Cloud Digital Leader Practice Test 28 — 15 Questions

Question 1

A multinational corporation uses Cloud Identity-Aware Proxy (IAP) to secure access to applications. They notice that some users outside the corporate network can still reach the applications. What is the most likely misconfiguration?

Accepted Answer

IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.. Option A is correct because setting IAP to 'allUsers' allows unauthenticated access from any user on the internet, bypassing IAP's authentication and authorization checks. IAP should be configured with 'allAuthenticatedUsers' or a more specific set of principals to enforce identity verification before granting access to the application.

Answer

The firewall rules allow ingress from 0.0.0.0/0.

Answer

IAP is not enabled on the backend service.

Answer

The OAuth 2.0 client ID is misconfigured.

Question 2

Refer to the exhibit. A developer receives this error when trying to create a Compute Engine instance. The developer is authenticated as a user with Project Editor role. What is the most likely cause?

Accepted Answer

The service account used for the instance lacks IAM permissions.. Option C is correct because the error occurs when the Compute Engine instance creation fails due to insufficient IAM permissions on the service account attached to the instance. Even though the developer has the Project Editor role (which includes compute.instances.create), the service account used by the instance must have the necessary IAM roles (e.g., roles/iam.serviceAccountUser) to be used. Without these permissions, the API call to create the instance is denied, resulting in the error.

Answer

The project has reached its compute instance quota.

Answer

The developer does not have the compute.instances.create permission.

Answer

The VPC network has insufficient IP addresses.

Question 3

A healthcare company must comply with HIPAA and store all protected health information (PHI) only in the United States. They use Google Cloud and want to prevent any accidental data storage outside the US. Which two services should they implement?

Accepted Answer

VPC Service Controls and Organization Policies. VPC Service Controls create a security perimeter around Google Cloud resources, preventing data from being copied or moved outside allowed regions. Organization Policies allow you to set a constraint (e.g., `gcp.resourceLocations`) that restricts where resources like Cloud Storage buckets or BigQuery datasets can be created, ensuring PHI remains in the US. Together, they enforce both data exfiltration prevention and location-based resource creation restrictions.

Answer

Data Loss Prevention API

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 4

An organization stores sensitive data in BigQuery. They need to restrict access to specific columns based on user role, while allowing analysis at the dataset level. Which feature should they use?

Accepted Answer

Column-level access control using authorized views or taxonomy policies. Option B is correct because BigQuery column-level access control, implemented through authorized views or taxonomy policies (via Data Catalog), allows restricting access to specific columns while preserving dataset-level analysis permissions. Authorized views use SQL logic to expose only permitted columns, and taxonomy policies apply fine-grained access controls at the column level without requiring separate datasets.

Answer

BigQuery row-level security

Answer

IAM roles at the dataset level with fine-grained permissions

Answer

Cloud Data Loss Prevention (DLP) to mask data

Question 5

A small IT team needs to grant developers the ability to deploy instances in a project but not delete them. Which IAM best practice should they use?

Accepted Answer

Create a service account for each developer and grant it the compute.instanceAdmin role.. Option D is correct because creating a service account for each developer and granting the `compute.instanceAdmin` role provides the precise permissions needed to deploy instances (via `compute.instances.insert`) without granting the ability to delete them (the `compute.instanceAdmin` role does not include `compute.instances.delete`). This follows the IAM best practice of least privilege, ensuring developers can perform only the required actions.

Answer

Create a custom role with compute.instances.insert and compute.instances.delete permissions.

Answer

Assign all developers the primitive role of Editor.

Answer

Use organization policy to restrict deletion of compute instances.

Question 6

A retail company experiences huge traffic spikes during Black Friday and slow periods otherwise. They want to avoid over-provisioning servers and reduce costs. Which cloud feature directly addresses this need?

Accepted Answer

Auto-scaling based on CPU utilization. Auto-scaling based on CPU utilization dynamically adjusts the number of server instances in response to real-time demand. During Black Friday traffic spikes, it automatically adds capacity, and during slow periods, it scales down to reduce costs. This directly addresses the need to avoid over-provisioning while maintaining performance.

Answer

Purchasing committed use discounts

Answer

Load balancing across regions

Answer

Manual scaling with reserve instances

Question 7

A retail bank wants to launch new digital banking features quickly to compete with fintech startups while maintaining strict regulatory compliance. Which cloud transformation strategy best addresses both agility and compliance?

Accepted Answer

Implement a cloud-native architecture using GKE, Cloud Build, and Cloud IAM with compliance auditing. Option D is correct because it leverages cloud-native services like Google Kubernetes Engine (GKE) for containerized microservices, Cloud Build for CI/CD automation, and Cloud IAM for fine-grained access control, enabling rapid feature deployment while maintaining compliance through integrated audit logging and policy enforcement. This architecture decouples agility from security, allowing the bank to iterate quickly without sacrificing regulatory requirements like PCI-DSS or SOX.

Answer

Move everything to a public cloud without additional access controls to maximize speed

Answer

Use a lift-and-shift migration to cloud VMs and rely on manual change management

Answer

Stick with on-premise systems for compliance and use cloud only for non-sensitive data

Question 8

An engineering team uses the command above to create an instance for a batch data processing job that runs nightly and can tolerate interruptions. What business transformation benefit does using the `--preemptible` flag provide?

Accepted Answer

Lower cost for fault-tolerant workloads, enabling more experimentation. The `--preemptible` flag creates a preemptible VM instance that can be terminated by Google Cloud at any time, typically after 24 hours, but at a significantly lower cost (up to 60-80% discount). For batch data processing jobs that run nightly and can tolerate interruptions, this cost savings directly enables more experimentation and iterative development because teams can run more jobs or larger datasets for the same budget, accelerating innovation and business transformation.

Answer

Higher reliability for critical applications

Answer

Better performance due to dedicated hardware

Answer

Enhanced security through automatic patching

Question 9

A business wants to reduce the time to market for new features by enabling developers to provision infrastructure without waiting for IT. Which cloud attribute supports this?

Accepted Answer

On-demand self-service. On-demand self-service (Option D) is the correct answer because it allows developers to provision infrastructure automatically without requiring human interaction from IT. This cloud attribute, defined by NIST SP 800-145, enables users to unilaterally provision computing resources as needed, directly reducing time to market by eliminating manual approval and setup delays.

Answer

Disaster recovery

Answer

Broad network access

Answer

High availability

Question 10

A company with fluctuating demand wants to pay only for the resources it consumes, with no long-term commitments. Which Google Cloud feature allows them to automatically adjust capacity based on real-time demand?

Accepted Answer

Autoscaling. Autoscaling is the correct answer because it automatically adjusts the number of compute resources (e.g., VM instances) up or down based on real-time demand metrics such as CPU utilization, request count, or custom metrics. This allows the company to pay only for the resources it consumes without any long-term commitments, as instances are added or removed dynamically to match current load.

Answer

Cloud Armor

Answer

Committed use discounts

Answer

Preemptible VMs

Question 11

A company wants to monitor the health and performance of their applications running on Google Cloud. Which two Google Cloud services should they use together for comprehensive observability?

Accepted Answer

Cloud Monitoring. Cloud Monitoring and Cloud Logging together form the core of Google Cloud's observability stack. Cloud Monitoring collects metrics, uptime checks, and alerting policies, while Cloud Logging ingests, stores, and analyzes log data. Combined, they provide the metrics, logs, and alerting needed to comprehensively monitor application health and performance.

Answer

Cloud Profiler

Answer

Cloud Debugger

Answer

Cloud Trace

Question 12

Given the Cloud Run service configuration above, what happens when a new revision is created after deploying a change to the container image?

Accepted Answer

Traffic continues to go to the old revision until the traffic section is updated.. Option E is correct because Cloud Run, by default, does not automatically shift traffic to a new revision. When you deploy a change, a new revision is created, but it receives 0% of traffic until you explicitly update the traffic configuration (e.g., via the console, gcloud run deploy --no-traffic, or the traffic section). This allows you to test the new revision before directing any live requests to it.

Answer

Traffic is split evenly between the old and new revision.

Answer

The service becomes unavailable until the new revision is ready.

Answer

Cloud Run automatically creates a new revision and routes traffic to it.

Answer

The new revision receives all traffic automatically.

Question 13

Refer to the exhibit. The IAM policy is applied at the project level. The bucket 'sensitive-data' exists and contains objects. What is the effective access for user alice@example.com?

Accepted Answer

Alice can view objects in all buckets including sensitive-data.. The IAM policy grants the 'roles/storage.objectViewer' role to user alice@example.com at the project level. This role allows listing and reading objects in all buckets within the project, including 'sensitive-data'. The condition 'request.time < 9:00 AM' is a denial condition that only applies to the 'sensitive-data' bucket, but because the policy is applied at the project level and the condition is not met (the request is made after 9 AM), the deny effect does not apply, so Alice retains full view access to all buckets.

Answer

Alice can view objects only in non-sensitive buckets, and can view objects in sensitive-data only after 9 AM due to condition.

Answer

Alice can view objects in all buckets except sensitive-data.

Answer

Alice can view and modify objects in all buckets.

Question 14

A large financial institution has a hybrid cloud strategy with sensitive data stored on-premises and customer-facing applications in Google Cloud. They need low-latency access between on-premises databases and cloud applications, but also require encryption in transit and strong access controls. The on-premises network uses non-google-compatible routing protocols. Which solution should they implement?

Accepted Answer

Deploy Dedicated Interconnect, use Cloud VPN for encryption, and VPC Service Controls for access. Option C is correct because Dedicated Interconnect provides the required low-latency, high-bandwidth connection between on-premises and Google Cloud, while Cloud VPN over the interconnect adds encryption in transit (IPsec) for sensitive data. VPC Service Controls enforce strong access controls by preventing data exfiltration from managed services, and the solution works with non-Google-compatible routing protocols since Dedicated Interconnect uses BGP, which is standard and supported.

Answer

Establish a Cloud VPN connection and use Identity-Aware Proxy for access

Answer

Directly peer with Google using Carrier Peering

Answer

Use a third-party VPN appliance on a Compute Engine instance and configure firewall rules

Question 15

A regional hospital chain wants to improve patient outcomes by analyzing electronic health records (EHRs) from multiple departments, including radiology, pathology, and pharmacy. Currently, each department stores data in separate on-premises databases, making it difficult to correlate information. The hospital must comply with HIPAA and other data privacy regulations. They have a small IT team and limited budget for new hardware. They want to enable clinicians to run ad-hoc queries across all data and generate insights using machine learning, without managing infrastructure. Which solution best achieves these goals?

Accepted Answer

Use Cloud Healthcare API to ingest and standardize data from each department, store in BigQuery, and use BigQuery ML to build predictive models.. Option D is correct because it leverages the Cloud Healthcare API to ingest and standardize data from disparate on-premises databases into a unified format, stores it in BigQuery for serverless ad-hoc querying, and uses BigQuery ML to build predictive models without managing infrastructure. This fully meets HIPAA compliance through built-in data residency and access controls, while the small IT team avoids hardware procurement and maintenance overhead.

Answer

Purchase additional on-premises servers and implement a data warehouse with ETL processes.

Answer

Deploy a third-party analytics SaaS tool and export data from each department manually.

Answer

Migrate all data to Cloud Storage and grant clinicians access to files for manual analysis.