Cloud Digital Leader Practice Test 3 — 10 Questions

Question 1

A company needs to send messages between different microservices in a decoupled way. When one service publishes an event, multiple downstream services should receive and process it independently. Which Google Cloud service enables this publish-subscribe messaging pattern?

Accepted Answer

Cloud Pub/Sub. Cloud Pub/Sub is the correct choice because it is Google Cloud's fully managed, asynchronous messaging service designed specifically for the publish-subscribe pattern. It allows a publisher service to emit events to a topic, and multiple subscriber services can independently pull or push those messages from that topic, ensuring decoupled and reliable communication.

Answer

Cloud Tasks

Answer

Cloud Scheduler

Answer

Eventarc

Question 2

A company's web service has a Service Level Objective (SLO) of 99.9% monthly availability. In a 30-day month, how many minutes of downtime are allowed before the SLO is violated?

Accepted Answer

~43.2 minutes. The SLO of 99.9% monthly availability means the service can be unavailable for 0.1% of the total monthly time. In a 30-day month, total minutes are 30 × 24 × 60 = 43,200 minutes. 0.1% of 43,200 minutes is 43.2 minutes, so option B is correct.

Answer

~4.3 minutes

Answer

~7.2 hours

Answer

~8.6 hours

Question 3

A company's application is composed of 15 microservices. When a performance issue occurs, the team struggles to determine which service is causing latency since request traces span multiple services. Which Google Cloud service helps identify which specific service in a microservices chain is causing slowdowns?

Accepted Answer

Cloud Trace — captures distributed request traces showing end-to-end latency across all microservices.. Cloud Trace is designed specifically for distributed tracing in microservices architectures. It captures end-to-end latency data for each request as it traverses multiple services, allowing you to pinpoint which service in the chain is introducing the most delay. This directly addresses the problem of identifying the specific service causing slowdowns in a 15-service application.

Answer

Cloud Logging — search logs for error messages across all 15 services.

Answer

Cloud Monitoring dashboards — create per-service CPU utilization graphs.

Answer

Security Command Center — scan for misconfigurations causing performance issues.

Question 4

A company is concerned about which security responsibilities belong to Google versus which belong to them when using Google Cloud's managed database service (Cloud SQL). In the shared responsibility model, which security tasks does Google handle?

Accepted Answer

Google handles physical security, hardware maintenance, and OS and database software patching.. In the shared responsibility model for Google Cloud services like Cloud SQL, Google is responsible for security 'of' the cloud, which includes physical security of data centers, hardware maintenance, and patching the underlying operating system and database software. This ensures the infrastructure hosting Cloud SQL instances is secure, while the customer remains responsible for securing their data, access policies, and application-level configurations.

Answer

Google controls who can access the database and what data can be stored.

Answer

Google is responsible for backing up customer data and ensuring data recovery.

Answer

Google determines which compliance certifications the customer's application must meet.

Question 5

A SRE team wants to alert when their service is consuming error budget faster than expected, rather than alerting only when the SLO threshold is crossed. Which Cloud Monitoring alerting strategy supports this approach?

Accepted Answer

SLO burn rate alerting — alert when error budget is being consumed faster than the measurement window allows.. B is correct because SLO burn rate alerting is specifically designed to detect when error budget is being consumed faster than the measurement window allows, enabling proactive alerts before the SLO threshold is breached. This approach uses a burn rate (e.g., 2x, 10x) to trigger alerts when the error budget depletion rate exceeds a predefined multiple of the expected rate, allowing the team to respond early. It directly addresses the requirement of alerting on error budget consumption speed rather than waiting for a hard SLO violation.

Answer

Threshold alerting — alert when error rate exceeds 0.1%.

Answer

Uptime check alerting — alert when health checks fail.

Answer

Log-based alerting — alert when specific error messages appear in logs.

Question 6

Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?

Accepted Answer

No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.. Option B is correct because Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).

Answer

Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.

Answer

Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.

Answer

Customers must purchase the Security Command Center Premium tier to enable data encryption.

Question 7

When data is transmitted between a user's browser and a Google Cloud-hosted web application over HTTPS, which security protection does this provide?

Accepted Answer

It encrypts data in transit between the user's browser and the server, preventing eavesdropping and tampering.. HTTPS (HTTP over TLS) encrypts the communication channel between the user's browser and the web server using Transport Layer Security (TLS). This ensures that any data transmitted, such as login credentials or API requests, is protected from eavesdropping and tampering while in transit. It does not protect data at rest or control access to cloud management interfaces.

Answer

It prevents unauthorized users from accessing the Google Cloud Console.

Answer

It encrypts data stored in the server's database.

Answer

It authenticates the user and verifies their permissions to use the application.

Question 8

A digital media company hosts video content globally. They want to reduce origin server load and deliver content faster to viewers worldwide. Their current architecture routes all viewer requests directly to the origin servers in `us-central1`, causing high latency for viewers in Asia and Europe. Which Google Cloud networking capability addresses this?

Accepted Answer

Enable Cloud CDN to cache video content at Google's global edge PoPs, serving viewers from the nearest location.. Cloud CDN uses Google's global edge Points of Presence (PoPs) to cache video content closer to viewers, reducing latency and offloading origin servers. When a viewer requests content, Cloud CDN serves it from the nearest edge cache if available, avoiding a direct trip to the origin in us-central1. This directly addresses the high latency for viewers in Asia and Europe without requiring server replication or bandwidth increases.

Answer

Deploy identical origin servers in every Google Cloud region globally.

Answer

Use Cloud VPN to route viewer traffic through a direct tunnel to the origin servers.

Answer

Increase the origin servers' network bandwidth to handle more simultaneous viewer connections.

Question 9

A security architect wants to implement a 'never trust, always verify' security approach where no user or service is assumed to be trustworthy based on network location alone. Every access request must be authenticated and authorized regardless of whether it comes from inside or outside the corporate network. Which security model describes this approach?

Accepted Answer

Zero Trust security model. The Zero Trust security model (Option B) is correct because it explicitly enforces the 'never trust, always verify' principle, requiring authentication and authorization for every access request regardless of network location. In Google Cloud, this aligns with BeyondCorp, which uses identity-aware proxy (IAP) and context-aware access to verify each request based on user identity, device posture, and other attributes, rather than trusting based on IP address or network perimeter.

Answer

Perimeter security model

Answer

Defense in depth model

Answer

Principle of least privilege

Question 10

A company is evaluating Google Cloud and wants to know: what is Access Transparency, and how does it benefit customers with stringent governance requirements?

Accepted Answer

Access Transparency logs when Google Cloud personnel access customer content, providing an audit trail for governance.. Access Transparency logs are a Google Cloud feature that provides customers with near real-time logs whenever Google personnel access their data. This creates a detailed audit trail, which is essential for customers with stringent governance or compliance requirements, as it allows them to monitor and verify that access is only for authorized purposes.

Answer

Access Transparency shows customers which Google Cloud services are available in their region.

Answer

Access Transparency is a feature that makes all customer data visible to Google for quality improvement.

Answer

Access Transparency provides customers with real-time dashboards of their application's security vulnerabilities.