Cloud Digital Leader Practice Test 32 — 15 Questions

Question 1

A cloud architect wants to ensure that only certain users in the finance team can access a Cloud Storage bucket containing invoices. They also want to log all access attempts. Which two services should they use?

Accepted Answer

IAM and Cloud Audit Logs. IAM (Identity and Access Management) is used to grant specific users (e.g., finance team members) granular access to the Cloud Storage bucket via roles like roles/storage.objectViewer. Cloud Audit Logs (specifically Admin Activity and Data Access audit logs) capture all access attempts, including who accessed the bucket, when, and from which IP address, meeting the logging requirement.

Answer

Cloud NAT and Cloud Audit Logs

Answer

Cloud NAT and Cloud Load Balancing

Answer

IAM and Cloud CDN

Question 2

A company uses Cloud SQL for MySQL and wants to ensure that data is encrypted at rest using customer-managed keys. They also need to rotate the key every 90 days. What should they do?

Accepted Answer

Enable CMEK on the Cloud SQL instance and rotate the key in Cloud KMS. Option C is correct because Cloud SQL supports Customer-Managed Encryption Keys (CMEK) via integration with Cloud KMS. By enabling CMEK on the Cloud SQL instance, you can use a key you create and manage in Cloud KMS, and you can set a rotation period (e.g., 90 days) on that key in Cloud KMS. This ensures data at rest is encrypted with a key you control and that is automatically rotated according to your schedule.

Answer

Use customer-supplied encryption keys (CSEK) with Cloud SQL

Answer

Use default Google-managed encryption and rotate the key using Cloud KMS

Answer

Bring your own key (BYOK) without using Cloud KMS

Question 3

A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS. Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) allows customers to control and rotate keys. CSEK is deprecated and less flexible. SSE-C is not available in Cloud Storage. Default encryption is Google-managed and cannot be rotated by the customer.

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 4

Refer to the exhibit. A security administrator reviews this Cloud Audit Logs entry. What does this entry indicate?

Accepted Answer

The user attempted to read the object 'secret.pdf' and the request resulted in an error.. Option A is correct because the log entry shows a 'storage.objects.get' method with the resource name of a specific object, indicating that user@example.com read the object. Option B is wrong because the method is 'get', not 'delete'. Option C is wrong because the severity is ERROR, but that could be due to the object being private or other reasons; the log shows a successful read? Actually, the severity is ERROR but the method is get, meaning the request resulted in an error? The exhibit doesn't show the status. However, the question is ambiguous. To make it clear, we should specify that the log shows an attempt to read an object that resulted in an error (e.g., 404). But since the log shows the method, we can interpret it as an access attempt. Let's adjust the options to reflect that it shows an attempt. Better: We'll assume the log shows a read attempt that was denied. For clarity, we'll add that the severity is ERROR, meaning the request failed. Then correct answer: The user attempted to read a secret document. Options: A) The user successfully read the object; B) The user attempted to delete the object; C) The user attempted to read the object; D) The user changed permissions. Correct: C (attempted read). Explanation: The method is 'get', and severity ERROR indicates failure, so it's an attempt. Option A is wrong because success would be lower severity. Option B is wrong because method is get. Option D is wrong because method is not setIamPolicy.

Answer

The user updated the IAM policy on the bucket.

Answer

The user attempted to delete the object 'secret.pdf'.

Answer

The user successfully read the object 'secret.pdf'.

Question 5

Which TWO statements about Cloud Identity-Aware Proxy (IAP) are correct?

Accepted Answer

IAP can be used to protect access to Compute Engine VMs via SSH and RDP without a VPN. Option B is correct because Cloud IAP enables identity-based access to Compute Engine instances via SSH and RDP without requiring a VPN or bastion host. IAP uses the user's identity and request context to create a secure tunnel, forwarding traffic to the instance over HTTPS and verifying the user's credentials before allowing the connection.

Answer

IAP encrypts data at rest by default

Answer

IAP only works with Google Cloud applications

Answer

IAP requires using a third-party identity provider

Question 6

A retail company uses Google Cloud to run an online store. They have a security requirement that all API calls to Cloud Storage must come from the company's on-premises network only. Which Google Cloud security feature should they implement?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define perimeters that restrict access to Google Cloud services from specified VPC networks or IP ranges. Cloud Armor is for DDoS and WAF. IAM conditions are for attribute-based access control within a policy. Identity-Aware Proxy protects web applications, not storage APIs.

Answer

IAM conditions with source IP constraint

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Question 7

Which TWO actions are the customer's responsibility under the GCP shared responsibility model?

Accepted Answer

Managing user accounts and authentication. Options B and D are correct. Configuring IAM policies and managing user accounts are customer responsibilities. Physical data center security and network infrastructure maintenance are Google's responsibilities. Encrypting data at rest using default settings is Google's responsibility, but customer can choose additional encryption.

Answer

Encryption of data at rest by default

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Question 8

Which TWO of the following are best practices for securing a Google Cloud environment? (Choose two.)

Accepted Answer

Grant minimal permissions to users and services using IAM roles.. Option B is correct because the principle of least privilege is a foundational security best practice in Google Cloud. By granting minimal permissions using IAM roles, you limit the attack surface and reduce the risk of unauthorized access or accidental data exposure. This aligns with Google Cloud's security model where roles are predefined or custom, and permissions are additive, never implicit.

Answer

Use the same SSH key for all Compute Engine instances.

Answer

Export service account keys and use them in on-premises applications for authentication.

Answer

Rotate service account keys every month.

Question 9

A startup wants to launch a new mobile app without investing heavily in physical servers. They need to pay only for what they use and scale quickly as user base grows. What cloud characteristic best supports this?

Accepted Answer

Pay-as-you-go pricing model. Option C is correct because the pay-as-you-go pricing model, also known as operational expenditure (OpEx) pricing, directly addresses the startup's need to avoid heavy upfront investment in physical servers and only pay for consumed resources. This model enables elastic scaling, allowing the app to automatically provision and de-provision compute resources (e.g., via AWS Auto Scaling or Azure Scale Sets) as the user base grows, aligning cost with actual usage.

Answer

Global infrastructure for low latency

Answer

High reliability and uptime SLAs

Answer

Built-in security and compliance

Question 10

A financial services firm wants to improve disaster recovery without maintaining a second physical data center. They need to replicate data asynchronously and failover quickly. How does cloud transformation help?

Accepted Answer

Creating a replica in another Cloud Region using Cloud Storage and Cloud SQL replicas. Option D is correct because it leverages Cloud Storage for durable, asynchronous object replication and Cloud SQL replicas for cross-region database failover. This eliminates the need for a second physical data center while providing quick failover via a standby replica in another region, meeting the requirements for asynchronous replication and rapid recovery.

Answer

Setting up a VPC peering to a partner data center

Answer

Using managed instance groups in the same region

Answer

Using tape backup stored offsite

Question 11

A manufacturing company wants to use sensor data from equipment to predict failures before they happen, reducing downtime. How does cloud technology enable this transformation?

Accepted Answer

By offering IoT Core and AI Platform to collect data and build predictive models. Cloud provides scalable data ingestion, storage, and advanced analytics (AI/ML) to process IoT data for predictive maintenance. Option B is wrong because edge computing is for low latency, but not the core enabler. Option C is wrong because monitoring is reactive, not predictive. Option D is wrong because batch processing is not real-time predictive.

Answer

By using edge computing to store all data locally

Answer

By setting up monitoring alerts for equipment failure

Answer

By migrating all data to a data warehouse for batch analysis

Question 12

A healthcare provider wants to use AI to analyze medical images while complying with HIPAA. They need a secure environment that supports model training and inference. Which Google Cloud capability is most critical for this transformation?

Accepted Answer

Cloud Healthcare API with AI Platform. Cloud Healthcare API provides HIPAA-compliant storage and interoperability, plus integration with AI Platform for model development. Option B is wrong because GKE containers are flexible but require additional configuration for compliance. Option C is wrong because Cloud Vision API is not HIPAA-covered by default. Option D is wrong because BigQuery is for analytics, not image analysis.

Answer

BigQuery for storing and querying images

Answer

Cloud Vision API for image classification

Answer

Google Kubernetes Engine (GKE) with custom containers

Question 13

A non-profit organization wants to reduce IT overhead so they can focus on their mission. They currently manage their own email server, file storage, and website. What cloud approach best supports this transformation?

Accepted Answer

Replacing on-premise services with Google Workspace, Cloud Storage, and App Engine. Option D is correct because it fully eliminates IT overhead by replacing self-managed services with fully managed cloud alternatives: Google Workspace handles email and collaboration, Cloud Storage provides scalable file storage without server management, and App Engine runs the website with automatic scaling and zero infrastructure maintenance. This aligns with the goal of reducing IT overhead to focus on the mission.

Answer

Upgrading their on-premise hardware to faster servers

Answer

Creating a hybrid cloud with a VPN to their data center

Answer

Migrating their applications to virtual machines in Compute Engine

Question 14

Which THREE of the following are traditional IT constraints that cloud technology helps businesses overcome?

Accepted Answer

Managing hardware refresh cycles and end-of-life. Option B is correct because cloud providers manage the underlying hardware, including regular refresh cycles and end-of-life replacements, which eliminates the need for businesses to invest capital in new servers or storage arrays. This shifts the burden of hardware lifecycle management from the customer to the provider, reducing operational overhead and ensuring access to up-to-date infrastructure.

Answer

Increased security risks from public connectivity

Answer

Compliance with industry regulations

Question 15

A global e-commerce company needs to deliver content to users quickly regardless of location. Which Google Cloud service can cache content at edge locations to reduce latency?

Accepted Answer

Cloud CDN. Cloud CDN (Content Delivery Network) uses Google's globally distributed edge caches to deliver content from the nearest point of presence (PoP) to the user, significantly reducing latency. It integrates with Cloud Load Balancing and Cloud Storage to cache static and dynamic content, accelerating delivery for a global e-commerce platform.

Answer

Cloud Storage

Answer

Cloud Load Balancing

Answer

Cloud Interconnect