Cloud Digital Leader Practice Test 42 — 15 Questions

Question 1

A cloud operations engineer notices that the managed instance group 'my-mig' has been scaling up frequently, but the application performance is still degraded. The CPU utilization metric shows high values. What is most likely the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scaling metric is not appropriate; consider using a custom metric that better reflects application load.. The autoscaler is using CPU utilization as the scaling metric, but high CPU does not necessarily correlate with application performance degradation. If the application is bottlenecked on memory, I/O, or request queuing, CPU may remain high while throughput suffers. A custom metric (e.g., requests per second, latency, or queue depth) would better reflect actual application load and enable more accurate scaling decisions.

Answer

The target size is set to 10, which is lower than the current needed capacity.

Answer

The instance group is using preemptible VMs which are being reclaimed frequently.

Answer

The autoscaler is using a cooldown period that is too long, preventing it from scaling down.

Question 2

A retail company runs a web application on Google Kubernetes Engine (GKE). They want to automatically scale the application based on custom metrics (e.g., number of items in a shopping cart). Which TWO resources should they configure?

Accepted Answer

Custom Metrics Stackdriver Adapter. Horizontal Pod Autoscaler (HPA) can scale pods based on custom metrics. Custom Metrics adapter (e.g., Stackdriver adapter) exposes application metrics to HPA.

Answer

Cluster Autoscaler

Answer

Vertical Pod Autoscaler (VPA)

Answer

Cloud Load Balancing

Question 3

A company wants to ensure that their confidential data stored in BigQuery cannot be shared outside the company's Google Cloud organization. Which Google Cloud security capability prevents data from being shared with external Google accounts (outside the organization)?

Accepted Answer

The 'Domain Restricted Sharing' organization policy constraint, which prevents IAM policies from granting access to users outside specified trusted domains. The 'Domain Restricted Sharing' organization policy constraint (constraints/iam.allowedPolicyMemberDomains) explicitly prevents IAM policies from granting access to principals outside of specified trusted domains. This directly blocks sharing BigQuery data with external Google accounts by enforcing that all IAM members belong to the allowed domains, such as the company's own Google Workspace domain.

Answer

Enabling BigQuery data encryption with CMEK to prevent external parties from decrypting shared data

Answer

BigQuery row-level security policies that restrict rows based on user email domain

Answer

Disabling external IP addresses on all Google Cloud resources to prevent data from leaving the organization's network

Question 4

A company needs to run a legacy application that requires full control over the operating system, including custom kernel modules. They want to minimize management overhead for the underlying hardware. Which cloud service model should they use?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where the customer manages the OS and above, while the cloud provider manages the hardware and hypervisor.

Answer

PaaS

Answer

FaaS

Answer

SaaS

Question 5

A solutions architect is explaining why using managed cloud database services (like Cloud SQL or Cloud Spanner) is preferable to running a database on a self-managed virtual machine in most cases. What is the primary operational advantage of managed database services over self-managed databases on VMs?

Accepted Answer

Managed database services automate operational tasks like backups, patching, HA failover, and scaling — freeing engineering teams to focus on application development rather than database administration. Managed database services like Cloud SQL and Cloud Spanner abstract away the operational overhead of database administration. They automate critical tasks such as automated backups, patch management, high-availability failover, and horizontal scaling, which allows engineering teams to focus on application logic rather than managing database servers, replication, or storage.

Answer

Managed databases are always significantly cheaper than self-managed databases on VMs

Answer

Managed databases guarantee better query performance than self-managed databases for all workload types

Answer

Managed databases provide stronger data encryption than self-managed databases on VMs

Question 6

An online retailer stores product images in a Cloud Storage bucket. Current access patterns: images uploaded once and read frequently for 30 days, then accessed rarely after 90 days, and must be retained for 7 years for compliance. Which storage class transition strategy minimizes cost while meeting requirements?

Accepted Answer

Upload to Standard, lifecycle rule to Nearline at 30 days, then to Archive at 90 days. The optimal strategy is to upload to Standard (for frequent access in the first 30 days), then transition to Nearline at 30 days (for infrequent access but still low latency), and finally to Archive at 90 days (for long-term retention at lowest cost). This matches the access pattern: frequent reads for 30 days, rare access after 90 days, and 7-year retention. Archive is the cheapest storage class for long-term retention, and transitioning at 90 days aligns with the change in access frequency.

Answer

Upload to Nearline, lifecycle rule to Archive at 30 days

Answer

Upload to Standard, lifecycle rule to Nearline at 30 days, then to Coldline at 90 days

Answer

Upload to Standard, lifecycle rule to Coldline at 30 days, then to Archive at 90 days

Question 7

An organization stores sensitive data in BigQuery. They need to restrict access to specific columns based on user role, while allowing analysis at the dataset level. Which feature should they use?

Accepted Answer

Column-level access control using authorized views or taxonomy policies. BigQuery column-level access control, implemented through authorized views or taxonomy policies (via Data Catalog), allows restricting access to specific columns while preserving dataset-level analysis permissions. Authorized views use SQL logic to expose only permitted columns, and taxonomy policies apply fine-grained access controls at the column level without requiring separate datasets.

Answer

BigQuery row-level security

Answer

IAM roles at the dataset level with fine-grained permissions

Answer

Cloud Data Loss Prevention (DLP) to mask data

Question 8

A media company needs to transcode and store thousands of video files daily, with variable demand. They want to minimize costs while ensuring fast processing. How does cloud transformation help?

Accepted Answer

Using Cloud Transcoder API and Cloud Storage with lifecycle policies. Cloud Transcoder API provides a serverless, scalable transcoding service that automatically handles variable demand, while Cloud Storage with lifecycle policies (e.g., moving files to Nearline or Archive after 30 days) minimizes storage costs. This combination ensures fast processing without provisioning fixed infrastructure, directly addressing the need for cost efficiency and speed under fluctuating workloads.

Answer

Deploying dedicated physical servers in a colocation facility

Answer

Using batch scripts on a fixed number of on-premise servers

Answer

Using Cloud Functions to process each video

Question 9

A company uses Cloud CDN to deliver static content. They notice that some content is being served stale despite a TTL of 1 hour. What should they check to ensure content is always fresh?

Accepted Answer

Verify that the origin server sets appropriate Cache-Control headers (e.g., max-age=3600).. Cloud CDN relies on the Cache-Control: max-age directive from the origin server to determine how long content should be considered fresh. If the origin does not set max-age=3600 (or a comparable value), Cloud CDN may serve stale content even if the CDN TTL is configured to 1 hour, as the CDN respects the origin's cache headers by default. Ensuring the origin sets appropriate Cache-Control headers guarantees that Cloud CDN caches content for the intended duration.

Answer

Enable cache invalidation for all objects daily.

Answer

Increase the TTL in the CDN configuration to 24 hours.

Answer

Use Cloud Storage as the origin and set caching to 'public'.

Question 10

An organization's digital transformation initiative is failing to deliver expected outcomes despite significant cloud technology investment. A review reveals that business units operate in silos, processes remain unchanged, and employees resist new ways of working. Which factor is most likely the root cause of the failure?

Accepted Answer

Insufficient change management, cultural resistance, and siloed operations are preventing the organization from realizing technology benefits. The failure stems from organizational and cultural factors—siloed operations, unchanged processes, and employee resistance—which are classic symptoms of inadequate change management. Cloud technology alone cannot drive transformation; it must be paired with process reengineering and cultural adoption. The GCDL framework emphasizes that digital transformation is as much about people and processes as it is about technology.

Answer

The organization chose the wrong cloud provider for its technical workloads

Answer

The cloud services selected are not technically advanced enough to deliver transformation outcomes

Answer

The organization is spending too much on cloud services, leaving insufficient budget for transformation

Question 11

A startup wants to launch a social media app globally. They have no existing IT infrastructure and very limited capital. The app will experience unpredictable traffic patterns, with usage expected to rapidly grow after viral campaigns. They need low latency for users across North America, Europe, and Asia. The development team is small and wants to focus on coding rather than operations. They also need to store user-generated content like images and videos. The CTO is evaluating whether to build on-premises or use cloud services. Which approach best meets their needs?

Accepted Answer

Build the app on Compute Engine with managed instance groups, use Cloud CDN for global low-latency delivery, and Cloud Storage for user content.. It leverages Google Cloud's fully managed services to meet the startup's needs: Compute Engine with managed instance groups provides auto-scaling for unpredictable traffic, Cloud CDN ensures low-latency global content delivery, and Cloud Storage offers scalable, durable storage for user-generated content. This serverless-like approach minimizes operational overhead, allowing the small team to focus on coding.

Answer

Deploy a single large virtual machine in one region and rely on a CDN to serve content globally.

Answer

Purchase and configure servers in a single colocation facility, and use a content delivery network (CDN) for static assets.

Answer

Use a hybrid cloud model: keep a small on-premises server for core features and burst to the cloud for extra capacity.

Question 12

Drag and drop the steps to enable and use Cloud Audit Logs for a project into the correct order.

Accepted Answer

Navigate to the Audit Logs page, select the services and log types, save the configuration, then view the logs.. First navigate to audit logs, then select services and log types, save, and finally view the logs.

Answer

Select the services and log types, navigate to the Audit Logs page, save the configuration, then view the logs.

Answer

Navigate to the Audit Logs page, save the configuration, select the services and log types, then view the logs.

Answer

Navigate to the Audit Logs page, select the services and log types, view the logs, then save the configuration.

Question 13

A company wants to add location-based features to their mobile app: showing nearby stores, calculating driving routes, and embedding interactive maps. Which Google Cloud platform provides these mapping and location services?

Accepted Answer

Google Maps Platform. Google Maps Platform is the correct choice because it provides the specific APIs needed for location-based features: Places API for nearby stores, Directions API for driving routes, and Maps SDK for embedding interactive maps. Cloud Spanner, IoT Core, and BigQuery Geo Viz are not designed to deliver these front-end mapping and routing services.

Answer

Cloud Spanner — it stores geolocation data with ACID transactions.

Answer

Cloud IoT Core — it tracks device locations in real time.

Answer

BigQuery Geo Viz — it visualizes geographic data on a map.

Question 14

A developer accidentally commits an application's Google Cloud service account key to a public GitHub repository. The key is valid and grants access to production resources. What is the correct immediate response?

Accepted Answer

Immediately revoke/delete the exposed service account key in Google Cloud IAM, review Cloud Audit Logs for unauthorized access, and generate a new key distributed through secure channels. The immediate priority is to invalidate the exposed credential to prevent unauthorized access to production resources. Revoking the key in Google Cloud IAM ensures it can no longer be used for authentication, while reviewing Cloud Audit Logs helps identify any potential misuse. Generating a new key and distributing it securely restores access for legitimate applications.

Answer

Delete the commit from GitHub history using git rebase; the key is safe once removed from the repository

Answer

Change the service account's permissions to read-only to limit the damage from potential misuse

Answer

Send an internal email informing the security team and wait for their guidance before taking any action

Question 15

A security team wants to find misconfigurations and vulnerabilities across their Google Cloud environment, including VMs, storage, and IAM. Which service provides a unified view of these findings?

Accepted Answer

Security Command Center. Security Command Center provides a centralized view of vulnerabilities and misconfigurations. Cloud Audit Logs are for auditing actions. Cloud IDS is for network threats. Assured Workloads is for compliance.

Answer

Cloud IDS

Answer

Assured Workloads

Answer

Cloud Audit Logs