Cloud Digital Leader Practice Test 36 — 15 Questions

Question 1

A company is migrating its on-premises applications to Google Cloud. The security team requires that all data be encrypted both in transit and at rest. Which approach meets these requirements with minimal operational overhead?

Accepted Answer

Use HTTPS for all traffic and enable default encryption at rest with Google-managed keys.. Option A is correct because HTTPS provides encryption in transit using TLS, and default encryption at rest with Google-managed keys encrypts data stored in Google Cloud services like Cloud Storage and Compute Engine disks without requiring any manual key management. This approach meets the security requirements with minimal operational overhead since Google handles key rotation and lifecycle management automatically.

Answer

Implement a third-party encryption tool for both transit and at rest.

Answer

Set up a VPN between on-premises and Google Cloud and rely on that for encryption.

Answer

Restrict physical access to Google Cloud data centers.

Question 2

A startup wants to automatically rotate encryption keys used for Cloud Storage objects every 90 days. Which service should they use?

Accepted Answer

Use Cloud Key Management Service (KMS) with automatic rotation schedule. Option D is correct because Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 90 days). When you create a key ring and key in Cloud KMS, you can set a rotation schedule, and Cloud KMS will automatically generate a new key version on the specified date. This allows the startup to meet the 90-day rotation requirement without manual intervention, and the new key version is used for encrypting new Cloud Storage objects while old versions remain available for decrypting existing data.

Answer

Use Cloud Secret Manager to store and rotate encryption keys

Answer

Use default Cloud Storage encryption (SSE-GCP)

Answer

Use Cloud HSM to store keys and rotate manually

Question 3

A company uses Cloud Load Balancing to distribute traffic to Compute Engine VMs. They want to protect against SQL injection and cross-site scripting attacks. Which service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP/S traffic for malicious patterns, including SQL injection and cross-site scripting (XSS) signatures. It integrates directly with Cloud Load Balancing to filter requests before they reach backend Compute Engine VMs, using pre-configured rules from the ModSecurity Core Rule Set (CRS) to block these common OWASP Top 10 threats.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls

Question 4

Which TWO features are part of Cloud Data Loss Prevention (Cloud DLP)?

Accepted Answer

Classification of sensitive data such as credit card numbers. Cloud DLP is specifically designed to inspect, classify, and protect sensitive data. Option A is correct because Cloud DLP uses over 150 built-in infoType detectors to automatically identify sensitive data types, such as credit card numbers (matching Luhn algorithm and PAN format), Social Security numbers, and passport numbers, enabling organizations to understand where their sensitive data resides.

Answer

Network vulnerability scanning

Answer

Removal of malware from uploaded files

Answer

Creation of IAM policies

Question 5

A financial services company is designing a multi-cloud architecture with Google Cloud and AWS. They need to encrypt data at rest in Google Cloud using a key stored in their on-premises Hardware Security Module (HSM). What is the best approach?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM). Cloud External Key Manager (Cloud EKM) is the correct approach because it allows you to manage encryption keys in an external key management system, such as an on-premises HSM, while using those keys to encrypt data at rest in Google Cloud. This meets the requirement of storing the key in the on-premises HSM, as Cloud EKM integrates with supported external key management partners or directly with your HSM via a key management proxy, ensuring that Google Cloud never has direct access to the raw key material.

Answer

Use default encryption

Answer

Use Cloud HSM

Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK

Question 6

A company's security team wants to detect and remediate public exposure of Cloud SQL instances. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the correct service because it provides centralized visibility and monitoring of Google Cloud resources, including the ability to detect and alert on public exposure of Cloud SQL instances. SCC's built-in vulnerability and threat detection findings, such as 'Public SQL instance,' directly identify misconfigured Cloud SQL instances that are accessible from the internet, enabling the security team to remediate the exposure.

Answer

Cloud Armor

Answer

Cloud Data Loss Prevention (DLP)

Answer

VPC Service Controls

Question 7

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Answer

Access Transparency

Answer

Security Command Center

Answer

Cloud Armor

Question 8

A security engineer notices that a Compute Engine instance is running a VM with a public IP that should not be accessible from the internet. They want to ensure this configuration is prevented by default for all future projects in the organization. What should they do?

Accepted Answer

Define an Organization Policy with the constraint compute.vmExternalIpAccess. Option B is correct because Organization Policies in Google Cloud allow you to set constraints at the organization, folder, or project level to enforce security controls. The `compute.vmExternalIpAccess` constraint specifically prevents VMs from being created with external IP addresses, ensuring that no future Compute Engine instances in the organization can have public IPs by default. This is a preventive control that applies to all new VM creations, unlike IAM policies or firewall rules which are more granular or reactive.

Answer

Set an IAM policy to deny compute.instances.create with public IP

Answer

Create a VPC firewall rule to deny all traffic from the internet to the VM

Answer

Use Cloud Security Scanner to identify and remediate

Question 9

Which THREE practices are recommended for securing a Kubernetes cluster in Google Kubernetes Engine (GKE)?

Accepted Answer

Use Binary Authorization to ensure only trusted container images are deployed. Binary Authorization is correct because it enforces deployment-time policy validation, ensuring that only container images signed by trusted authorities (e.g., via KMS) are allowed to run in GKE. This prevents the deployment of untrusted or tampered images, directly addressing supply chain security.

Answer

Enable node auto-repair to automatically fix security vulnerabilities in nodes

Answer

Expose the cluster control plane via a public endpoint to allow monitoring

Question 10

A global e-commerce company serves customers from multiple continents. They want to guarantee fast page load times and minimize latency. Which Google Cloud service is most suitable for this transformation?

Accepted Answer

Cloud CDN with global external HTTP(S) load balancing. Cloud CDN with global external HTTP(S) load balancing is the most suitable solution because it caches static and dynamic content at edge locations worldwide, reducing latency for users across multiple continents. The global load balancer provides anycast IP addresses that route traffic to the nearest healthy backend, while Cloud CDN serves cached content directly from the edge, minimizing round-trip time and improving page load times.

Answer

Cloud SQL for data caching

Answer

Cloud Storage multi-regional buckets

Answer

Compute Engine with large VMs

Question 11

A media company needs to transcode and store thousands of video files daily, with variable demand. They want to minimize costs while ensuring fast processing. How does cloud transformation help?

Accepted Answer

Using Cloud Transcoder API and Cloud Storage with lifecycle policies. Option A is correct because Cloud Transcoder API provides a serverless, scalable transcoding service that automatically handles variable demand, while Cloud Storage with lifecycle policies (e.g., moving files to Nearline or Archive after 30 days) minimizes storage costs. This combination ensures fast processing without provisioning fixed infrastructure, directly addressing the need for cost efficiency and speed under fluctuating workloads.

Answer

Deploying dedicated physical servers in a colocation facility

Answer

Using batch scripts on a fixed number of on-premise servers

Answer

Using Cloud Functions to process each video

Question 12

Which TWO of the following are key benefits of cloud technology that are transforming business operations?

Accepted Answer

Elasticity to automatically scale resources up and down. Option B is correct because cloud elasticity allows resources to automatically scale up or down based on demand, eliminating over-provisioning and underutilization. This dynamic adjustment is a key transformation driver, enabling businesses to handle variable workloads efficiently without manual intervention.

Answer

Physical security of data centers

Answer

Data locality to keep data within national borders

Answer

Ability to purchase reserved instances for predictable workloads

Question 13

Which TWO of the following cloud characteristics directly enable a business to innovate faster than using traditional IT?

Accepted Answer

Global infrastructure that allows launching in new regions quickly. Option A is correct because a global infrastructure with multiple regions and edge locations allows businesses to deploy applications and services in new geographic areas rapidly, reducing time-to-market compared to building or leasing physical data centers. Option E is correct because self-service provisioning enables developers to spin up resources like virtual machines, databases, or containers in minutes via APIs or console, eliminating the weeks-long procurement and setup cycles of traditional IT, thus accelerating experimentation and iteration.

Answer

Vendor lock-in for long-term contracts

Answer

Capital expenditure model for budgeting

Answer

Customizable hardware configurations for optimal performance

Question 14

A company migrating to the cloud wants to focus on building applications rather than managing servers. Which Google Cloud compute service provides a fully managed platform for web applications that automatically scales?

Accepted Answer

App Engine. App Engine is a fully managed, serverless platform that automatically scales web applications based on traffic. It abstracts away server management, allowing developers to focus solely on writing code, which aligns directly with the requirement to build applications without managing infrastructure.

Answer

Cloud Functions

Answer

Google Kubernetes Engine

Answer

Compute Engine

Question 15

An organization wants to ensure business continuity by failing over to a secondary region in case of disaster. Which cloud characteristic enables this capability?

Accepted Answer

Global infrastructure. Global infrastructure refers to the distributed network of data centers across multiple geographic regions. By deploying resources in a secondary region, an organization can fail over to that region during a disaster, ensuring business continuity. This capability is unique to the cloud's global footprint, not to other characteristics like scalability or measured service.

Answer

Scalability

Answer

Measured service

Answer

Resource pooling