Cloud Digital Leader Practice Test 35 — 15 Questions

Question 1

An organization needs to store confidential healthcare data in Google Cloud. Which compliance certification ensures that Google Cloud infrastructure meets the required security controls for protected health information (PHI)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) sets standards for protecting PHI. Customers must sign a Business Associate Agreement (BAA) with Google to use GCP for HIPAA-covered data. The other certifications address different data types.

Answer

ISO 27001

Answer

SOC 2

Answer

PCI DSS

Question 2

Which Google Cloud service is a fully managed, serverless data warehouse for running SQL queries on petabyte-scale datasets?

Accepted Answer

BigQuery. BigQuery is the serverless data warehouse for analytics SQL queries. Dataflow is for stream processing, Dataproc for Hadoop/Spark, and Cloud SQL for OLTP.

Answer

Cloud SQL

Answer

Cloud Dataflow

Answer

Cloud Dataproc

Question 3

Which cloud computing characteristic is defined by the NIST as the ability for a consumer to provision computing capabilities automatically without requiring human interaction with each service provider?

Accepted Answer

On-demand self-service. On-demand self-service allows users to provision resources automatically, without needing manual approval or interaction with Google Cloud staff.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity

Question 4

A company uses Cloud Functions to process image uploads. Each image triggers a function that uses Vision API to extract text and stores results in Firestore. The function sometimes fails due to timeout when images are large. How should they redesign for reliability and scale?

Accepted Answer

Use Cloud Tasks with Cloud Run to process images asynchronously. Cloud Functions has a timeout limit (9 minutes max for gen2). For long-running operations, use Cloud Run or migrate processing to a queue. Cloud Tasks with Cloud Run decouples and allows async processing with longer timeouts.

Answer

Use Cloud Scheduler to trigger the function every minute

Answer

Increase the function timeout to 60 minutes

Answer

Use Compute Engine VMs with startup scripts

Question 5

A company wants to reserve Compute Engine resources for a 3-year term to get a significant discount. Which discount type should they use?

Accepted Answer

Committed use discount. Committed use discounts (CUDs) allow you to commit to a certain level of usage for 1 or 3 years in exchange for a discounted rate.

Answer

Preemptible VM discount

Answer

Sustained use discount

Answer

Sole-tenant node discount

Question 6

A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS. Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) allows customers to control and rotate keys. CSEK is deprecated and less flexible. SSE-C is not available in Cloud Storage. Default encryption is Google-managed and cannot be rotated by the customer.

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 7

A company wants to replace its VPN-based remote access with a zero-trust solution that verifies user identity and device health before granting access to internal applications. Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise provides zero-trust access based on user identity and device context, eliminating the need for a VPN. IAP is a component but the full solution is BeyondCorp Enterprise.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Answer

Cloud Identity

Question 8

A company has a Premium support plan. They experience a critical production outage and need immediate assistance. What is the guaranteed response time for a P1 (Priority 1) case?

Accepted Answer

15 minutes. Premium support offers a 15-minute response time for P1 cases, along with a Technical Account Manager (TAM) and other benefits.

Answer

4 hours

Answer

8 hours

Answer

1 hour

Question 9

A company wants to analyze petabytes of sales data using SQL queries with sub-second response times for dashboards. They need a fully managed, serverless solution that separates storage and compute. Which service meets these requirements?

Accepted Answer

BigQuery. BigQuery is a serverless data warehouse that stores petabytes and uses SQL with fast query performance via columnar storage and separation of compute and storage.

Answer

Cloud SQL

Answer

Cloud Spanner

Answer

Dataflow

Question 10

A company wants to run a batch job that processes large log files stored in Cloud Storage every night. The job typically runs for 2 hours on a single VM with 16 vCPUs and 64 GB of memory. They want to minimize costs. Which compute option is BEST?

Accepted Answer

Compute Engine with preemptible VMs. Preemptible VMs offer significant cost savings (up to 60-91% discount) for fault-tolerant batch jobs that can handle interruptions.

Answer

Cloud Run

Answer

Compute Engine with Sole-tenant nodes

Answer

Compute Engine with standard VMs

Question 11

A company is moving a sensitive database to Cloud SQL. They need to encrypt data at rest using customer-managed encryption keys (CMEK) and rotate the key every 30 days. How should they set this up?

Accepted Answer

Create a key in Cloud KMS, specify it as the CMEK for Cloud SQL, and set rotation period to 30 days. Cloud KMS allows managing keys outside the service, and you can set an automatic rotation period of 30 days. Cloud HSM provides hardware-backed keys but is not required. Protecting the key with IAM is separate. Enabling encryption by default uses Google-managed keys, not CMEK.

Answer

Enable encryption by default in Cloud SQL settings

Answer

Use Cloud HSM to generate a key and import it to Cloud SQL

Answer

Create a key in Cloud KMS and manually rotate it each month

Question 12

A data engineer needs to process streaming clickstream data in real-time, apply transformations, and write the output to BigQuery. Which Google Cloud service is built for this use case?

Accepted Answer

Cloud Dataflow. Dataflow is a managed stream and batch processing service perfect for real-time transformations and writing to BigQuery. Pub/Sub is for ingestion, Dataproc for Spark, and Cloud Functions for simple event-driven code.

Answer

Cloud Dataproc

Answer

Cloud Pub/Sub

Answer

Cloud Functions

Question 13

A data scientist wants to train a custom machine learning model using a large dataset stored in BigQuery. They need a managed service that supports distributed training with GPU accelerators. Which service should they use?

Accepted Answer

Vertex AI Training. Vertex AI provides a unified ML platform with managed training jobs that support distributed training and GPU accelerators.

Answer

Dataflow

Answer

Cloud Functions

Answer

AutoML (within Vertex AI)

Question 14

A company is using Cloud SQL for MySQL and notices that read queries are becoming slow as the application scales. They want to offload read traffic from the primary instance to improve performance. Which Cloud SQL feature should they enable?

Accepted Answer

Read replicas. Cloud SQL read replicas are read-only copies of the primary instance that can serve read traffic, reducing load on the primary and improving query performance.

Answer

Automatic failover replicas

Answer

Connection pooling

Answer

Point-in-time recovery

Question 15

A company wants to protect its web application running on Google Cloud from DDoS attacks and SQL injection. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and WAF capabilities (including SQL injection prevention). Cloud CDN caches content but does not protect against attacks. VPC firewall rules are network-level only. reCAPTCHA protects against bots but not SQL injection.

Answer

reCAPTCHA Enterprise

Answer

Cloud CDN

Answer

VPC firewall rules