Cloud Digital Leader Practice Test 4 — 10 Questions

Question 1

A company's production database is running on a Compute Engine VM with a 500 GB Persistent Disk. The operations team wants to create a backup they can restore from in case of data corruption or accidental deletion. Which Google Cloud capability provides point-in-time backup for Persistent Disks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Persistent Disk Snapshots, which capture the disk state at a point in time and enable restoration or creation of new disks from that snapshot. Persistent Disk Snapshots are the correct Google Cloud feature for creating point-in-time backups of Persistent Disks. They capture the disk's data and configuration at a specific moment, allowing you to restore the disk or create new disks from that snapshot. This is the native, recommended method for backup and disaster recovery of Compute Engine VM disks.

Answer

Cloud Storage bucket replication, by continuously copying the database files to a storage bucket

Answer

Cloud SQL automated backups, which protect databases running on Compute Engine VMs

Answer

VM live migration, which moves the running VM between physical hosts, automatically creating a backup in the process

Question 2

A startup is building a web application and wants to protect it from common web attacks like SQL injection and cross-site scripting. Which Google Cloud product provides web application firewall (WAF) capabilities?

Accepted Answer

Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks. Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.

Answer

Cloud Firewall, which controls network-level traffic based on IP and port rules

Answer

VPC Service Controls, which prevent data exfiltration from Google Cloud services

Answer

Security Command Center, which detects security misconfigurations across Google Cloud resources

Question 3

A company runs an e-commerce platform on Google Kubernetes Engine (GKE) using autoscaling. They have a baseline workload and occasional traffic spikes during promotions. They configured a Horizontal Pod Autoscaler (HPA) for their web application pods and a Cluster Autoscaler for the node pool. The HPA targets 70% CPU utilization. During a recent sales event, traffic exceeded expectations. The operations team observed that the HPA increased the desired number of replicas to 50, but only 20 pods were running. The remaining 30 pods were in 'Pending' status. The Cluster Autoscaler logs show repeated messages: 'no capacity to scale up node pool'. The node pool is configured with a maximum of 10 nodes, each with 4 vCPUs, and currently all 10 nodes are running. The team checked the node pool's current utilization and found that nodes are near capacity. What should the team do to ensure the application scales correctly during future events?

Accepted Answer

Increase the maximum number of nodes in the node pool to allow more capacity.. The HPA requested 50 replicas, but only 20 could be scheduled because the existing 10 nodes are near capacity and the node pool is already at its maximum size. The Cluster Autoscaler cannot add more nodes because the node pool's maximum node limit prevents it from provisioning the needed additional capacity. Increasing the maximum number of nodes in the node pool (Option C) allows the Cluster Autoscaler to add nodes and accommodate the pending pods, enabling the HPA to scale as needed.

Answer

Increase the HPA target CPU utilization to 90% to reduce the number of replicas needed.

Answer

Reduce the pod resource requests for CPU so that more pods can fit on existing nodes.

Answer

Enable extra capacity by creating a second node pool with preemptible VMs.

Question 4

A product team is discussing how to handle a planned 48-hour maintenance window for a critical customer-facing service. The SRE team argues the maintenance window is unnecessary with proper cloud architecture. Which cloud capability eliminates the need for planned downtime maintenance windows?

Accepted Answer

Zero-downtime deployment strategies like rolling updates and blue/green deployments, combined with cloud live migration for infrastructure maintenance. Cloud platforms like Google Cloud support zero-downtime deployment strategies (rolling updates, blue/green deployments) and live migration for infrastructure maintenance. Live migration transparently moves running VMs between hosts without interrupting the OS or applications, while blue/green deployments allow traffic to be switched to a fully updated environment before the old one is taken down. Together, these capabilities eliminate the need for planned downtime maintenance windows entirely.

Answer

Longer maintenance windows scheduled during off-peak hours to minimize customer impact

Answer

Notifying customers in advance of the maintenance window and offering service credits for the downtime

Answer

Backing up all data before the maintenance window to ensure recovery if something goes wrong

Question 5

A Virtual Private Cloud (VPC) in Google Cloud provides network isolation. What does 'network isolation' mean in this context, and why is it important?

Accepted Answer

VPC provides a logically isolated private network where resources are separated from other customers' networks by default, preventing unauthorized cross-customer traffic.. A Google Cloud VPC provides a logically isolated private network within the shared Google Cloud infrastructure. This isolation ensures that resources in one customer's VPC cannot directly communicate with resources in another customer's VPC by default, preventing unauthorized cross-customer traffic. This is achieved through software-defined networking (SDN) constructs like virtual firewalls and routing tables, not through physical separation.

Answer

Network isolation means the VPC blocks all internet access — resources cannot communicate with external services.

Answer

Network isolation means all traffic within the VPC is automatically encrypted.

Answer

A VPC requires dedicated physical hardware separate from other customers to ensure isolation.

Question 6

A data analyst at a media company needs to run complex SQL queries on petabytes of user engagement data to produce weekly reports. The dataset is stored in Google Cloud. Which Google Cloud product is purpose-built for this type of large-scale analytical SQL workload?

Accepted Answer

BigQuery, Google Cloud's serverless data warehouse for petabyte-scale analytical SQL. BigQuery is Google Cloud's serverless, highly scalable data warehouse specifically designed for petabyte-scale analytical SQL queries. It separates compute from storage and uses a columnar storage format and a distributed query engine to execute complex SQL on massive datasets without provisioning infrastructure, making it the ideal choice for the described workload.

Answer

Cloud SQL, Google Cloud's managed relational database service

Answer

Cloud Bigtable, Google's NoSQL wide-column database

Answer

Firestore, Google Cloud's serverless NoSQL document database

Question 7

A company wants to enable its developers to write and run code in various programming languages (Python, Node.js, Go) without provisioning or managing any servers. The code should execute in response to HTTP requests. Which Google Cloud product is designed for this serverless, function-level execution model?

Accepted Answer

Cloud Functions, which executes code functions in response to events or HTTP requests with no server management required. Cloud Functions is the correct choice because it is Google Cloud's event-driven, serverless compute platform that allows developers to write and deploy single-purpose functions in languages like Python, Node.js, and Go. These functions automatically scale and execute in response to HTTP triggers (e.g., HTTP requests) without any server provisioning or management, directly matching the requirement for a function-level execution model.

Answer

Compute Engine, which provides virtual machines for running code in any language

Answer

Cloud SQL, which runs SQL queries in response to HTTP requests

Answer

Persistent Disk, which stores code that can be executed on demand

Question 8

A company runs a customer-facing web application with a published SLA of 99.95% monthly availability. In the past month, the application experienced two outages: a 12-minute outage and a 7-minute outage. Did the company meet its SLA?

Accepted Answer

Yes — 99.95% availability in a 30-day month allows approximately 21.6 minutes of downtime; total outage of 19 minutes is within the budget, meaning the SLA was met. The SLA of 99.95% monthly availability permits a maximum downtime of approximately 21.6 minutes in a 30-day month (total minutes in month × (1 - 0.9995) = 43,200 × 0.0005 = 21.6 minutes). The combined outage of 19 minutes (12 + 7) is within this budget, so the SLA was met. This calculation assumes a 30-day month; if the month had 31 days, the allowable downtime would be about 22.3 minutes, still exceeding 19 minutes.

Answer

No — the company missed the SLA because any outage automatically constitutes an SLA breach

Answer

The answer cannot be determined without knowing the cause of the outages

Answer

No — two separate outages in one month always constitute an SLA breach regardless of duration

Question 9

A multinational retail company has an on-premises infrastructure with a mix of Windows and Linux servers. They are planning to migrate their e-commerce platform to Google Cloud to take advantage of scalability and reduce latency. The platform consists of a web frontend (Apache), a backend API (Node.js), and a MySQL database. They want to minimize downtime during the migration. They have a limited budget and need a solution that is cost-effective and quick to implement. The IT team has experience with containers but prefers to avoid managing Kubernetes. Which approach should they take?

Accepted Answer

Migrate the frontend to App Engine Standard, the backend to Cloud Run, and the database to Cloud SQL with read replicas.. It combines fully managed, serverless services (App Engine Standard for the web frontend and Cloud Run for the backend API) with Cloud SQL for the database, which meets the requirements of minimizing downtime, being cost-effective, and avoiding Kubernetes management. App Engine Standard and Cloud Run automatically scale to zero when not in use, reducing costs, and Cloud SQL with read replicas provides high availability and low-latency reads without complex orchestration. This approach also allows for a gradual migration with minimal disruption, as the existing code can be adapted with minimal changes.

Answer

Use Compute Engine for the web frontend, Cloud Functions for the backend API, and Cloud Spanner for the database.

Answer

Lift and shift all components to Compute Engine with an autoscaling managed instance group, and migrate the database to Cloud SQL.

Answer

Containerize all components using GKE, use Cloud SQL for the database, and deploy using a CI/CD pipeline.

Question 10

A company wants to allow a third-party security firm to conduct a penetration test against their Google Cloud environment to identify vulnerabilities. What is Google Cloud's policy on penetration testing?

Accepted Answer

Customers are authorized to penetration test their own GCP resources without prior Google approval, within the Acceptable Use Policy.. Google Cloud's policy explicitly authorizes customers to conduct penetration testing on their own GCP resources without prior approval from Google, as long as the testing complies with the Acceptable Use Policy. This is because Google treats the customer's environment as their own responsibility, and the shared responsibility model places security testing under the customer's control. Option B correctly reflects this policy, which is documented in Google Cloud's security testing guidelines.

Answer

Customers must submit a formal request to Google and wait for written approval before any penetration testing.

Answer

Penetration testing is illegal in cloud environments and customers should use vulnerability scanners instead.

Answer

Google automatically performs penetration testing on all customer resources monthly and shares the report.