Cloud Digital Leader Practice Test 32 — 15 Questions

Question 1

A company is migrating a legacy monolithic application to Google Cloud. They want to reduce operational overhead by eliminating server management while keeping the ability to run containers. The application has unpredictable traffic patterns and needs to scale to zero when idle. Which compute option is the best fit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that automatically scales to zero when idle, eliminating server management and cost during idle periods. GKE requires cluster management, Compute Engine is not serverless, and App Engine Flex requires VMs always running.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Flexible Environment

Answer

Compute Engine with managed instance groups

Question 2

A developer wants to deploy a containerized web application that can automatically scale to zero when there are no requests, and charges only for resources used during request processing. Which Google Cloud compute service should they use?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero and charges per request. Google Kubernetes Engine and Compute Engine require running instances, and App Engine Standard is a platform as a service but not container-based.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard Environment

Question 3

An organization wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they control and rotate periodically. They also need to audit key usage. Which approach should they take?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow customers to control and rotate keys and audit usage via Cloud Audit Logs.

Answer

Use Customer-Supplied Encryption Keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use Cloud External Key Manager (Cloud EKM)

Question 4

An organization has multiple projects in Google Cloud. They want to enforce a policy that prevents the creation of Compute Engine instances with more than 8 vCPUs in any project under a specific folder, except for a few exempted projects. How can they achieve this with minimal overhead?

Accepted Answer

Use organization policy with tags: define a tag 'exempt' and attach it to exempted projects; set the policy condition to apply unless the resource has the tag.. Using organization policy constraints with tags allows conditional enforcement. By attaching a tag to exempted projects and using conditions in the policy, they can apply the restriction to most projects while allowing exceptions.

Answer

Use IAM conditions with a custom role to deny creation of large instances.

Answer

Create a folder for exempted projects and apply a allow policy to that folder.

Answer

Apply a custom organization policy at the folder level without tags, and add exceptions in each project individually.

Question 5

A company needs to perform interactive SQL analytics on petabytes of data without managing any infrastructure. They need to query data stored in Cloud Storage and want the fastest query performance. Which Google Cloud service should they use?

Accepted Answer

BigQuery. BigQuery is a serverless, highly scalable data warehouse that supports SQL queries on data stored in Cloud Storage (external tables) or natively. It provides fast performance on petabyte-scale data without infrastructure management. Dataflow is for ETL, not ad-hoc analytics; Cloud SQL is for OLTP; Looker is a BI layer on top of a data warehouse.

Answer

Looker

Answer

Dataflow

Answer

Cloud SQL

Question 6

An engineer wants to analyze historical spending trends and break down costs by project, region, and service. They need to run complex SQL queries on the billing data. What is the recommended approach?

Accepted Answer

Enable billing export to BigQuery and query the exported tables. Billing export to BigQuery sends detailed billing information (e.g., usage, cost, project, labels) into BigQuery tables, enabling complex SQL analysis.

Answer

Set up a budget alert to receive cost reports daily

Answer

Use the Cloud Billing API to programmatically fetch cost data

Answer

Download the monthly invoice CSV and import it into Sheets

Question 7

A security engineer needs to monitor and analyze security logs from multiple GCP projects and on-premises sources in a centralized SIEM. Which Google Cloud service is designed for log management and security analytics at scale?

Accepted Answer

Chronicle. Chronicle is Google Cloud's SIEM platform that ingests logs from various sources and provides security analytics. Security Command Center is for vulnerability management, not a SIEM. Cloud Logging is for log storage and basics, but not a full SIEM.

Answer

Cloud Logging

Answer

Security Command Center

Answer

Cloud IDS

Question 8

An organisation needs to run a batch analytics job every night that processes terabytes of data stored in Cloud Storage. The job is expected to run for 3 hours and can tolerate interruptions. The compute resources should be as cost-effective as possible. Which Compute Engine VM type should be used?

Accepted Answer

Preemptible VMs. Preemptible VMs are significantly cheaper than standard VMs and are ideal for batch jobs that can tolerate interruptions. They can be preempted at any time but can be restarted. Standard VMs are for long-running, fault-intolerant workloads. Sole-tenant nodes are for compliance, not cost savings. Custom machine types allow tailoring resources but do not inherently save cost like preemptible VMs.

Answer

Standard (on-demand) VMs

Answer

Custom machine types

Answer

Sole-tenant nodes

Question 9

A data engineer needs to process a continuous stream of clickstream events from multiple sources, aggregate them into 1-minute windows, and write the results to BigQuery for real-time dashboarding. The solution must handle exactly-once processing semantics. Which combination of services should they use?

Accepted Answer

Pub/Sub -> Dataflow -> BigQuery. Dataflow (Apache Beam) provides exactly-once processing semantics and can read from Pub/Sub, apply windowed aggregations, and write to BigQuery. Pub/Sub is the ingestion layer for streaming events. Cloud Functions and Cloud Run are not designed for stateful windowed aggregations at scale, and Cloud Dataproc (Hadoop/Spark) would require more overhead.

Answer

Pub/Sub -> Cloud Functions -> BigQuery

Answer

Cloud Storage -> Dataflow -> BigQuery

Answer

Pub/Sub -> Cloud Dataproc -> BigQuery

Question 10

A security team wants to restrict access to a Cloud Storage bucket so that only Compute Engine VMs in the same VPC network can read objects. The VMs do not have public IP addresses. Which configuration should they use?

Accepted Answer

Enable Private Google Access on the subnet and use VPC Service Controls to limit bucket access to the VPC.. Private Google Access allows VMs without external IPs to access Google APIs and services via the VPC network. Combined with VPC Service Controls and bucket IAM, this ensures only VMs in the VPC can access the bucket.

Answer

Assign external IPs to the VMs and use firewall rules.

Answer

Create a bucket with uniform bucket-level access and grant the `storage.objectViewer` role to `allUsers`.

Answer

Use a Cloud VPN to connect the VMs to the bucket.

Question 11

An organisation is migrating its on-premises Oracle database to Google Cloud. They need a fully managed, PostgreSQL-compatible database with high performance for transaction processing and built-in AI capabilities for predictive analytics. Which database service should they choose?

Accepted Answer

AlloyDB. AlloyDB is a fully managed PostgreSQL-compatible database that offers high performance (4x faster than standard PostgreSQL) and integrated AI capabilities for vector search and predictive analytics. Cloud SQL for PostgreSQL is also managed but lacks the AI optimisations. Cloud Spanner is globally distributed but not PostgreSQL-compatible. Bare Metal Solution runs Oracle on dedicated hardware, not managed.

Answer

Bare Metal Solution for Oracle

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Question 12

A data analyst needs to run ad-hoc SQL queries on a large dataset stored in Cloud Storage. The data is in CSV format and does not require real-time results. Which Google Cloud service should they use?

Accepted Answer

BigQuery. BigQuery supports external data sources; you can create an external table pointing to CSV files in Cloud Storage and run SQL queries without loading the data. This is ideal for ad-hoc analysis on existing data.

Answer

Dataflow

Answer

Cloud SQL

Answer

Cloud Dataproc

Question 13

A retail company migrated its e-commerce platform to Google Cloud. During a flash sale, the application experiences high latency. The architecture uses managed instance groups with autoscaling based on CPU utilization. The database is Cloud SQL with read replicas. What is the MOST likely cause of the latency?

Accepted Answer

Cloud SQL connection limit is reached. Database connection pooling is often misconfigured during autoscaling, leading to connection exhaustion and increased latency.

Answer

Autoscaling is not triggered because CPU utilization is below threshold

Answer

Insufficient Cloud SQL storage capacity

Answer

SSL/TLS encryption is causing overhead

Question 14

Which Google Cloud service provides a fully managed, serverless data warehouse for petabyte-scale analytics with SQL?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, serverless data warehouse. It supports SQL queries at petabyte scale with no infrastructure to manage. Cloud SQL is for OLTP, Dataproc is for Hadoop/Spark, and Dataflow is for stream/batch processing.

Answer

Cloud SQL

Answer

Dataproc

Answer

Dataflow

Question 15

An engineer is deploying a global application that requires low latency for users in North America, Europe, and Asia. They plan to use Compute Engine instances in multiple regions. Which Google Cloud resource is essential to distribute traffic and provide a single anycast IP address?

Accepted Answer

Global external HTTP(S) load balancer. Global external HTTP(S) load balancer provides a single anycast IP and distributes traffic across regions, enabling low-latency access worldwide.

Answer

Cloud CDN

Answer

Traffic Director

Answer

Cloud NAT