Cloud Digital Leader Practice Test 29 — 15 Questions

Question 1

A company must meet regulatory requirements that restrict where data can be stored and processed. They need to ensure that Google Cloud personnel have limited and audited access to their data. Which combination of services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assured Workloads and Access Transparency. Assured Workloads provides regulatory compliance controls and access restrictions for specific regions. Access Transparency logs Google personnel access. Cloud Audit Logs track user activity. The question asks for a combination that restricts personnel access and provides audit logs.

Answer

Access Transparency and VPC Service Controls

Answer

Cloud KMS and Cloud Audit Logs

Answer

VPC Service Controls and Cloud Audit Logs

Question 2

A security engineer needs to analyze network traffic for malicious payloads and anomalies in real-time across multiple VPC networks in a project. The solution must be managed and not require deploying third-party appliances. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS provides managed intrusion detection across VPC networks, analyzing traffic for threats like malware and anomalies.

Answer

Security Command Center

Answer

Cloud Armor

Answer

VPC Flow Logs

Question 3

An organization wants to ensure that all data stored in Cloud Storage is encrypted with customer-managed keys that can be rotated on demand. They also need to log every key use for audit compliance. Which combination of services should they use?

Accepted Answer

Cloud KMS with Customer-Managed Encryption Keys (CMEK) and Cloud Audit Logs. Cloud KMS allows creation and management of customer-managed encryption keys (CMEK) for Cloud Storage. Cloud Audit Logs can be used to log key usage (e.g., via Data Access audit logs). CSEK is deprecated; Secret Manager is for secrets, not encryption keys for storage.

Answer

Cloud KMS with Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys with Access Transparency

Answer

Secret Manager with encryption keys and Cloud Logging

Question 4

A startup wants to deploy a containerized web application that can scale to zero when not in use and automatically scale based on request traffic. They have limited DevOps experience and want minimal infrastructure management. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero, automatically scales based on requests, and requires no cluster management, making it ideal for this scenario.

Answer

App Engine Standard

Answer

Google Kubernetes Engine

Answer

Compute Engine

Question 5

A development team runs a web application on Cloud Run. They need to store session state across requests. Which Google Cloud service should they use?

Accepted Answer

Memorystore for Redis. Cloud Run instances are stateless; for session state, use an external caching layer like Memorystore (Redis). Pub/Sub is for messaging, Cloud SQL for relational data, and Cloud Storage for objects.

Answer

Cloud Storage

Answer

Cloud SQL

Answer

Cloud Pub/Sub

Question 6

A team is using Cloud Build to build container images and push them to Artifact Registry. The build process involves sensitive dependencies that should not be exposed to the internet. The team wants to ensure that all builds execute on a private network without public IP addresses. What should the team configure?

Accepted Answer

Use a private pool in Cloud Build. Cloud Build supports private pools that provide workers in a customer-managed VPC network, allowing builds to run without public IP addresses and access internal resources. Connecting the project to a shared VPC only enables network access but workers still have public IPs unless private pools are used. Using Artifact Registry VPC-SC perimeters helps secure the registry but not the build workers. Cloud NAT provides outbound internet but does not remove public IPs from workers.

Answer

Set up Cloud NAT for the Cloud Build workers

Answer

Configure Artifact Registry with VPC Service Controls

Answer

Connect the Cloud Build service account to a shared VPC

Question 7

A media streaming company wants to reduce latency for users worldwide by serving content from edge locations. They also want to offload traffic from their origin servers. Which Google Cloud service should they implement?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge network to cache content close to users, reducing latency and origin load.

Answer

Cloud Interconnect

Answer

Cloud Storage

Answer

Cloud Load Balancing

Question 8

A startup wants to deploy a containerized web application that can scale to zero during periods of no traffic, and they want to minimize operational overhead. Which Google Cloud compute service is the BEST fit?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that automatically scales your containers up and down, including scaling to zero when there is no traffic. It abstracts away infrastructure management, making it ideal for this use case.

Answer

App Engine Flexible Environment

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine with managed instance groups

Question 9

A company wants to reduce its on-premises data center footprint by moving workloads to Google Cloud. They need to maintain low-latency connectivity between their remaining on-premises equipment and their Google Cloud VPC. Which Google Cloud service should they use?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct, private, high-bandwidth connections between on-premises and Google Cloud, meeting low-latency requirements. Partner Interconnect uses service providers with lower bandwidth. Cloud VPN is internet-based and slower. Direct Peering lacks SLAs.

Answer

Cloud VPN

Answer

Partner Interconnect

Answer

Direct Peering

Question 10

A team wants to track costs for their development and production environments separately. They have multiple projects for each environment. Which approach should they use to group projects by environment and analyze costs by environment in billing reports?

Accepted Answer

Add a label like 'environment:dev' or 'environment:prod' to each project. Labels are key-value pairs that can be applied to resources or projects and used for cost allocation and filtering in billing reports. Folders are for hierarchical grouping and IAM inheritance, not direct cost tracking.

Answer

Create a folder for each environment and assign projects to the folders

Answer

Use separate billing accounts for each environment

Answer

Create a separate organization for each environment

Question 11

An organization wants to separate billing and access control for two departments, each with multiple projects. They also need to apply common IAM policies to all projects in a department. What is the recommended way to structure their resource hierarchy?

Accepted Answer

Use folders under the organization node, one per department, and place projects inside them. Folders sit below the organization node and above projects. They allow grouping projects by department and applying IAM policies at the folder level, which are inherited by all projects within.

Answer

Place all resources in a single project and use Cloud Identity groups for access

Answer

Create one project per department and use labels to separate them

Answer

Create separate billing accounts per department and link projects directly

Question 12

A company runs a batch processing workload every night that takes 60 minutes on a single n1-standard-32 VM. They want to reduce costs by using preemptible VMs but need the job to complete within 90 minutes. The job can be parallelized if necessary. Which approach is most cost-effective?

Accepted Answer

Split the workload across 4 preemptible n1-standard-8 VMs with checkpointing.. Preemptible VMs can be terminated at any time, so running multiple smaller instances with checkpointing and retries reduces cost and meets the deadline.

Answer

Use a single non-preemptible VM to ensure completion.

Answer

Use the same VM but as preemptible; if preempted, restart the job from scratch.

Answer

Use a single preemptible VM with persistent disk snapshots every 10 minutes.

Question 13

A company wants to reduce its carbon footprint by using cloud infrastructure powered by renewable energy. Which Google Cloud sustainability commitment is most relevant?

Accepted Answer

100% renewable energy match. Google Cloud matches 100% of its global electricity consumption with renewable energy purchases.

Answer

Net zero emissions by 2025

Answer

Carbon offset program

Answer

Carbon-free energy by 2025

Question 14

A company runs a globally distributed application with users in North America, Europe, and Asia. They need to serve static content (images, videos) with low latency from edge locations. They also need to protect against DDoS attacks. Which combination of services should they use?

Accepted Answer

Cloud CDN and Cloud Armor. Cloud CDN caches static content at edge locations for low latency, and Cloud Armor provides DDoS protection and WAF capabilities.

Answer

Cloud CDN and Cloud NAT

Answer

Cloud Load Balancing and Cloud CDN

Answer

Cloud Armor and Cloud Interconnect

Question 15

A company wants to receive near-real-time notifications when spending in a project exceeds 50%, 75%, and 100% of a monthly budget of $50,000. They also want to automatically disable billing for the project if spending exceeds $60,000. Which configuration should they use?

Accepted Answer

Create a budget with thresholds at 50%, 75%, 100% and set up a Cloud Function that listens to Pub/Sub messages from the budget to automatically disable billing when a 120% threshold is exceeded.. Budgets can be set with multiple threshold rules for notifications. However, automatically disabling billing requires a separate automation (e.g., Cloud Functions triggered by Pub/Sub) because budgets do not perform actions beyond notifications and Pub/Sub messages.

Answer

Use the Cost Management dashboard to monitor spending and disable billing manually.

Answer

Create a budget alert at 100% only and manually disable billing when alerted.

Answer

Create a budget with thresholds at 50%, 75%, 100% and set the 'disable billing' action on the budget.