Cloud Digital Leader Practice Test 33 — 15 Questions

Question 1

A company wants to use a pre-trained model to extract text from scanned invoices. They need a fully managed API that can be called via REST. Which Google Cloud service should they use?

Accepted Answer

Document AI. Document AI is a fully managed service for document processing, including OCR and extraction from invoices. Vision AI is for general image analysis. Natural Language AI handles text sentiment/entities. Vertex AI is a platform for custom models, not pre-built API for invoices.

Answer

Vision AI

Answer

Natural Language AI

Answer

Vertex AI

Question 2

A company runs a global web application hosted on Compute Engine behind a Cloud Load Balancer. They want to protect against DDoS attacks and filter incoming traffic based on IP reputation and geolocation. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is a web application firewall (WAF) and DDoS protection service that integrates with Cloud Load Balancing. It allows IP allow/deny lists, rate limiting, and predefined rules to block traffic based on geo-location and threat intelligence. VPC firewall rules operate at the network level but cannot inspect application-layer traffic or use IP reputation. Cloud CDN caches content but does not filter traffic. Cloud NAT provides outbound connectivity only.

Answer

Cloud CDN

Answer

Cloud NAT

Answer

VPC firewall rules

Question 3

A company wants to use machine learning models but has no in-house data science team. They need a service that allows them to train custom models using their own data without managing infrastructure. Which Google Cloud service should they use?

Accepted Answer

Vertex AI (including AutoML). Vertex AI provides a unified platform for ML, including AutoML for custom model training without managing infrastructure. BigQuery ML is for SQL-based ML, AI Platform Notebooks require manual setup, and Cloud TPUs are hardware accelerators, not a managed service.

Answer

AI Platform Notebooks

Answer

BigQuery ML

Answer

Cloud TPUs

Question 4

A company must meet regulatory requirements that restrict where data can be stored and processed. They need to ensure that Google Cloud personnel have limited and audited access to their data. Which combination of services should they use?

Accepted Answer

Assured Workloads and Access Transparency. Assured Workloads provides regulatory compliance controls and access restrictions for specific regions. Access Transparency logs Google personnel access. Cloud Audit Logs track user activity. The question asks for a combination that restricts personnel access and provides audit logs.

Answer

Access Transparency and VPC Service Controls

Answer

Cloud KMS and Cloud Audit Logs

Answer

VPC Service Controls and Cloud Audit Logs

Question 5

A security engineer needs to analyze network traffic for malicious payloads and anomalies in real-time across multiple VPC networks in a project. The solution must be managed and not require deploying third-party appliances. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS provides managed intrusion detection across VPC networks, analyzing traffic for threats like malware and anomalies.

Answer

Security Command Center

Answer

Cloud Armor

Answer

VPC Flow Logs

Question 6

An organization wants to ensure that all data stored in Cloud Storage is encrypted with customer-managed keys that can be rotated on demand. They also need to log every key use for audit compliance. Which combination of services should they use?

Accepted Answer

Cloud KMS with Customer-Managed Encryption Keys (CMEK) and Cloud Audit Logs. Cloud KMS allows creation and management of customer-managed encryption keys (CMEK) for Cloud Storage. Cloud Audit Logs can be used to log key usage (e.g., via Data Access audit logs). CSEK is deprecated; Secret Manager is for secrets, not encryption keys for storage.

Answer

Cloud KMS with Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys with Access Transparency

Answer

Secret Manager with encryption keys and Cloud Logging

Question 7

A startup wants to deploy a containerized web application that can scale to zero when not in use and automatically scale based on request traffic. They have limited DevOps experience and want minimal infrastructure management. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero, automatically scales based on requests, and requires no cluster management, making it ideal for this scenario.

Answer

App Engine Standard

Answer

Google Kubernetes Engine

Answer

Compute Engine

Question 8

A development team runs a web application on Cloud Run. They need to store session state across requests. Which Google Cloud service should they use?

Accepted Answer

Memorystore for Redis. Cloud Run instances are stateless; for session state, use an external caching layer like Memorystore (Redis). Pub/Sub is for messaging, Cloud SQL for relational data, and Cloud Storage for objects.

Answer

Cloud Storage

Answer

Cloud SQL

Answer

Cloud Pub/Sub

Question 9

A team is using Cloud Build to build container images and push them to Artifact Registry. The build process involves sensitive dependencies that should not be exposed to the internet. The team wants to ensure that all builds execute on a private network without public IP addresses. What should the team configure?

Accepted Answer

Use a private pool in Cloud Build. Cloud Build supports private pools that provide workers in a customer-managed VPC network, allowing builds to run without public IP addresses and access internal resources. Connecting the project to a shared VPC only enables network access but workers still have public IPs unless private pools are used. Using Artifact Registry VPC-SC perimeters helps secure the registry but not the build workers. Cloud NAT provides outbound internet but does not remove public IPs from workers.

Answer

Set up Cloud NAT for the Cloud Build workers

Answer

Configure Artifact Registry with VPC Service Controls

Answer

Connect the Cloud Build service account to a shared VPC

Question 10

A media streaming company wants to reduce latency for users worldwide by serving content from edge locations. They also want to offload traffic from their origin servers. Which Google Cloud service should they implement?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge network to cache content close to users, reducing latency and origin load.

Answer

Cloud Interconnect

Answer

Cloud Storage

Answer

Cloud Load Balancing

Question 11

A startup wants to deploy a containerized web application that can scale to zero during periods of no traffic, and they want to minimize operational overhead. Which Google Cloud compute service is the BEST fit?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that automatically scales your containers up and down, including scaling to zero when there is no traffic. It abstracts away infrastructure management, making it ideal for this use case.

Answer

App Engine Flexible Environment

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine with managed instance groups

Question 12

A company wants to reduce its on-premises data center footprint by moving workloads to Google Cloud. They need to maintain low-latency connectivity between their remaining on-premises equipment and their Google Cloud VPC. Which Google Cloud service should they use?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides direct, private, high-bandwidth connections between on-premises and Google Cloud, meeting low-latency requirements. Partner Interconnect uses service providers with lower bandwidth. Cloud VPN is internet-based and slower. Direct Peering lacks SLAs.

Answer

Cloud VPN

Answer

Partner Interconnect

Answer

Direct Peering

Question 13

A team wants to track costs for their development and production environments separately. They have multiple projects for each environment. Which approach should they use to group projects by environment and analyze costs by environment in billing reports?

Accepted Answer

Add a label like 'environment:dev' or 'environment:prod' to each project. Labels are key-value pairs that can be applied to resources or projects and used for cost allocation and filtering in billing reports. Folders are for hierarchical grouping and IAM inheritance, not direct cost tracking.

Answer

Create a folder for each environment and assign projects to the folders

Answer

Use separate billing accounts for each environment

Answer

Create a separate organization for each environment

Question 14

An organization wants to separate billing and access control for two departments, each with multiple projects. They also need to apply common IAM policies to all projects in a department. What is the recommended way to structure their resource hierarchy?

Accepted Answer

Use folders under the organization node, one per department, and place projects inside them. Folders sit below the organization node and above projects. They allow grouping projects by department and applying IAM policies at the folder level, which are inherited by all projects within.

Answer

Place all resources in a single project and use Cloud Identity groups for access

Answer

Create one project per department and use labels to separate them

Answer

Create separate billing accounts per department and link projects directly

Question 15

A company runs a batch processing workload every night that takes 60 minutes on a single n1-standard-32 VM. They want to reduce costs by using preemptible VMs but need the job to complete within 90 minutes. The job can be parallelized if necessary. Which approach is most cost-effective?

Accepted Answer

Split the workload across 4 preemptible n1-standard-8 VMs with checkpointing.. Preemptible VMs can be terminated at any time, so running multiple smaller instances with checkpointing and retries reduces cost and meets the deadline.

Answer

Use a single non-preemptible VM to ensure completion.

Answer

Use the same VM but as preemptible; if preempted, restart the job from scratch.

Answer

Use a single preemptible VM with persistent disk snapshots every 10 minutes.