Cloud Digital Leader Practice Test 37 — 15 Questions

Question 1

A small startup wants to protect its web application from common attacks like SQL injection and cross-site scripting (XSS). They also need DDoS protection. Which Google Cloud security service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Armor. Cloud Armor provides web application firewall (WAF) rules to block SQL injection and XSS, plus DDoS protection.

Answer

Security Command Center

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 2

An engineer needs to organize resources for multiple departments and enforce organization-wide policies such as restricting VM external IP addresses. Which GCP resource hierarchy level should the policy be applied at to ensure all projects inherit it?

Accepted Answer

Organization node. Organization policies applied at the organization node are inherited by all folders and projects under it.

Answer

Resource

Answer

Folder

Answer

Project

Question 3

Which Google Cloud service helps identify and classify sensitive data such as credit card numbers or personal health information in Cloud Storage and BigQuery?

Accepted Answer

Data Loss Prevention (DLP) API. Sensitive Data Protection (DLP API) scans content to discover and classify sensitive data.

Answer

Security Command Center

Answer

Cloud Data Catalog

Answer

Access Transparency

Question 4

Which TWO of the following are NIST-defined characteristics of cloud computing?

Accepted Answer

Resource pooling. The NIST definition includes: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Virtualization is an enabling technology but not a characteristic. High availability is a benefit but not a NIST characteristic.

Answer

High availability

Answer

Pay-as-you-go pricing

Answer

Virtualization

Question 5

A company wants to enforce the principle of least privilege by granting a service account only the permissions necessary to publish messages to a specific Pub/Sub topic. Which IAM approach should they use?

Accepted Answer

Grant the roles/pubsub.publisher role to the service account at the topic level. IAM allows granting roles at specific resource levels. To grant only publish permission on a specific topic, you should add the service account as a member and assign the Pub/Sub Publisher role (roles/pubsub.publisher) directly on that topic. Granting the role at the project level would give too broad access. Using a custom role with only the required permission is also correct but more complex; however, the simplest correct approach among the options is to assign a predefined role at the topic level.

Answer

Grant the roles/editor role to the service account at the project level

Answer

Grant the roles/pubsub.subscriber role to the service account at the topic level

Answer

Grant the roles/pubsub.publisher role to the service account at the project level

Question 6

An organization needs to ensure that data stored in Cloud Storage is encrypted using keys that they manage and rotate themselves. Which encryption option should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). CMEK allows customers to manage their own keys via Cloud KMS. CSEK requires customer-supplied keys but has operational overhead. Google-managed keys are default but not customer-managed.

Answer

Default encryption at rest

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption keys

Question 7

A developer wants to label resources with key-value pairs to track cost by team. Which GCP feature should they use?

Accepted Answer

Labels. Labels are key-value metadata that can be applied to resources for cost tracking and filtering.

Answer

Tags

Answer

Folders

Answer

Organization policy tags

Question 8

A developer needs to estimate the monthly cost of running a set of Compute Engine instances with specific machine types, persistent disks, and network egress before deploying. Which tool should they use?

Accepted Answer

Google Cloud Pricing Calculator. The Google Cloud Pricing Calculator allows users to estimate costs for various services based on their configuration, before deployment.

Answer

Billing export to BigQuery

Answer

Active Assist Recommendations

Answer

Cost Management dashboard

Question 9

A company wants to use machine learning to analyze customer reviews without building and training models from scratch. They need a pre-trained model that can classify sentiment. Which Google Cloud service should they use?

Accepted Answer

Cloud Natural Language API. Cloud Natural Language API provides pre-trained models for sentiment analysis, entity recognition, etc. AutoML Natural Language requires custom training. Vertex AI is a platform for building custom models. Dialogflow is for conversational interfaces.

Answer

Vertex AI

Answer

AutoML Natural Language

Answer

Dialogflow

Question 10

A company wants to analyze their GCP spending trends by service and project over the past year. They need to export detailed billing data to a BigQuery dataset for custom queries. Which feature should they use?

Accepted Answer

Billing export to BigQuery. Billing export to BigQuery sends detailed usage and cost data to a BigQuery dataset for analysis.

Answer

Cloud Pricing Calculator

Answer

Active Assist rightsizing recommendations

Answer

Cloud Billing budget alerts

Question 11

An organization wants to tag resources with key-value metadata for cost allocation purposes (e.g., team: marketing, environment: prod). Which feature should be used?

Accepted Answer

Labels. Labels are key-value pairs that can be applied to resources for billing, filtering, and cost attribution. They are visible in billing reports and the cost management dashboard.

Answer

Organization policy constraints

Answer

IAM custom roles

Answer

Tags (network tags)

Question 12

A company has a fixed budget for GCP and wants to prevent any cost overrun by automatically disabling all resources when the monthly budget is exceeded. Which approach should they use?

Accepted Answer

Create a Cloud Function triggered by a budget alert Pub/Sub message to stop resources.. GCP does not have a built-in mechanism to automatically disable resources when a budget is exceeded. Budget alerts trigger notifications but do not take action. The best practice is to monitor alerts and manually take action, or use Cloud Functions to automate shutdown based on budget alerts.

Answer

Use the Cost Management dashboard to manually stop resources.

Answer

Use Active Assist to automatically stop idle resources.

Answer

Set up a budget alert with the 'disable resource' action.

Question 13

A multinational corporation wants to serve content to users worldwide with low latency. They plan to use Google Cloud's content delivery network and points of presence. Which cloud benefit enables this?

Accepted Answer

Global reach. Global reach, enabled by Google's extensive network and CDN, provides low-latency content delivery worldwide. Scalability is about capacity, cost optimisation is about pricing, and agility is about speed of deployment.

Answer

Cost optimisation

Answer

Scalability

Answer

Agility

Question 14

What is a key business benefit of moving from a capital expenditure (CapEx) model for IT infrastructure to an operational expenditure (OpEx) model like pay-as-you-go cloud computing?

Accepted Answer

Improved cash flow by avoiding large upfront hardware purchases. Pay-as-you-go eliminates large upfront hardware costs, converting them to variable costs based on usage, which improves cash flow and agility.

Answer

Elimination of all IT staff

Answer

Reduced need for software licenses

Answer

Guaranteed performance improvement

Question 15

Which of the following is a characteristic of the cloud according to the NIST definition?

Accepted Answer

Measured service. Measured service is one of the five essential characteristics of cloud computing as defined by NIST.

Answer

Manual scaling

Answer

Limited network access

Answer

Single tenancy