Cloud Digital Leader Practice Test 36 — 15 Questions

Question 1

A developer wants to deploy a containerized web application that automatically scales to zero when not in use, and they want to minimize operational overhead. Which compute service should they use?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that runs containers on demand, scales automatically including to zero when there is no traffic, and requires no cluster or infrastructure management. This directly satisfies the requirements of automatic scale-to-zero and minimal operational overhead. It is the only option purpose-built for serverless container execution.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine Flexible Environment

Question 2

An operations team is performing a post-incident review after a production outage. The team lead insists that the review must follow a 'blameless postmortem' approach. What does this mean, and why is it important for organizational learning?

Accepted Answer

A blameless postmortem focuses on systemic root causes and improvement opportunities rather than individual fault — creating psychological safety for honest disclosure and leading to more effective prevention of future incidents. A blameless postmortem in Google Cloud operations (and SRE practice) shifts focus from individual human error to systemic root causes, such as misconfigured alerting thresholds, insufficient canary deployments, or gaps in monitoring coverage. This approach fosters psychological safety, encouraging engineers to report all contributing factors without fear of reprisal, which leads to more effective incident prevention and aligns with Google's Site Reliability Engineering (SRE) principles of learning from failures.

Answer

A blameless postmortem assigns full responsibility to the automated systems involved, not to human engineers, which protects the team from accountability

Answer

A blameless postmortem means the incident is not formally documented to protect employees' privacy and career records

Answer

A blameless postmortem can only be conducted by senior management who have authority to make systemic improvements

Question 3

A company has multiple projects and wants to organize them by environment (dev, test, prod) and by team (engineering, marketing, finance). They also need to apply IAM policies that affect all projects in a given environment. Which TWO steps should they take?

Accepted Answer

Apply IAM policies at the folder level. Using folders to group projects by environment allows inheritance of IAM policies. Labels are used for cost attribution and filtering, not for policy enforcement.

Answer

Create separate billing accounts for each environment

Answer

Use organization policies at the project level

Answer

Use labels to group projects by environment

Question 4

A company uses service accounts to allow their application running on a Compute Engine VM to access Cloud Storage. Which is the most secure way to configure this service account access?

Accepted Answer

Attach the service account to the Compute Engine VM; the application obtains credentials automatically via the metadata server with no key files needed.. Attaching a service account to a Compute Engine VM allows the application to automatically obtain short-lived OAuth 2.0 access tokens from the instance metadata server (http://169.254.169.254). This eliminates the need to download, store, or manage any long-lived service account key files, which are a significant security risk. The metadata server provides credentials that are automatically rotated and scoped to the service account's IAM roles, making this the most secure method for accessing Cloud Storage from a VM.

Answer

Download the service account key JSON file and store it in the application's source code repository.

Answer

Grant all users the Storage Admin role so the application can access Cloud Storage through their credentials.

Answer

Create a shared service account key file accessible to all VMs via a Cloud Storage bucket.

Question 5

A large enterprise has 200+ applications and is developing its cloud migration strategy. A cloud architect argues that not all applications should be migrated the same way. Which migration strategy framework best organizes the different approaches for moving applications to cloud?

Accepted Answer

A portfolio-based migration framework (such as the 6 Rs: Rehost, Replatform, Refactor, Repurchase, Retire, Retain) that applies the right migration strategy to each application based on its business value and cloud-readiness. A portfolio-based migration framework like the 6 Rs (Rehost, Replatform, Refactor, Repurchase, Retire, Retain) provides a structured, risk-aware approach to cloud migration. It recognizes that each application has unique business value, technical debt, and cloud-readiness, so a one-size-fits-all strategy would be inefficient or disruptive. This framework aligns migration tactics with business objectives, enabling the enterprise to optimize cost, performance, and operational continuity across a diverse application portfolio.

Answer

All applications should be completely rewritten as cloud-native microservices for maximum cloud benefit

Answer

Migrate all applications simultaneously during a single weekend cutover to minimize the total migration duration

Answer

Keep all applications on-premises until a complete cloud-native replacement is built for each one

Question 6

A retail bank is building a partnership with a fintech startup. The bank provides regulated financial services infrastructure and customer reach; the fintech provides innovative digital experiences. Which cloud architectural pattern most naturally enables this kind of bank-fintech partnership?

Accepted Answer

An API-first Open Banking architecture where the bank exposes regulated capabilities (accounts, payments, KYC) through managed APIs that the fintech builds innovative experiences on top of. An API-first Open Banking architecture allows the bank to expose regulated capabilities (e.g., account information, payment initiation, KYC verification) through managed, secure APIs. The fintech can then build innovative digital experiences on top of these APIs without direct access to the bank's core systems, ensuring compliance, security, and loose coupling. This pattern aligns with PSD2 and Open Banking standards, enabling partnership without compromising regulatory control.

Answer

Giving the fintech startup direct database access to the bank's customer records system for maximum data sharing

Answer

The bank should acquire the fintech startup and consolidate all technology onto the bank's legacy infrastructure

Answer

The fintech should build all required banking infrastructure independently to avoid dependency on the bank's legacy systems

Question 7

A healthcare company runs its critical application on Google Cloud. The application uses Cloud SQL for patient records, Cloud Storage for medical images, and Pub/Sub for data ingestion. The security team requires that all data at rest be encrypted with a key that is managed and rotated by their on-premises HSM. They also need to ensure that any potential data exfiltration is immediately detected and prevented. Recently, a vulnerability scan revealed that a Cloud SQL instance had a public IP. The team wants to enforce that no Cloud SQL instance can be created with a public IP across the entire organization. Additionally, they need to implement a solution to monitor and alert on any suspicious activity, such as a large download from Cloud Storage. They have a limited budget and cannot afford complex custom solutions. Which combination of Google Cloud services should they use to meet these requirements?

Accepted Answer

Use Cloud External Key Manager (EKM) for encryption, define an Organization Policy constraint to prohibit public IPs on Cloud SQL, deploy Security Command Center with Event Threat Detection to monitor for data exfiltration, and implement VPC Service Controls to limit data access.. Cloud External Key Manager (EKM) allows you to use an external key management system (on-premises HSM) for encrypting data at rest in Google Cloud services like Cloud SQL, Cloud Storage, and Pub/Sub. The Organization Policy constraint `constraints/sql.restrictPublicIp` can enforce that no Cloud SQL instance is created with a public IP. Security Command Center with Event Threat Detection provides out-of-the-box monitoring and alerting for suspicious activities like large downloads from Cloud Storage, while VPC Service Controls adds a data exfiltration prevention layer by restricting data movement outside a defined service perimeter.

Answer

Use CMEK with Cloud KMS for encryption, set an Organization Policy to restrict public IPs on Cloud SQL, and configure Cloud Audit Logs with alerting via Cloud Monitoring to detect data exfiltration.

Answer

Use default encryption with Google-managed keys, set an IAM condition to deny public IP on Cloud SQL, and configure Cloud Data Loss Prevention to detect sensitive data exfiltration.

Answer

Use Cloud HSM for encryption, create a VPC firewall rule to block all incoming traffic to Cloud SQL, and use Cloud Armor to protect against data exfiltration.

Question 8

Match each Google Cloud data service to its primary function.

Accepted Answer

Cloud SQL: Managed relational database for MySQL, PostgreSQL, and SQL Server.. Cloud SQL is for traditional relational databases, Cloud Spanner for globally distributed ones, BigQuery for analytics, and Firestore for NoSQL document storage.

Answer

Cloud SQL: Globally distributed relational database with strong consistency.

Answer

BigQuery: NoSQL document database for mobile and web apps.

Question 9

A security team needs to implement a zero-trust architecture for a web application that is accessed by both internal employees and external partners. They require context-aware access that checks device posture and identity. Which THREE components should they use? (Choose three.)

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise provides the zero-trust framework, including device and identity verification. Identity-Aware Proxy (IAP) is a key component that enforces access based on context. Access levels in IAP define conditions (e.g., device posture, IP range) that must be met for access. Cloud Armor is for DDoS/WAF, not context-aware access. VPC firewall rules are network-level, not user-level. Chronicle is a SIEM.

Answer

VPC firewall rules

Answer

Cloud Armor

Question 10

Match each Google Cloud service to its primary use case.

Accepted Answer

Compute Engine: Virtual machines (IaaS). Compute Engine provides IaaS virtual machines, Cloud Storage offers object storage for unstructured data, and BigQuery is a data warehouse for analytics. Common confusions occur when mixing these services.

Answer

Compute Engine: Object storage for any data

Answer

Cloud Storage: Virtual machines (IaaS)

Answer

BigQuery: Serverless event-driven functions

Question 11

A company's compliance team asks what evidence they can provide to regulators to demonstrate that Google Cloud services meet industry security standards. Which type of documentation most directly provides this evidence?

Accepted Answer

Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager, which provide independent verification of security controls. Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager provide independent verification of security controls. These are the most direct evidence for regulators because they are produced by independent auditors and attest to the effectiveness of controls.

Answer

Google Cloud's marketing materials and product documentation describing security features

Answer

The company's own internal security policies that reference using Google Cloud

Answer

A Google Cloud support ticket confirming that the company's account is in good standing

Question 12

A security administrator needs to grant a developer the minimum permissions to create and delete Cloud Storage buckets in a specific project, but NOT allow them to modify the contents of those buckets (e.g., upload or delete objects). Which IAM role should they assign?

Accepted Answer

Custom role with storage.buckets.* permissions. Storage Admin (roles/storage.admin) grants full control over buckets and objects, which is too permissive. The correct approach is to create a custom role with only storage.buckets.* permissions, or use predefined roles like Storage Object Admin? Actually, Storage Object Admin allows object management. The question requires bucket management only. A custom role with storage.buckets.create and storage.buckets.delete (and maybe storage.buckets.get) is necessary; predefined roles do not separate bucket and object permissions perfectly. But among standard roles, 'Storage Admin' is too broad; there is no predefined role that only allows bucket management without object access. So the answer must be a custom role.

Answer

Storage Admin (roles/storage.admin)

Answer

Storage Object Admin (roles/storage.objectAdmin)

Answer

Project Editor (roles/editor)

Question 13

A company uses multiple public clouds (AWS, Azure, Google Cloud) for different workloads. They want to centralize monitoring and logging. Which Google Cloud service can aggregate logs from all clouds?

Accepted Answer

Cloud Logging. Cloud Logging (formerly Stackdriver Logging) is Google Cloud's centralized log ingestion, storage, and analysis service, and it can ingest logs from AWS, Azure, and other sources via the BindPlane/Cloud Logging agent or the Logging API. It provides a single pane for querying and routing logs across clouds, making it the correct choice for aggregating multi-cloud logs. Cloud Monitoring handles metrics and dashboards, not log aggregation.

Answer

Cloud Audit Logs

Answer

Cloud Console

Answer

Cloud Monitoring

Question 14

A cloud team receives an alert that a critical production service's error rate has spiked. Following incident response best practices, what is the correct first priority action?

Accepted Answer

Mitigate user impact immediately (e.g., rollback, traffic rerouting, scaling) while beginning parallel investigation of the root cause. Incident response best practices prioritize reducing user impact first. In Google Cloud, this could involve rolling back a deployment via Cloud Deploy, rerouting traffic with a load balancer, or scaling up instances with Managed Instance Groups, all while a parallel investigation into the root cause begins. This aligns with the SRE principle of 'error budget' and the 'mitigate before diagnose' approach.

Answer

Identify and fix the root cause before taking any other action to ensure the fix is complete

Answer

Wait to understand the full scope of the issue and inform all stakeholders before taking any technical action

Answer

Escalate to senior leadership and wait for their approval before making any production changes

Question 15

An architect explains that her cloud application uses a 'loosely coupled architecture.' She contrasts it with a tightly coupled on-premises system where all components run in a single process. What is the primary operational benefit of loose coupling in a cloud environment?

Accepted Answer

Loose coupling allows individual components to fail, scale, or be updated independently without cascading failures to the entire system. In a loosely coupled architecture, components communicate via well-defined interfaces (e.g., REST APIs, message queues) and are deployed as independent services. This means a failure in one component does not propagate to others, and each component can be scaled or updated without affecting the rest of the system. This isolation is the primary operational benefit in a cloud environment, enabling high availability and continuous delivery.

Answer

Loosely coupled applications are always faster because messages are passed in memory rather than over the network

Answer

Loosely coupled architectures require less developer expertise and are easier to build than monolithic applications

Answer

Loose coupling reduces cloud costs because fewer network calls are made between services