Cloud Digital Leader Practice Test 39 — 15 Questions

Question 1

An engineer needs to analyze detailed cost data, including resource-level usage costs and labels, to create custom reports. Which approach should they use?

Accepted Answer

Set up billing export to BigQuery. Setting up billing export to BigQuery provides detailed cost data, including resource-level usage costs and labels, enabling custom analysis and reporting. BigQuery allows you to query and join billing data with other datasets, and it includes labels for cost allocation.

Answer

Use the Cost Management dashboard to export a CSV

Answer

Manually review invoices

Answer

Use the Cloud Pricing Calculator

Question 2

A company wants to scan its Cloud Storage buckets for sensitive data like credit card numbers and social security numbers. Which service should they use?

Accepted Answer

Sensitive Data Protection. Sensitive Data Protection (formerly Cloud Data Loss Prevention) is designed to discover, classify, and protect sensitive data such as credit card numbers and social security numbers. It can scan Cloud Storage buckets, BigQuery tables, and other sources, using built-in infoTypes to detect and optionally de-identify sensitive information. This is the correct service for the requirement.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Web Risk API

Question 3

A developer wants to label resources with key-value pairs to track cost by team. Which GCP feature should they use?

Accepted Answer

Labels. Labels in Google Cloud are key-value pairs that can be attached to resources for purposes like cost tracking, automation, and organization. They are specifically designed for granular, user-defined metadata and are commonly used to track cost by team, environment, or project. Labels are supported across many GCP services and can be used in billing reports to break down costs.

Answer

Tags

Answer

Folders

Answer

Organization policy tags

Question 4

A data engineer needs to process streaming clickstream data in real-time, apply transformations, and write the output to BigQuery. Which Google Cloud service is built for this use case?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is Google Cloud's fully managed, serverless service for both batch and stream processing, built on Apache Beam. It natively supports reading from Pub/Sub, applying transformations, and writing to BigQuery, making it the correct choice for real-time clickstream processing. Its autoscaling and exactly-once processing capabilities are designed for streaming pipelines like this.

Answer

Cloud Dataproc

Answer

Cloud Pub/Sub

Answer

Cloud Functions

Question 5

A global e-commerce platform needs to serve content with low latency to users worldwide. They want to cache static content at edge locations near users. Which Google Cloud service should they use?

Accepted Answer

Cloud CDN. Cloud CDN caches static content at Google's globally distributed edge locations, bringing content closer to users and reducing latency for worldwide audiences. It integrates with external HTTP(S) load balancing and Cloud Storage or Compute Engine backends, making it the correct choice for edge caching of static assets.

Answer

Cloud DNS

Answer

Cloud Armor

Answer

Cloud Storage

Question 6

A company currently runs its applications in a co-location data centre with a 5-year contract for hardware. They are considering migrating to Google Cloud to avoid the upcoming hardware refresh cycle. Which business driver is most directly addressed by this migration?

Accepted Answer

Cost optimisation (avoiding CAPEX). The company faces an upcoming hardware refresh cycle mandated by their 5-year co-location contract, which would require significant capital expenditure (CAPEX) on new servers, storage, and networking. Migrating to Google Cloud converts that CAPEX into operational expenditure (OPEX) on a pay-as-you-go basis, directly addressing the cost optimization driver of avoiding a large upfront hardware investment.

Answer

Scalability

Answer

Agility

Answer

Innovation (AI/ML access)

Question 7

A company has set a budget alert at 80% and 100% of $10,000 for a specific project. The project has a billing account linked. What happens when the cost reaches $8,000?

Accepted Answer

A notification is sent to the configured Pub/Sub topic.. Budget alerts in Google Cloud are informational only; when spend crosses a threshold (80% of $10,000 = $8,000), the configured notification channel — typically a Pub/Sub topic, and optionally email to billing admins — receives a message. No automatic enforcement action is taken on the project or billing account. This is by design: budgets are for visibility, not control.

Answer

The project is automatically suspended.

Answer

All resources in the project are deleted.

Answer

The billing account is disabled.

Question 8

Which of the following is a characteristic of the cloud according to the NIST definition?

Accepted Answer

Measured service. The NIST SP 800-145 definition of cloud computing lists five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Measured service means cloud providers automatically monitor, control, and report resource usage (storage, processing, bandwidth, active user accounts) via metering capabilities, providing transparency to both provider and consumer. This pay-per-use metering model is a defining trait of cloud computing.

Answer

Manual scaling

Answer

Limited network access

Answer

Single tenancy

Question 9

A company wants to automatically receive a discount for running Compute Engine instances for more than 25% of a month without any upfront commitment. Which discount type applies?

Accepted Answer

Sustained use discount. Sustained use discounts (SUDs) are automatically applied to Compute Engine instances that run for a significant portion of the billing month (specifically, more than 25% of the month). They require no upfront commitment and are applied automatically to eligible instances. This matches the scenario described.

Answer

Committed use discount

Answer

CUD (Committed Use Discount)

Answer

Preemptible VM discount

Question 10

According to the shared responsibility model, which of the following is the customer responsible for?

Accepted Answer

Data encryption and access control (IAM). Under the shared responsibility model, customers are responsible for securing their data and controlling access to it. This includes encrypting data (at rest and in transit, where applicable) and managing identity and access with IAM policies. Google secures the physical and foundational infrastructure but does not manage customer IAM or data encryption choices.

Answer

Physical security of data centers

Answer

Network infrastructure security

Answer

Hypervisor security

Question 11

An e-commerce company needs a globally distributed relational database with strong consistency and 99.999% SLA to handle customer orders and inventory across multiple regions. They require SQL compatibility and automatic replication. Which database should they use?

Accepted Answer

Cloud Spanner. Cloud Spanner is Google Cloud's globally distributed, horizontally scalable relational database that provides strong consistency (external consistency via TrueTime) and a 99.999% availability SLA for multi-region configurations. It supports ANSI SQL and automatic synchronous replication across regions, which matches the e-commerce requirement for SQL compatibility, global distribution, and strong consistency for orders and inventory. No other option combines relational SQL, global scale, strong consistency, and a five-nines SLA.

Answer

Bigtable

Answer

Cloud SQL

Answer

Firestore

Question 12

Which Google Cloud service can be used to create and manage virtual networks, subnets, firewall rules, and VPN connections?

Accepted Answer

Cloud VPC. Cloud VPC (Virtual Private Cloud) is the Google Cloud service that provides networking functionality for your resources. It allows you to create and manage virtual networks, subnets, firewall rules, and VPN connections. It is the foundational networking service in GCP, enabling you to define IP ranges, routes, and security policies for your instances and services.

Answer

Cloud Armor

Answer

Cloud Load Balancing

Answer

Cloud CDN

Question 13

A financial services company must comply with regulations requiring data residency within the EU. They want to run workloads on Google Cloud. Which action should they take?

Accepted Answer

Select a Google Cloud region located in the EU. Data residency requirements are satisfied by physically storing and processing data within a specific geographic boundary, which in Google Cloud means selecting a region (or regions) located inside the EU, such as europe-west1, europe-west3, or europe-north1. Choosing an EU region ensures that at-rest storage, compute, and default replication stay within EU soil, meeting GDPR-style residency mandates. Encryption and network connectivity do not change where data physically resides.

Answer

Use a multi-region deployment with regions in the US and EU

Answer

Enable data encryption at rest

Answer

Use Cloud VPN for connectivity

Question 14

A security team wants to detect and respond to threats across multiple GCP projects, including identifying misconfigurations and vulnerabilities. They need a single pane of glass. Which service provides a unified view of security findings across projects?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. It aggregates findings across projects and organizations — including misconfigurations, vulnerabilities, and threats — into a single dashboard, providing the 'single pane of glass' the team requires.

Answer

Cloud Operations

Answer

Cloud Audit Logs

Answer

Chronicle

Question 15

A technology company runs its containerized microservices on Google Kubernetes Engine (GKE). The development team frequently pushes new container images to Container Registry, and those images are deployed to a production cluster. The security team recently discovered that a few running containers have critical vulnerabilities from outdated base images. They want to enforce a policy that only vulnerability-scanned and approved images can be deployed in the production cluster. The team uses Cloud Build for CI/CD and Container Analysis for vulnerability scanning. Which solution should they implement to meet this requirement?

Accepted Answer

Enable Binary Authorization with a policy that requires attestations from Container Analysis for all deployments in the production cluster.. Binary Authorization enforces deployment-time policies that require signed attestations from trusted authorities (like Container Analysis) before an image can be deployed on GKE. By configuring a policy that mandates an attestation from Container Analysis (which performs vulnerability scanning), only images that have been scanned and approved can be deployed, directly meeting the requirement to block containers with critical vulnerabilities.

Answer

Use Cloud Security Scanner to scan the production cluster for vulnerabilities.

Answer

Enable Cloud Asset Inventory to monitor image vulnerabilities across projects.

Answer

Configure Cloud Build to run a vulnerability scan step before pushing images to Container Registry.