Cloud Digital Leader Practice Test 34 — 15 Questions

Question 1

A data analytics team wants to analyze large datasets using SQL and create dashboards with minimal latency. They need a serverless data warehouse and a BI tool. Which two services should they use? (Choose exactly 2.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Looker. BigQuery is a serverless data warehouse for SQL analytics. Looker is a BI platform integrated with BigQuery for dashboards. Dataflow is for data processing, not storage. Cloud Storage is for object storage, not SQL analytics. Looker Studio is free but less feature-rich for enterprise needs.

Answer

Dataflow

Answer

Looker Studio

Answer

Cloud Storage

Question 2

A company wants to reduce costs for its batch processing jobs that run nightly on Compute Engine. The jobs are fault-tolerant and can be interrupted. They are considering using preemptible VMs. Which THREE statements about preemptible VMs are true?

Accepted Answer

Preemptible VMs do not offer live migration.. Preemptible VMs can be terminated at any time within 24 hours (typical max 24h). They are significantly cheaper than regular VMs. They cannot be migrated to regular VMs; you must recreate them. They do not offer live migration. They are suitable for fault-tolerant batch jobs.

Answer

Preemptible VMs can be migrated to regular VMs if preemption occurs.

Answer

Preemptible VMs provide the same SLA as standard VMs.

Question 3

What is the primary purpose of VPC Service Controls?

Accepted Answer

To prevent data exfiltration from Google Cloud services. VPC Service Controls create perimeters around Google Cloud services to prevent data exfiltration. VPC firewall rules control network traffic. Cloud Armor is for DDoS. Cloud IDS is for intrusion detection.

Answer

To control ingress and egress traffic at the network level

Answer

To detect network intrusions

Answer

To protect against DDoS attacks

Question 4

A large enterprise is migrating its on-premises data center to Google Cloud. They need a dedicated, low-latency, and highly available connection between their on-premises network and their VPC. Which networking service should they use?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides dedicated, high-bandwidth, low-latency connections with SLAs. Cloud VPN is over the public internet and may not meet strict latency/availability requirements. Load Balancing and CDN are not for connectivity to on-premises.

Answer

Cloud CDN

Answer

Cloud VPN

Answer

Cloud Load Balancing

Question 5

A developer wants to deploy a containerized web application that can scale to zero when not in use, and only pay for actual request processing time. Which Google Cloud compute service should the developer use?

Accepted Answer

Cloud Run. Cloud Run is a serverless container runtime that scales to zero and charges per request, ideal for containerized apps with variable traffic. Cloud Functions is for smaller code snippets, not containers. Compute Engine runs VMs continuously, and GKE requires at least one node.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Question 6

A data science team needs to train a custom machine learning model using their own data. They want a unified platform that manages the entire ML lifecycle, including data preparation, training, tuning, and deployment. Which service should they use?

Accepted Answer

Vertex AI. Vertex AI is Google Cloud's unified ML platform that covers the full lifecycle from data to deployment.

Answer

AutoML

Answer

AI Platform

Answer

Cloud Functions

Question 7

A startup is building a mobile app and needs to store user profiles and preferences. The data is hierarchical and the app requires real-time synchronization across devices. Which Google Cloud database should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database designed for mobile apps, with real-time sync and offline support. Cloud SQL and Spanner are relational, not ideal for hierarchical data. Bigtable is for time-series/analytics, not mobile app data.

Answer

Cloud Spanner

Answer

Cloud Bigtable

Answer

Cloud SQL

Question 8

A data engineering team needs to store and manage database passwords and API keys used by their applications. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like passwords and API keys. Cloud KMS is for encryption keys. Cloud Key Management Service is for creating and managing cryptographic keys, not storing secrets. Cloud Storage is for objects.

Answer

Cloud KMS

Answer

Cloud Key Management Service

Answer

Cloud Storage

Question 9

An engineer needs to grant a team access to view but not edit Compute Engine instances in a project. They also need to ensure that any new instances created in a folder automatically inherit a policy that denies using certain machine types. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Apply an organization policy constraint to the folder to deny certain machine types. IAM roles grant permissions; compute.viewer provides read-only access to Compute resources. Organization policies can be set at the folder level to restrict machine types across all projects within.

Answer

Grant the team the 'roles/iam.securityReviewer' role

Answer

Use a deny IAM policy at the project level to block create permissions

Answer

Set a quota for the machine type at the project level

Question 10

A company wants to protect its web application deployed on Google Cloud from OWASP Top 10 attacks and also block traffic from specific geographic regions. Which TWO services should they use together? (Choose 2)

Accepted Answer

Cloud CDN. Cloud Armor provides WAF rules for OWASP Top 10 and geo-blocking. Cloud CDN caches content and can be used with Cloud Armor for edge protection.

Answer

Cloud Load Balancing

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 11

A security team needs to monitor and analyze logs from multiple GCP projects to detect threats across the organization. They require a SIEM solution that can ingest logs from on-premises and other clouds. Which service should they use?

Accepted Answer

Chronicle. Chronicle is a Google Cloud SIEM that ingests logs from various sources, including on-premises and other clouds, and provides threat detection. Security Command Center is for vulnerability scanning, not SIEM.

Answer

Security Command Center

Answer

Cloud IDS

Answer

Cloud Logging

Question 12

A company runs Compute Engine instances for batch processing that are shut down on weekends. They want to automatically reduce costs without committing to a 1-year or 3-year term. Which discount type applies?

Accepted Answer

Sustained use discount. Sustained use discounts automatically apply for instances running more than 25% of a month, with no upfront commitment.

Answer

Sole-tenant node discounts

Answer

Preemptible VM discounts

Answer

Committed use discount

Question 13

An organization wants to detect and respond to threats across their GCP environment, including finding misconfigurations, vulnerabilities, and potential malicious activity. Which service provides a unified view of security findings?

Accepted Answer

Security Command Center. Security Command Center is a central dashboard for security findings including vulnerabilities, misconfigurations, and threats.

Answer

Mandiant

Answer

Chronicle

Answer

Cloud Audit Logs

Question 14

An organization needs to protect a web application hosted on Google Cloud from DDoS attacks and SQL injection attempts. They want a managed security service that integrates with Cloud Load Balancing. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's managed DDoS protection and Web Application Firewall (WAF) service. It integrates with Cloud Load Balancing to filter traffic based on IP, geo, and HTTP headers, and includes preconfigured rules (e.g., OWASP) to block SQL injection. Cloud IDS is for network intrusion detection. reCAPTCHA Enterprise is for bot detection. VPC firewall rules are for network-level access control.

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Answer

VPC firewall rules

Question 15

A company wants to ensure that its Google Cloud resources can only be accessed from within a specific VPC network, preventing data exfiltration to the internet. They need to enforce this for Cloud Storage and BigQuery APIs. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create perimeters around managed services to restrict access to only allowed VPC networks.

Answer

Cloud NAT

Answer

VPC Firewall Rules

Answer

Private Google Access