Cloud Digital Leader Practice Test 37 — 15 Questions

Question 1

A company uses two different public cloud providers (AWS for their North American operations and Google Cloud for their European operations) to meet data residency requirements and avoid vendor lock-in. Which deployment model does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multi-cloud. This scenario describes using two distinct public cloud providers (AWS and Google Cloud) to meet data residency and avoid vendor lock-in, which is the definition of a multi-cloud deployment model. Multi-cloud involves using multiple public cloud services from different vendors, as opposed to combining public and private infrastructure (hybrid cloud) or simply deploying across multiple regions within a single provider.

Answer

Hybrid cloud

Answer

Multi-region

Answer

Distributed cloud

Question 2

Which term describes the model where the cloud provider is responsible for the security of the cloud infrastructure, while the customer is responsible for security within their own cloud environment (data, applications, access management)?

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security responsibilities between the cloud provider and the customer. Google secures the physical infrastructure, hardware, hypervisor, and core services. The customer secures what they put in the cloud: data classification, access control, application security, network configuration, and compliance. The boundary between provider and customer responsibility varies by service model (IaaS vs. PaaS vs. SaaS).

Answer

Zero trust security model

Answer

Defense in depth strategy

Answer

Identity federation model

Question 3

A company wants to run a batch job that processes large files (up to 100 TB each) using a custom Linux executable. The job runs once a month and takes about 12 hours. They want to minimise cost. Which compute option should they choose?

Accepted Answer

Compute Engine with preemptible VMs. For a monthly batch job processing large files (up to 100 TB) with a custom Linux executable, preemptible VMs on Compute Engine offer the lowest cost. Preemptible VMs are significantly cheaper than standard VMs and are suitable for batch jobs that can tolerate interruptions, as the job can be restarted if preempted. Since the job runs once a month for about 12 hours, the cost savings outweigh the risk of preemption.

Answer

Compute Engine with standard VMs

Answer

Cloud Run

Answer

App Engine Flexible Environment

Question 4

A finance team needs to analyze detailed cost data across multiple projects, including resource-level breakdowns, labels, and cost attribution. They want to export this data to a BigQuery dataset for custom analysis. Which billing export option should they enable?

Accepted Answer

Enable billing export to BigQuery (standard usage cost data). Enabling billing export to BigQuery (standard usage cost data) provides detailed, resource-level cost information including labels, projects, and SKUs, which can be queried directly in BigQuery for custom analysis. This is the only option that natively exports granular cost data to BigQuery without additional pipeline development. It supports cost attribution and detailed breakdowns required by the finance team.

Answer

Use the Cloud Billing API to pull cost data programmatically

Answer

Set up a budget alert with notifications to Pub/Sub and ingest into BigQuery

Answer

Enable billing export to Cloud Storage in CSV format

Question 5

A financial services firm must comply with PCI DSS and wants to run workloads on Google Cloud. They need to isolate their production environment from development and enforce granular access controls. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls and IAM. VPC Service Controls and IAM together provide the required isolation and granular access control for PCI DSS compliance. VPC Service Controls create a service perimeter that prevents data exfiltration from Google Cloud services, while IAM policies enforce least-privilege access at the resource level. This combination isolates production from development and restricts who can access what, directly addressing PCI DSS segmentation and access control requirements.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Cloud VPN

Question 6

A security engineer wants to block malicious traffic patterns at the edge of Google's network before it reaches their application. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's edge security service that provides WAF capabilities and DDoS protection, allowing you to block malicious traffic patterns before they reach your application. It integrates with global load balancing to filter requests at the edge of Google's network. This directly addresses the requirement to block malicious traffic at the edge.

Answer

VPC firewall rules

Answer

Cloud DNS

Answer

Cloud CDN

Question 7

An organization needs to store confidential healthcare data in Google Cloud. Which compliance certification ensures that Google Cloud infrastructure meets the required security controls for protected health information (PHI)?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the U.S. regulation that governs the protection of protected health information (PHI). Google Cloud offers a HIPAA Business Associate Agreement (BAA) and compliance certification for its infrastructure, ensuring the required security controls for storing PHI are met. This is the specific compliance framework for healthcare data.

Answer

ISO 27001

Answer

SOC 2

Answer

PCI DSS

Question 8

A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS. Customer-managed encryption keys (CMEK) with Cloud KMS allow the customer to create and manage their own keys in Cloud KMS, and use them to encrypt data in Cloud Storage. The customer can rotate the key monthly via Cloud KMS key rotation schedules. This meets the requirement of self-managed keys with monthly rotation.

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 9

A data engineering team wants to process continuous streams of real-time events from millions of devices, perform transformations, and load the results into BigQuery for analysis. They need a fully managed, serverless solution. Which service should they use?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is a fully managed, serverless service for both batch and stream processing, built on Apache Beam. It can ingest continuous streams from Pub/Sub, apply transformations, and write results to BigQuery with automatic scaling and no infrastructure management. This matches the requirement for a serverless solution to process real-time events from millions of devices and load them into BigQuery.

Answer

Dataproc

Answer

Cloud Pub/Sub

Answer

Cloud Functions

Question 10

A company has a support plan that guarantees a 15-minute response time for P1 cases and includes a Technical Account Manager (TAM). Which support plan do they have?

Accepted Answer

Premium Support. Premium Support is the only Google Cloud support plan that guarantees a 15-minute response time for P1 cases and includes a named Technical Account Manager (TAM). Enhanced Support offers a 1-hour P1 response and no TAM, while Standard and Basic offer progressively slower responses. The combination of 15-minute P1 SLA and TAM uniquely identifies Premium.

Answer

Standard Support

Answer

Enhanced Support

Answer

Basic Support

Question 11

A user attempts to create a new Compute Engine instance in the us-central1 region and receives an error indicating that the quota for 'CPUs' has been exceeded. Where should the user go to request a quota increase?

Accepted Answer

Cloud Console > IAM & Admin > Quotas. Quota increases in Google Cloud are requested through the Cloud Console under IAM & Admin > Quotas, where you can filter by service (Compute Engine), locate the specific quota (CPUs in us-central1), and submit an increase request. This is the standard, supported workflow for adjusting project quotas. The request is then reviewed and typically approved automatically or by Google support depending on the size.

Answer

Cloud Console > Billing > Budgets

Answer

Google Cloud Pricing Calculator

Answer

Cloud Console > Support > Cases

Question 12

A team needs to run a machine learning model using custom code in Python with TensorFlow, and they want to train it at scale on GPU hardware without managing infrastructure. Which Google Cloud service is best suited?

Accepted Answer

Vertex AI. Vertex AI is Google Cloud's unified ML platform that supports custom Python code with frameworks like TensorFlow and provides managed training on GPU hardware without infrastructure management. It offers Vertex AI Training with pre-built containers or custom containers, auto-scaling, and integration with GPUs/TPUs. This directly matches the requirement to train at scale on GPUs with custom code.

Answer

Cloud Run

Answer

Compute Engine

Answer

Cloud Functions

Question 13

A company uses a legacy on-premises database and wants to migrate to Google Cloud with minimal changes to application code. They need a fully managed relational database that supports MySQL compatibility and automatic failover. Which service should they choose?

Accepted Answer

Cloud SQL for MySQL. Cloud SQL for MySQL is a fully managed relational database service that is wire-compatible with MySQL, so existing applications using MySQL drivers and SQL syntax require minimal code changes. It supports automatic failover via a regional HA configuration with a standby instance. This matches the requirement for MySQL compatibility, managed operations, and automatic failover.

Answer

Firestore

Answer

Cloud Spanner

Answer

Cloud Bigtable

Question 14

A retail bank wants to launch new digital banking features quickly to compete with fintech startups while maintaining strict regulatory compliance. Which cloud transformation strategy best addresses both agility and compliance?

Accepted Answer

Implement a cloud-native architecture using GKE, Cloud Build, and Cloud IAM with compliance auditing. It leverages cloud-native services like Google Kubernetes Engine (GKE) for containerized microservices, Cloud Build for CI/CD automation, and Cloud IAM for fine-grained access control, enabling rapid feature deployment while maintaining compliance through integrated audit logging and policy enforcement. This architecture decouples agility from security, allowing the bank to iterate quickly without sacrificing regulatory requirements like PCI-DSS or SOX.

Answer

Move everything to a public cloud without additional access controls to maximize speed

Answer

Use a lift-and-shift migration to cloud VMs and rely on manual change management

Answer

Stick with on-premise systems for compliance and use cloud only for non-sensitive data

Question 15

A DevOps engineer wants to audit all actions performed by Google personnel on their customer data stored in Cloud Storage. They need to review logs that show access by Google employees and the reason for access. Which logging feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides logs specifically showing when Google personnel access customer data, including the reason and justification for access. It is designed for auditing Google employee actions on customer data, which is exactly the requirement.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

VPC Flow Logs