Cloud Digital Leader Practice Test 30 — 15 Questions

Question 1

A security engineer needs to ensure that a Compute Engine instance can access a Cloud Storage bucket using its own identity, without embedding service account keys in the instance. What should the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service account, grant it the required IAM roles on the bucket, and attach the service account to the Compute Engine instance.. Attaching a service account to the Compute Engine instance allows it to authenticate using instance metadata without keys.

Answer

Create a service account and download its key. Store the key in Cloud Storage and have the instance download it at startup.

Answer

Create a service account, generate a key, and use the gcloud auth activate-service-account command on the instance.

Answer

Use the default Compute Engine service account and grant it roles on the bucket; no additional steps needed.

Question 2

A company uses Cloud SQL for MySQL and needs to migrate to a PostgreSQL-compatible database that offers improved performance for AI workloads (e.g., vector embeddings). Which Google Cloud database is MOST suitable?

Accepted Answer

AlloyDB. AlloyDB is a PostgreSQL-compatible database that is optimized for high performance and features like vector embeddings for AI, making it ideal for this migration.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Answer

Bigtable

Question 3

Which Google Cloud service is a fully managed, serverless data warehouse for running SQL queries on petabyte-scale datasets?

Accepted Answer

BigQuery. BigQuery is the serverless data warehouse for analytics SQL queries. Dataflow is for stream processing, Dataproc for Hadoop/Spark, and Cloud SQL for OLTP.

Answer

Cloud SQL

Answer

Cloud Dataflow

Answer

Cloud Dataproc

Question 4

A company wants to reserve Compute Engine resources for a 3-year term to get a significant discount. Which discount type should they use?

Accepted Answer

Committed use discount. Committed use discounts (CUDs) in Google Cloud allow you to reserve Compute Engine resources for a 1-year or 3-year term in exchange for significant discounts (up to 57% for 3-year). This is the correct discount type for a 3-year commitment. CUDs are ideal for predictable workloads.

Answer

Preemptible VM discount

Answer

Sustained use discount

Answer

Sole-tenant node discount

Question 5

A developer needs to allow a Compute Engine VM to read from a specific Cloud Storage bucket. Which IAM role should be granted to the VM's service account?

Accepted Answer

roles/storage.objectViewer. roles/storage.objectViewer grants read-only access to objects in a Cloud Storage bucket, including listing and getting objects. Granting it to the VM's service account allows the Compute Engine VM to read from the specific bucket without granting write or administrative permissions. This follows the principle of least privilege for a read-only requirement.

Answer

roles/storage.legacyBucketReader

Answer

roles/storage.admin

Answer

roles/storage.objectCreator

Question 6

Which THREE of the following are best practices for managing operations in Google Cloud? (Choose THREE.)

Accepted Answer

Set up budget alerts to monitor costs. Setting up budget alerts in Google Cloud allows you to monitor costs proactively by triggering notifications when spending exceeds defined thresholds. This is a fundamental operational best practice to avoid unexpected bills and maintain financial control over your cloud resources.

Answer

Use Cloud Logging to store all logs indefinitely to ensure compliance

Answer

Use a single project for all workloads to simplify management

Question 7

Match each Google Cloud storage class to its use case.

Accepted Answer

Standard: Frequently accessed data, short retention period. The correct matches are: Standard for frequently accessed data, Nearline for data accessed less than once a month, Coldline for data accessed less than once a quarter, and Archive for data accessed less than once a year. Common confusions involve misremembering the access frequency thresholds.

Answer

Standard: Data accessed less than once a year

Answer

Nearline: Data accessed less than once a quarter

Question 8

A global gaming company uses Cloud Spanner for their leaderboard. They notice that write latency spikes during peak hours. The database is currently deployed in a single region. Which scaling strategy should they implement to reduce write latency globally?

Accepted Answer

Use Cloud Spanner multi-region configuration.. Cloud Spanner's multi-region configuration is designed to reduce write latency for globally distributed users by placing write-capable replicas in multiple geographic regions. This allows writes to be committed at the nearest replica, leveraging Spanner's TrueTime and Paxos-based replication to maintain strong consistency across regions. A single-region deployment forces all writes to a single location, causing high latency for distant clients during peak hours.

Answer

Implement application-level caching with Memorystore.

Answer

Change to Cloud Bigtable for higher throughput.

Answer

Add more nodes to the existing Spanner instance.

Question 9

A healthcare company must store PHI in Cloud Storage. They require encryption at rest and in transit, and need to comply with HIPAA. Which combination of Google Cloud features should they implement?

Accepted Answer

Cloud Storage with SSE-GCP and use HTTPS, sign BAA with Google.. Cloud Storage with server-side encryption (SSE-GCP) provides encryption at rest by default, HTTPS ensures encryption in transit, and signing a Business Associate Agreement (BAA) with Google is a mandatory contractual requirement for HIPAA compliance. This combination satisfies all stated requirements: encryption at rest, encryption in transit, and HIPAA compliance.

Answer

Cloud Storage with SSE-C, HTTP for in-transit, and enable HIPAA compliance flag.

Answer

Use Cloud Storage with CSEK and disable public access.

Answer

Use Cloud Storage with CMEK and use VPN for transit.

Question 10

Refer to the exhibit. A security engineer applies this IAM policy. What is the effect?

Accepted Answer

Access is allowed only from the IP address 203.0.113.1.. The IAM policy shown in the exhibit restricts access to requests coming from IP address 203.0.113.1. In Google Cloud IAM, this is expressed using a condition on `source.ip` (or `request.headers['x-goog-user-ip']`). Only requests from that IP satisfy the condition, and requests from any other IP are denied.

Answer

Access is allowed only to resources tagged with 'production'.

Answer

Access is allowed only with two-factor authentication.

Answer

Access is allowed only during business hours.

Question 11

Match each Google Cloud migration term to its description.

Accepted Answer

Lift and Shift: Moving applications to the cloud without modification. Correct matches: Lift and Shift moves apps without changes; Replatform optimizes; Refactor re-architects; Migrate for Compute Engine is the VM migration tool. Common confusions include mixing tool names and migration strategies.

Answer

Lift and Shift: Tool for migrating VMs to GCP

Answer

Replatform: Re-architecting applications to be cloud-native

Question 12

A mid-sized company runs a legacy inventory management system on a single on-premises server. The system uses a monolithic Java application and a PostgreSQL database. The server has reached 90% CPU usage during business hours, and the database is 800 GB. The company wants to migrate to Google Cloud to take advantage of autoscaling and reduce hardware costs. The migration must have minimal downtime and the application cannot be significantly rewritten. The team also wants to enable future scalability for peak seasons. The IT team includes experienced database administrators but limited application development resources. Given the constraints, which approach should the team take?

Accepted Answer

Use Database Migration Service to migrate the PostgreSQL database to Cloud SQL with continuous replication for minimal downtime. Simultaneously, rehost the application on a managed instance group with autoscaling. Have a rollback plan.. It combines Database Migration Service with continuous replication (CDC) to achieve near-zero downtime for the 800 GB PostgreSQL database, while rehosting the monolithic application on a managed instance group with autoscaling to address CPU spikes without code changes. This approach respects the constraint of limited app development resources by avoiding refactoring, and the rollback plan provides safety during migration.

Answer

Containerize the entire monolithic application and deploy it on Google Kubernetes Engine with a persistent volume for the database, with horizontal pod autoscaling.

Answer

Use Database Migration Service to migrate the PostgreSQL database to Cloud SQL with a one-time dump and restore, and rehost the application on a single Compute Engine instance.

Answer

Refactor the monolithic application into microservices, deploy on Cloud Run, and use Cloud Spanner for the database.

Question 13

A retail company needs to handle sudden spikes in customer traffic during holiday promotions without over-provisioning hardware. Which cloud characteristic directly enables this capability?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to automatically scale up or down in response to demand. For a retail company handling sudden traffic spikes, elasticity ensures compute and network capacity dynamically adjusts without manual intervention or over-provisioning, directly matching the workload in real time.

Answer

Load balancing

Answer

High availability

Answer

Disaster recovery

Question 14

An organization wants to ensure business continuity by failing over to a secondary region in case of disaster. Which cloud characteristic enables this capability?

Accepted Answer

Global infrastructure. Global infrastructure refers to the distributed network of data centers across multiple geographic regions. By deploying resources in a secondary region, an organization can fail over to that region during a disaster, ensuring business continuity. This capability is unique to the cloud's global footprint, not to other characteristics like scalability or measured service.

Answer

Scalability

Answer

Measured service

Answer

Resource pooling

Question 15

A financial services company must comply with strict data residency regulations. Which cloud feature helps meet compliance requirements?

Accepted Answer

Data location controls. Data location controls (Option A) allow explicit geographic restrictions, directly meeting data residency requirements. Customer-managed encryption keys (Option E) address data confidentiality and access control, not where data resides. The other options are irrelevant or misleading.

Answer

Open source software

Answer

Public internet access

Answer

Single data center footprint

Answer

Customer-managed encryption keys