Cloud Digital Leader Practice Test 3 — 10 Questions

Question 1

A CISO is evaluating Google Cloud's security posture and asks about independent third-party validation of Google's security practices. Which types of certifications and audit reports most directly provide this independent assurance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Third-party audit certifications such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP, which independently verify that Google's security controls meet defined international and industry standards. Independent third-party validation of Google Cloud's security posture is most directly provided by certifications and audit reports such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP. These are issued by accredited external auditors who verify that Google's security controls, processes, and infrastructure meet rigorous, internationally recognized standards. This gives customers objective assurance beyond Google's own claims.

Answer

Google's internal security policies and self-assessment reports published on its website

Answer

Google's Bug Bounty program, which shows that the public can report security vulnerabilities

Answer

Customer testimonials from large enterprises that use Google Cloud for sensitive workloads

Question 2

A multinational company must ensure that personal data of European citizens stored in Google Cloud cannot be accessed by or transferred to systems outside the European Union, as required by GDPR data residency requirements. Which Google Cloud controls most directly enforce this?

Accepted Answer

Configuring organization policy to restrict resource creation to EU regions, using VPC Service Controls to prevent data movement outside the EU perimeter, and establishing a GDPR-compliant Data Processing Agreement with Google. It combines three essential controls that directly enforce GDPR data residency: Organization Policies restrict resource creation to EU regions, VPC Service Controls create a data perimeter preventing exfiltration outside the EU, and a GDPR-compliant Data Processing Agreement (DPA) establishes the legal framework for data handling. These controls work together to ensure data at rest and in transit remains within the EU boundary, directly addressing the residency requirement.

Answer

Enabling HTTPS for all data transmission to ensure data is encrypted during transfer

Answer

Using Customer-Managed Encryption Keys (CMEK) where the encryption keys are stored outside Google's infrastructure

Answer

Training developers about GDPR requirements and requiring manual approval for any cross-region data transfers

Question 3

A security team is reviewing a developer's request to be granted the 'Owner' role on a production Google Cloud project 'just in case they need broad access.' The security team rejects this and instead grants a more specific role. Which security principle does the security team's decision enforce?

Accepted Answer

Principle of least privilege, by granting only the minimum permissions necessary for the developer's specific role and tasks. The security team's decision to reject the overly broad 'Owner' role and grant a more specific role directly enforces the principle of least privilege. This principle dictates that users should be granted only the minimum permissions necessary to perform their job functions, reducing the risk of accidental or malicious misuse of elevated access. In Google Cloud, this is implemented by assigning predefined or custom IAM roles with precisely scoped permissions rather than broad roles like Owner.

Answer

Defense in depth, by ensuring multiple security layers protect the project

Answer

Separation of duties, by ensuring no single person has too many responsibilities

Answer

Zero trust networking, by treating the developer's device as untrusted

Question 4

A healthcare company needs to store patient data in Google Cloud and must comply with HIPAA (Health Insurance Portability and Accountability Act). Which statement correctly describes how Google Cloud helps them achieve HIPAA compliance?

Accepted Answer

Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.. Google Cloud provides HIPAA-eligible services and offers a Business Associate Agreement (BAA) to covered entities, but compliance is a shared responsibility. Customers must configure their own technical safeguards, such as access controls, audit logging, and encryption key management, to meet HIPAA requirements. Google Cloud does not automatically make an application compliant; the customer must implement the necessary controls.

Answer

Storing data in Google Cloud automatically makes an application HIPAA-compliant.

Answer

HIPAA compliance is impossible on public cloud; healthcare data must stay on-premises.

Answer

Google Cloud's automatic data encryption fully satisfies all HIPAA technical safeguard requirements.

Question 5

A company has a Google Cloud environment with 50 projects and 200 engineers. The security team wants to ensure that a new security policy — requiring all Cloud Storage buckets to have uniform bucket-level access enabled — applies to all existing and future buckets across all projects. Which approach scales to the entire organization?

Accepted Answer

Apply an Organization Policy constraint ('storage.uniformBucketLevelAccess') at the organization level to enforce the setting automatically across all current and future projects and buckets. Organization Policy constraints, such as `storage.uniformBucketLevelAccess`, are enforced at the organization level and automatically apply to all existing and future projects and resources within the organization. This ensures uniform compliance without manual intervention, scaling seamlessly across 50 projects and 200 engineers.

Answer

Send an email to all 200 engineers explaining the policy and asking them to manually enable uniform bucket-level access on their buckets

Answer

Create a Cloud Function that checks bucket configurations hourly and enables uniform access on non-compliant buckets

Answer

Grant the security team Owner access to all 50 projects so they can manually enforce the policy in each project

Question 6

A company wants to expose its internal backend services to external partners through a managed API layer that handles authentication, rate limiting, traffic management, and analytics — without modifying the underlying services. Which Google Cloud product is designed for this API management use case?

Accepted Answer

Apigee, Google Cloud's full-featured enterprise API management platform for authentication, rate limiting, analytics, and developer portal without modifying backend services. Apigee is Google Cloud's full-featured enterprise API management platform designed to expose backend services to external partners without requiring modifications to those services. It provides built-in authentication, rate limiting, traffic management, and analytics, along with a developer portal for partner onboarding. This makes it the correct choice for the described use case.

Answer

Cloud Load Balancing, which distributes API requests across backend instances

Answer

Cloud Endpoints, a lighter-weight API gateway for Google Cloud-hosted APIs

Answer

Cloud Armor, Google Cloud's web application firewall and DDoS protection service

Question 7

A software team wants to host their container images securely within Google Cloud and integrate with Cloud Build for CI/CD pipelines and GKE for deployments. Which Google Cloud product serves as the managed repository for storing and managing container images?

Accepted Answer

Artifact Registry, Google Cloud's managed repository for container images and build artifacts with native CI/CD integration. Artifact Registry is Google Cloud's fully managed, next-generation repository for storing, managing, and securing container images and build artifacts. It natively integrates with Cloud Build for CI/CD pipelines and GKE for deployments, providing features like vulnerability scanning, access control via IAM, and support for multiple formats (Docker, Maven, npm, etc.). This makes it the correct choice for the team's requirements.

Answer

Cloud Storage, by storing container images as objects in a bucket

Answer

Container Registry (gcr.io), the legacy Google container image service

Answer

Cloud Source Repositories, for storing source code and container build files

Question 8

An operations team wants to receive an automated alert when their web application's HTTP error rate exceeds 5% for more than 5 minutes. Which Google Cloud product is used to configure this type of metric-based alert?

Accepted Answer

Cloud Monitoring, by creating an alerting policy on the HTTP error rate metric with a 5-minute evaluation window and notification channel. Cloud Monitoring is the correct service because it is purpose-built for creating alerting policies based on metrics like HTTP error rates. You can define a condition that triggers when the error rate exceeds 5% for a specified evaluation window (e.g., 5 minutes) and route the alert through a notification channel (e.g., email, Slack). This directly matches the requirement for a metric-based alert with a time-based threshold.

Answer

Cloud Logging, by configuring a log-based metric and email notification

Answer

Cloud Trace, by setting a trace sampling threshold for error requests

Answer

Security Command Center, by configuring a finding for high error rates

Question 9

A company wants to use computing resources over the internet without managing physical servers. The cloud provider manages the underlying hardware and virtualization, while the company manages the operating system, middleware, and applications. Which cloud service model does this describe?

Accepted Answer

Infrastructure as a Service (IaaS). This scenario describes Infrastructure as a Service (IaaS) because the cloud provider manages the physical hardware and virtualization layer, while the customer retains control over the operating system, middleware, and applications. In IaaS, the provider offers virtualized computing resources (e.g., virtual machines, storage, networks) via APIs or dashboards, and the customer is responsible for OS patches, application configuration, and middleware management. This matches the given split of responsibilities exactly.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 10

Google Cloud runs its own infrastructure operations using the Site Reliability Engineering (SRE) model, which Google invented. What is the core principle that distinguishes SRE from traditional IT operations?

Accepted Answer

SRE applies software engineering principles to operations — automating toil, using quantitative SLOs, and treating reliability as an engineered system property.. The core principle of SRE is applying software engineering practices to operations work. This means automating manual toil, defining quantitative Service Level Objectives (SLOs) to measure reliability, and treating reliability as an engineered property of the system — not as an afterthought. This contrasts with traditional IT operations, which often rely on manual processes and reactive troubleshooting.

Answer

SRE teams never allow production deployments to ensure maximum stability.

Answer

SRE relies entirely on external monitoring vendors to detect and respond to all incidents.

Answer

SRE means development and operations teams are separate departments that communicate only via ticketing systems.