exceeded.

Answer

The autoscaler is disabled

Answer

The instance template is misconfigured

Answer

The autoscaler cooldown period is preventing new instances

Question 13

A startup wants to deploy a containerized web application without managing the underlying infrastructure. They want to only focus on code. Which Google Cloud service is most suitable?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a fully managed serverless platform that executes stateless containers in a request-driven environment, abstracting all infrastructure management. This allows the startup to focus solely on code by deploying container images directly from Artifact Registry or Container Registry, with automatic scaling down to zero when not in use.

Answer

Google Kubernetes Engine

Answer

Compute Engine

Answer

App Engine

Question 14

An organization uses Security Command Center (SCC) premium tier and wants to automatically remediate a specific finding type by disabling public access to Cloud Storage buckets. What is the recommended approach?

Accepted Answer

Set up a Cloud Function triggered by SCC findings to remove public access. Security Command Center (SCC) premium tier can publish findings to Cloud Pub/Sub, which can trigger a Cloud Function via a push subscription. The Cloud Function can then use the Google Cloud Storage API (specifically, the `storage.buckets.setIamPolicy` method) to remove the `allUsers` or `allAuthenticatedUsers` bindings that grant public access, enabling automated, event-driven remediation without manual intervention.

Answer

Use Cloud Pub/Sub alone to listen for SCC findings and then manually remediate

Answer

Use IAM to deny all users except project owners from making buckets public

Answer

Configure a Cloud Scheduler job to run a script that checks and removes public access

Question 15

A company's security team wants to detect and remediate public exposure of Cloud SQL instances. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the correct service because it provides centralized visibility and monitoring of Google Cloud resources, including the ability to detect and alert on public exposure of Cloud SQL instances. SCC's built-in vulnerability and threat detection findings, such as 'Public SQL instance,' directly identify misconfigured Cloud SQL instances that are accessible from the internet, enabling the security team to remediate the exposure.

Answer

Cloud Armor

Answer

Cloud Data Loss Prevention (DLP)

Answer

VPC Service Controls