Cloud Digital Leader Practice Test 28 — 15 Questions

Question 1

An organization has multiple projects in Google Cloud. They want to enforce a policy that prevents the creation of Compute Engine instances with more than 8 vCPUs in any project under a specific folder, except for a few exempted projects. How can they achieve this with minimal overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use organization policy with tags: define a tag 'exempt' and attach it to exempted projects; set the policy condition to apply unless the resource has the tag.. Using organization policy constraints with tags allows conditional enforcement. By attaching a tag to exempted projects and using conditions in the policy, they can apply the restriction to most projects while allowing exceptions.

Answer

Use IAM conditions with a custom role to deny creation of large instances.

Answer

Create a folder for exempted projects and apply a allow policy to that folder.

Answer

Apply a custom organization policy at the folder level without tags, and add exceptions in each project individually.

Question 2

A company needs to perform interactive SQL analytics on petabytes of data without managing any infrastructure. They need to query data stored in Cloud Storage and want the fastest query performance. Which Google Cloud service should they use?

Accepted Answer

BigQuery. BigQuery is a serverless, highly scalable data warehouse that supports SQL queries on data stored in Cloud Storage (external tables) or natively. It provides fast performance on petabyte-scale data without infrastructure management. Dataflow is for ETL, not ad-hoc analytics; Cloud SQL is for OLTP; Looker is a BI layer on top of a data warehouse.

Answer

Looker

Answer

Dataflow

Answer

Cloud SQL

Question 3

An engineer wants to analyze historical spending trends and break down costs by project, region, and service. They need to run complex SQL queries on the billing data. What is the recommended approach?

Accepted Answer

Enable billing export to BigQuery and query the exported tables. Billing export to BigQuery sends detailed billing information (e.g., usage, cost, project, labels) into BigQuery tables, enabling complex SQL analysis.

Answer

Set up a budget alert to receive cost reports daily

Answer

Use the Cloud Billing API to programmatically fetch cost data

Answer

Download the monthly invoice CSV and import it into Sheets

Question 4

A security engineer needs to monitor and analyze security logs from multiple GCP projects and on-premises sources in a centralized SIEM. Which Google Cloud service is designed for log management and security analytics at scale?

Accepted Answer

Chronicle. Chronicle is Google Cloud's SIEM platform that ingests logs from various sources and provides security analytics. Security Command Center is for vulnerability management, not a SIEM. Cloud Logging is for log storage and basics, but not a full SIEM.

Answer

Cloud Logging

Answer

Security Command Center

Answer

Cloud IDS

Question 5

An organisation needs to run a batch analytics job every night that processes terabytes of data stored in Cloud Storage. The job is expected to run for 3 hours and can tolerate interruptions. The compute resources should be as cost-effective as possible. Which Compute Engine VM type should be used?

Accepted Answer

Preemptible VMs. Preemptible VMs are significantly cheaper than standard VMs and are ideal for batch jobs that can tolerate interruptions. They can be preempted at any time but can be restarted. Standard VMs are for long-running, fault-intolerant workloads. Sole-tenant nodes are for compliance, not cost savings. Custom machine types allow tailoring resources but do not inherently save cost like preemptible VMs.

Answer

Standard (on-demand) VMs

Answer

Custom machine types

Answer

Sole-tenant nodes

Question 6

A data engineer needs to process a continuous stream of clickstream events from multiple sources, aggregate them into 1-minute windows, and write the results to BigQuery for real-time dashboarding. The solution must handle exactly-once processing semantics. Which combination of services should they use?

Accepted Answer

Pub/Sub -> Dataflow -> BigQuery. Dataflow (Apache Beam) provides exactly-once processing semantics and can read from Pub/Sub, apply windowed aggregations, and write to BigQuery. Pub/Sub is the ingestion layer for streaming events. Cloud Functions and Cloud Run are not designed for stateful windowed aggregations at scale, and Cloud Dataproc (Hadoop/Spark) would require more overhead.

Answer

Pub/Sub -> Cloud Functions -> BigQuery

Answer

Cloud Storage -> Dataflow -> BigQuery

Answer

Pub/Sub -> Cloud Dataproc -> BigQuery

Question 7

A security team wants to restrict access to a Cloud Storage bucket so that only Compute Engine VMs in the same VPC network can read objects. The VMs do not have public IP addresses. Which configuration should they use?

Accepted Answer

Enable Private Google Access on the subnet and use VPC Service Controls to limit bucket access to the VPC.. Private Google Access allows VMs without external IPs to access Google APIs and services via the VPC network. Combined with VPC Service Controls and bucket IAM, this ensures only VMs in the VPC can access the bucket.

Answer

Assign external IPs to the VMs and use firewall rules.

Answer

Create a bucket with uniform bucket-level access and grant the `storage.objectViewer` role to `allUsers`.

Answer

Use a Cloud VPN to connect the VMs to the bucket.

Question 8

An organisation is migrating its on-premises Oracle database to Google Cloud. They need a fully managed, PostgreSQL-compatible database with high performance for transaction processing and built-in AI capabilities for predictive analytics. Which database service should they choose?

Accepted Answer

AlloyDB. AlloyDB is a fully managed PostgreSQL-compatible database that offers high performance (4x faster than standard PostgreSQL) and integrated AI capabilities for vector search and predictive analytics. Cloud SQL for PostgreSQL is also managed but lacks the AI optimisations. Cloud Spanner is globally distributed but not PostgreSQL-compatible. Bare Metal Solution runs Oracle on dedicated hardware, not managed.

Answer

Bare Metal Solution for Oracle

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Question 9

A data analyst needs to run ad-hoc SQL queries on a large dataset stored in Cloud Storage. The data is in CSV format and does not require real-time results. Which Google Cloud service should they use?

Accepted Answer

BigQuery. BigQuery supports external data sources; you can create an external table pointing to CSV files in Cloud Storage and run SQL queries without loading the data. This is ideal for ad-hoc analysis on existing data.

Answer

Dataflow

Answer

Cloud SQL

Answer

Cloud Dataproc

Question 10

A retail company migrated its e-commerce platform to Google Cloud. During a flash sale, the application experiences high latency. The architecture uses managed instance groups with autoscaling based on CPU utilization. The database is Cloud SQL with read replicas. What is the MOST likely cause of the latency?

Accepted Answer

Cloud SQL connection limit is reached. Database connection pooling is often misconfigured during autoscaling, leading to connection exhaustion and increased latency.

Answer

Autoscaling is not triggered because CPU utilization is below threshold

Answer

Insufficient Cloud SQL storage capacity

Answer

SSL/TLS encryption is causing overhead

Question 11

Which Google Cloud service provides a fully managed, serverless data warehouse for petabyte-scale analytics with SQL?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, serverless data warehouse. It supports SQL queries at petabyte scale with no infrastructure to manage. Cloud SQL is for OLTP, Dataproc is for Hadoop/Spark, and Dataflow is for stream/batch processing.

Answer

Cloud SQL

Answer

Dataproc

Answer

Dataflow

Question 12

An engineer is deploying a global application that requires low latency for users in North America, Europe, and Asia. They plan to use Compute Engine instances in multiple regions. Which Google Cloud resource is essential to distribute traffic and provide a single anycast IP address?

Accepted Answer

Global external HTTP(S) load balancer. Global external HTTP(S) load balancer provides a single anycast IP and distributes traffic across regions, enabling low-latency access worldwide.

Answer

Cloud CDN

Answer

Traffic Director

Answer

Cloud NAT

Question 13

A company wants to use a pre-trained model to extract text from scanned invoices. They need a fully managed API that can be called via REST. Which Google Cloud service should they use?

Accepted Answer

Document AI. Document AI is a fully managed service for document processing, including OCR and extraction from invoices. Vision AI is for general image analysis. Natural Language AI handles text sentiment/entities. Vertex AI is a platform for custom models, not pre-built API for invoices.

Answer

Vision AI

Answer

Natural Language AI

Answer

Vertex AI

Question 14

A company runs a global web application hosted on Compute Engine behind a Cloud Load Balancer. They want to protect against DDoS attacks and filter incoming traffic based on IP reputation and geolocation. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is a web application firewall (WAF) and DDoS protection service that integrates with Cloud Load Balancing. It allows IP allow/deny lists, rate limiting, and predefined rules to block traffic based on geo-location and threat intelligence. VPC firewall rules operate at the network level but cannot inspect application-layer traffic or use IP reputation. Cloud CDN caches content but does not filter traffic. Cloud NAT provides outbound connectivity only.

Answer

Cloud CDN

Answer

Cloud NAT

Answer

VPC firewall rules

Question 15

A company wants to use machine learning models but has no in-house data science team. They need a service that allows them to train custom models using their own data without managing infrastructure. Which Google Cloud service should they use?

Accepted Answer

Vertex AI (including AutoML). Vertex AI provides a unified platform for ML, including AutoML for custom model training without managing infrastructure. BigQuery ML is for SQL-based ML, AI Platform Notebooks require manual setup, and Cloud TPUs are hardware accelerators, not a managed service.

Answer

AI Platform Notebooks

Answer

BigQuery ML

Answer

Cloud TPUs