Cloud Digital Leader Practice Test 39 — 15 Questions

Question 1

A large enterprise wants to enforce the principle of least privilege for its cloud resources. The security team needs to audit all IAM policy changes across the organization and ensure that custom roles are used where predefined roles are too permissive. Which three Google Cloud services or features should be combined to achieve this? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IAM Recommender. Cloud Audit Logs track IAM policy changes. Organization policies can enforce constraints like restricting the use of predefined roles. IAM Recommender provides recommendations to reduce permissions. Cloud Asset Inventory can also be used for IAM policy auditing. Security Command Center is for threat detection, not IAM auditing. Policy Analyzer helps understand access, but the combination of Audit Logs, Organization Policies, and IAM Recommender is most direct.

Answer

Cloud Key Management Service

Answer

Security Command Center

Question 2

Which layer of Google's defence-in-depth security model includes the use of TLS for data in transit?

Accepted Answer

Data security. Data security covers encryption of data at rest and in transit. Physical security is about data centers. Operational security covers processes. Deployment security is about secure infrastructure deployment.

Answer

Operational security

Answer

Deployment security

Answer

Physical security

Question 3

A company stores sensitive data in Cloud Storage. They want to restrict access to only users from the company's corporate network (IP range 203.0.113.0/24) and ensure data is encrypted at rest using a customer-managed key. Which TWO configurations are required? (Select 2)

Accepted Answer

Set a bucket policy with an IP address condition. Cloud Storage bucket-level access control with IP-based conditions can restrict access to a specific IP range. CMEK requires Cloud KMS to create and manage the key. Cloud Armor is for HTTP(S) load balancing, not Cloud Storage. VPC Service Controls provide perimeter security but are not IP-based. Cloud NAT is for outbound connectivity.

Answer

Configure Cloud Armor with IP allowlist

Answer

Enable VPC Service Controls

Answer

Configure Cloud NAT

Question 4

A company wants to reduce costs for their long-running Compute Engine instances by committing to a 1-year term. Which type of discount should they use?

Accepted Answer

Committed use discount. Committed use discounts offer reduced prices in exchange for a 1 or 3 year commitment.

Answer

Sole-tenant node discount

Answer

Preemptible VM discount

Answer

Sustained use discount

Question 5

Which Google Cloud resource serves as the root node in the resource hierarchy and is linked to a Google Workspace or Cloud Identity account?

Accepted Answer

Organization node. The organization node is the top-level resource in the hierarchy, linked to the domain of the Google Workspace or Cloud Identity account.

Answer

Billing account

Answer

Folder

Answer

Project

Question 6

A company runs a stateful web application on Compute Engine. They need to ensure that persistent data is retained if an instance fails, and that traffic is automatically distributed across healthy instances. Which TWO Google Cloud services should they use? (Choose 2)

Accepted Answer

Persistent Disk. Persistent Disk provides durable block storage that can be attached to Compute Engine instances, retaining data even if the instance terminates. Cloud Load Balancing distributes traffic across a managed instance group and automatically routes traffic away from failed instances. Cloud DNS resolves domain names but does not provide load balancing. Cloud CDN caches content. Cloud NAT is for outbound connectivity.

Answer

Cloud DNS

Answer

Cloud CDN

Answer

Cloud NAT

Question 7

Which statement best describes the shared responsibility model in Google Cloud?

Accepted Answer

Google is responsible for security of the infrastructure; customers are responsible for their data and configurations.. Google is responsible for the security of the cloud infrastructure, while customers are responsible for security within the cloud, including data, access, and configurations.

Answer

Google is responsible for all security aspects, including customer data.

Answer

Customers are responsible for physical security of data centers.

Answer

Security is entirely the customer's responsibility in IaaS.

Question 8

According to the shared responsibility model, which of the following is the customer responsible for?

Accepted Answer

Data encryption and access control (IAM). Customers are responsible for securing their data, applications, and identity (IAM). Google is responsible for physical infrastructure, networks, and hypervisor security.

Answer

Physical security of data centers

Answer

Network infrastructure security

Answer

Hypervisor security

Question 9

Which THREE of the following are best practices for managing operations in Google Cloud? (Choose THREE.)

Accepted Answer

Set up budget alerts to monitor costs. Setting up budget alerts in Google Cloud allows you to monitor costs proactively by triggering notifications when spending exceeds defined thresholds. This is a fundamental operational best practice to avoid unexpected bills and maintain financial control over your cloud resources.

Answer

Use Cloud Logging to store all logs indefinitely to ensure compliance

Answer

Use a single project for all workloads to simplify management

Question 10

An organization has a folder-level IAM policy that grants the 'roles/compute.instanceAdmin' role to a group. A project under that folder has a policy that denies this role to the same group. What is the effective access for the group on Compute Engine instances in the project?

Accepted Answer

The group has no access because the deny overrides the allow. Deny policies override allow policies. Even though the group has an allowed role at the folder level, the explicit deny at the project level takes precedence, so the group will not have the role's permissions on instances in that project.

Answer

The group has full admin access because the folder policy allows it

Answer

The group has view access only

Answer

The group retains permissions but cannot modify instances

Question 11

A healthcare organization must store patient health records (PHI) in the cloud and comply with HIPAA. They need to ensure data is encrypted at rest by default, maintain access logs, and restrict access to authorized personnel. Which THREE Google Cloud features or services should they use?

Accepted Answer

Cloud Audit Logs. HIPAA requires encryption at rest (Cloud KMS provides managed keys), audit logs (Cloud Audit Logs), and access control (IAM). Cloud NAT provides outbound internet access, VPC Flow Logs capture network metadata, not access logs.

Answer

VPC Flow Logs

Answer

Cloud NAT

Question 12

A company wants to store encryption keys for encrypting data at rest in Cloud Storage, and also needs to automatically rotate the keys every 30 days. Additionally, they require an audit log of key usage. Which TWO services should they use? (Choose two.)

Accepted Answer

Cloud KMS. Cloud KMS allows creating and managing keys with automatic rotation (via rotation period). Cloud Audit Logs can be configured to log every use of the key (Data Access audit logs). Secret Manager is for secrets, not encryption keys. Cloud HSM provides hardware-backed keys but is part of Cloud KMS. Cloud Storage itself does not manage key rotation.

Answer

Cloud HSM

Answer

Secret Manager

Answer

Cloud Storage

Question 13

A company wants to implement a serverless event-driven architecture where object uploads to Cloud Storage trigger a function that processes the file and stores results in Firestore. The function needs to be written in Python. Which three Google Cloud services are required?

Accepted Answer

Cloud Functions. The architecture uses Cloud Storage (trigger), Cloud Functions (compute), and Firestore (database). Cloud Build is for CI/CD, not runtime. Pub/Sub could be used but is not required if the function is triggered directly from Cloud Storage.

Answer

Pub/Sub

Answer

Cloud Build

Question 14

A developer wants to build a mobile app backend that uses a real-time database for chat messages, user profiles, and file storage for images. They want a fully managed, serverless solution. Which THREE Google Cloud services should they use? (Choose three.)

Accepted Answer

Cloud Functions. Firestore provides real-time document database for chat and profiles; Cloud Storage for images; Cloud Functions for backend logic triggered by database or storage events. App Engine is not required for serverless backend if using Cloud Functions.

Answer

Cloud SQL

Answer

App Engine

Question 15

A company is planning their resource hierarchy in Google Cloud. They need to separate environments (prod, non-prod) and teams (engineering, data science). They also need to apply common policies to all prod projects. Which TWO resources should they use?

Accepted Answer

Folders. Folders allow hierarchical grouping of projects. Organization policies can be applied at the folder level to enforce common policies. Projects are the unit of resource management. Labels are for metadata, not hierarchy. Billing accounts are separate from hierarchy.

Answer

Billing accounts

Answer

Labels

Answer

Projects