Cloud Digital Leader Practice Test 43 — 15 Questions

Question 1

Which Google Cloud feature provides reports on how Google processes government requests for customer data and how often Google challenges overly broad requests?

Accepted Answer

Google's Transparency Report — publishing data about government requests and legal compliance.. Google's Transparency Report is the correct answer because it specifically publishes data on government requests for user data, including how Google processes these requests and how often it challenges overly broad or legally questionable demands. This report is designed to provide public visibility into government actions, not to log individual API calls or access events.

Answer

Cloud Audit Logs — they record all API calls including government data requests.

Answer

Security Command Center — it alerts when government agencies access customer data.

Answer

Access Transparency logs — they record every time any external entity accesses customer data.

Question 2

A financial services company must comply with strict data residency regulations. They want to run sensitive workloads on-premises while using Google Cloud for burst analytics. Which deployment model should they choose?

Accepted Answer

Hybrid cloud. Hybrid cloud is correct because it combines on-premises infrastructure with public cloud services, allowing the company to keep regulated sensitive workloads on-premises (satisfying data residency) while leveraging Google Cloud for elastic burst analytics. This split-deployment model is the defining characteristic of hybrid cloud. Neither pure public nor pure private cloud alone satisfies both requirements.

Answer

Public cloud

Answer

Private cloud

Answer

Multi-cloud

Question 3

The principle of least privilege is a fundamental security concept applied to IAM in Google Cloud. Which statement best describes this principle?

Accepted Answer

Users and services should be granted only the minimum permissions required for their specific function, nothing more.. The principle of least privilege in Google Cloud IAM dictates that identities (users, groups, or service accounts) should be granted only the permissions necessary to perform their intended tasks. This minimizes the attack surface and limits the blast radius of a compromised credential. In Google Cloud, this is implemented by assigning predefined or custom roles with the exact set of permissions required, rather than using broad roles like Owner or Editor.

Answer

All users should have read-only access to prevent accidental changes.

Answer

Administrators should have full access so they can respond to any emergency quickly.

Answer

All employees should share the same IAM role to simplify permission management.

Question 4

A developer needs to store a database password securely and access it from a Compute Engine VM. The password should be automatically rotated every 90 days. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing, versioning, and accessing sensitive values like database passwords, API keys, and certificates, with native support for automatic rotation via rotation schedules and Pub/Sub notifications. It integrates directly with Compute Engine service accounts through IAM, so a VM can retrieve the secret at runtime without embedding credentials. This matches every requirement in the scenario.

Answer

IAM

Answer

Cloud Storage with server-side encryption

Answer

Cloud KMS

Question 5

What does 'serverless computing' mean, and what does a developer NOT have to manage when using serverless services?

Accepted Answer

Serverless means developers don't provision or manage servers, OS, or scaling — they only write and deploy code.. Serverless computing is a cloud execution model where the cloud provider dynamically manages the allocation and provisioning of servers. The developer writes and deploys code (functions) without needing to provision, configure, or scale underlying servers, operating systems, or runtime environments. Option B correctly captures this: developers only write and deploy code, while the provider handles infrastructure management.

Answer

Serverless means no code is needed — the cloud provider writes the application logic automatically.

Answer

Serverless computing only works for batch jobs that run overnight.

Answer

Serverless is a type of on-premises architecture where servers are hidden from developers.

Question 6

A data engineering team needs to orchestrate a complex data pipeline that involves multiple steps: extracting data from various sources, transforming it with Dataflow, loading it into BigQuery, and running validation jobs — all in a specific sequence with retry logic and scheduling. Which Google Cloud service manages this workflow orchestration?

Accepted Answer

Cloud Composer (managed Apache Airflow). Cloud Composer is a managed Apache Airflow service that provides workflow orchestration, including dependency management, retry logic, and scheduling for complex pipelines. It allows you to define a DAG (Directed Acyclic Graph) that sequences tasks like Dataflow extraction, BigQuery loading, and validation jobs, with built-in retry and scheduling capabilities.

Answer

Cloud Scheduler — cron-based job scheduling.

Answer

Cloud Dataflow — stream and batch processing.

Answer

Cloud Functions — event-driven function execution.

Question 7

Refer to the exhibit. A company configures a lifecycle policy on a Cloud Storage bucket. The bucket contains objects uploaded over the past year with custom time set on each object. After 60 days, what happens to the objects?

Accepted Answer

Objects with custom time more than 30 days ago are deleted.. The lifecycle policy uses the `customTime` attribute, and the rule is configured to delete objects when `customTime` is older than 30 days. After 60 days from upload, objects with a `customTime` set at upload will have had that timestamp for 60 days, so they are more than 30 days past their `customTime` and are deleted. The policy does not use object age or last access time.

Answer

All objects older than 30 days from now are deleted.

Answer

Objects are deleted after 30 days from the last access.

Answer

The lifecycle policy is invalid because custom time is not supported.

Question 8

An enterprise needs advanced business intelligence capabilities: governed semantic models that business users query with natural language, embedded analytics in their customer-facing application, and centralized data access controls. Which Google Cloud analytics product is purpose-built for these enterprise BI requirements?

Accepted Answer

Looker (enterprise BI platform with LookML semantic layer). Looker is purpose-built for enterprise BI with its LookML semantic modeling layer, which governs data definitions and access controls. It supports natural language querying through Looker's 'Ask Looker' feature and enables embedded analytics via its API and SDK, directly matching the requirements for governed semantic models, natural language queries, and embedded analytics.

Answer

Looker Studio (free BI dashboards)

Answer

BigQuery — it provides natural language querying via BQML.

Answer

Vertex AI — it builds ML models that answer business questions.

Question 9

A company wants to proactively identify underutilized Compute Engine VMs (high provisioned capacity but low actual usage) to reduce costs. Which Google Cloud tool provides recommendations for right-sizing VMs?

Accepted Answer

Active Assist Recommender — ML-based VM rightsizing recommendations.. Active Assist Recommender is Google Cloud's ML-based service that analyzes historical VM utilization metrics and generates rightsizing recommendations, flagging VMs that are over-provisioned relative to actual usage. It directly addresses the goal of proactively identifying underutilized Compute Engine VMs to reduce cost. The recommendations include specific machine type suggestions and estimated savings.

Answer

Cloud Monitoring — set alerts for low CPU utilization.

Answer

Cloud Asset Inventory — lists all VMs and their configurations.

Answer

Cloud Billing budgets — set spending limits to prevent overspend.

Question 10

A company wants to replace its VPN-based remote access with a solution that grants access based on user identity, device security status, and context (e.g., location, IP). Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise is Google Cloud's zero-trust access platform that grants access based on user identity, device security posture, and contextual signals (location, IP, time), replacing traditional VPN-based remote access. It builds on Identity-Aware Proxy (IAP) and adds device trust, continuous authorization, and threat/data protection. This matches the requirement for identity- and context-based access without a VPN.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 11

A retail bank's branch staff currently look up customer information in disconnected systems, requiring multiple logins and manual data consolidation before advising customers. A cloud transformation project unifies customer data into a single 360° view platform accessible from any device. What type of transformation does this primarily represent?

Accepted Answer

Business process and customer experience transformation — unifying data to enable better customer service through digital tools.. The project unifies fragmented customer data into a single 360° view platform accessible from any device, directly improving how staff serve customers. This is a business process and customer experience transformation, as it eliminates manual data consolidation and multiple logins, enabling faster, more personalized service through digital tools. The cloud enables this by providing a centralized data store and API-driven access, which is the core of transforming customer interactions rather than just upgrading infrastructure.

Answer

Infrastructure modernization — replacing old servers with cloud VMs.

Answer

Security transformation — reducing the number of password logins required.

Answer

Cost reduction initiative — eliminating duplicate software licenses.

Question 12

A reliability engineering team wants to proactively identify weaknesses in their distributed system by deliberately injecting failures — killing random instances, introducing network latency, and cutting off database connections — to observe how the system responds. What is this practice called?

Accepted Answer

Chaos engineering — deliberately injecting controlled failures to discover system weaknesses and build resilience confidence.. Chaos engineering is the practice of deliberately injecting controlled failures—such as killing instances, introducing latency, or cutting database connections—into a distributed system to proactively identify weaknesses and build resilience confidence. This approach aligns with Google Cloud's reliability principles, where tools like Chaos Monkey (part of the Simian Army) or Google's internal DiRT (Disaster Recovery Testing) are used to test system behavior under failure conditions.

Answer

Destructive testing — deliberately breaking the system to determine the breaking point.

Answer

Penetration testing — simulating attacks to find security vulnerabilities.

Answer

Load testing — verifying the system handles expected traffic volumes.

Question 13

A CEO presents a strategic plan to 'move everything to the cloud.' The board asks what business outcome should be the primary measure of success for the cloud migration. Which answer best reflects a business-outcome-oriented approach to measuring cloud migration success?

Accepted Answer

Measurable business improvements such as reduced time-to-market for new products, lower infrastructure costs, and improved customer satisfaction enabled by cloud capabilities. It ties cloud migration success directly to measurable business outcomes, such as reduced time-to-market, lower infrastructure costs, and improved customer satisfaction. This aligns with the GCDL principle that cloud technology is a business enabler, not just an IT project. A business-outcome-oriented approach ensures that migration efforts are evaluated by their impact on strategic goals, such as agility and cost efficiency, rather than technical milestones.

Answer

The percentage of applications successfully migrated to cloud infrastructure

Answer

The number of cloud certifications earned by the IT team during the migration

Answer

Achieving 100% elimination of on-premises infrastructure by the end of the first year

Question 14

A company wants to migrate a legacy monolithic application to Google Cloud with minimal code changes. The application runs on a specific OS version and uses a relational database. Which migration approach is most suitable?

Accepted Answer

Lift and shift to Compute Engine and Cloud SQL. The correct option is B: Lift and shift to Compute Engine and Cloud SQL. This approach is most suitable because it preserves the existing application with minimal code changes, allowing the same OS version to run on Compute Engine VMs while migrating the relational database to Cloud SQL, a managed relational database service. Options A and C require significant code changes (rebuilding as serverless functions or refactoring into microservices), which contradicts the minimal-change requirement. Option D, replatforming to Cloud Run, also typically requires containerization and code adjustments and may not support the specific OS version or relational database dependencies as directly.

Answer

Rebuild the application using serverless functions

Answer

Refactor the application into microservices

Answer

Replatform to use Cloud Run

Question 15

Refer to the exhibit. A user receives this error when trying to copy an object from one bucket to another. What is the most likely cause?

Accepted Answer

The service account used does not have the required IAM permissions to copy objects.. The error when copying an object between buckets is most likely due to insufficient IAM permissions. In Google Cloud, the service account initiating the copy must have both `storage.objects.get` (to read the source object) and `storage.objects.create` (to write to the destination bucket) permissions. Without these, the operation fails with an access denied error, even if the buckets exist and are accessible.

Answer

The buckets are located in different regions and cross-region copy is not allowed.

Answer

The destination bucket has exceeded its storage quota.

Answer

The source bucket name is misspelled in the request.