Cloud Digital Leader Practice Test 46 — 15 Questions

Question 1

An organisation needs to securely connect its on-premises data centre to Google Cloud with high bandwidth and low latency for hybrid cloud workloads. They want a dedicated, private connection that does not traverse the public internet. Which solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides dedicated, private connections between on-prem and Google Cloud with high bandwidth and low latency. VPN uses the public internet, Cloud CDN is for content delivery, and Cloud NAT is for outbound internet access.

Answer

Cloud NAT

Answer

Cloud CDN

Answer

Cloud VPN

Question 2

A non-profit organization with limited IT staff wants to use cloud to improve its fundraising and donor management without hiring technology specialists. Which type of cloud service model is most appropriate for this organization's need?

Accepted Answer

Software as a Service (SaaS), where a fully managed donor management application is subscribed to and used without any infrastructure management. Software as a Service (SaaS) is the most appropriate model because it provides a fully managed, ready-to-use donor management application over the internet. The organization's limited IT staff can simply subscribe and use the software without provisioning servers, installing applications, or managing infrastructure, directly addressing the need to avoid hiring technology specialists.

Answer

Infrastructure as a Service (IaaS), where the organization provisions VMs and installs donor management software

Answer

Platform as a Service (PaaS), where the organization deploys custom-built donor management code

Answer

Private cloud, where the organization builds its own cloud infrastructure for complete data control

Question 3

An organization needs to store API keys, database passwords, and certificates securely, with automatic rotation and audit logging. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing API keys, passwords, and certificates with versioning, automatic rotation, IAM-based access control, and audit logging via Cloud Audit Logs. It directly addresses the requirement for secure storage plus rotation and auditing.

Answer

Cloud Storage with encryption

Answer

Cloud KMS

Answer

Cloud HSM

Question 4

An engineer is troubleshooting a Cloud SQL instance that is running out of memory. They want to reduce memory usage without changing the machine type. Which action would help?

Accepted Answer

Reduce the max_connections flag. In Cloud SQL, each database connection consumes memory for session state, buffers, and per-connection overhead. Reducing the max_connections flag lowers the maximum number of simultaneous connections, directly reducing the memory footprint of the database instance without changing the machine type. This is the most direct lever for memory reduction in this scenario.

Answer

Enable automatic storage increase

Answer

Add a read replica

Answer

Switch from InnoDB to MyISAM

Question 5

Which cloud computing characteristic is defined by the NIST as the ability for a consumer to provision computing capabilities automatically without requiring human interaction with each service provider?

Accepted Answer

On-demand self-service. On-demand self-service, as defined by NIST SP 800-145, is the capability for a consumer to unilaterally provision computing capabilities such as server time and network storage automatically, without requiring human interaction with each service provider. This is the defining characteristic that enables users to spin up resources via portals or APIs instantly.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity

Question 6

A developer needs to store and manage API keys and certificates in a secure, centralized manner, with automatic rotation and integration with Cloud Functions. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is Google Cloud's dedicated service for storing, managing, and auditing secrets such as API keys, passwords, and certificates. It supports automatic rotation via rotation schedules and Pub/Sub notifications, and integrates natively with Cloud Functions through client libraries and IAM. This directly matches the requirement for secure centralized storage with rotation and Cloud Functions integration.

Answer

Cloud Storage

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 7

A global e-commerce company wants to serve its website from Google Cloud with low latency to users worldwide. The website consists of static content (images, CSS) and dynamic content served by a backend application. Which combination of services should they use?

Accepted Answer

Cloud Storage with Cloud CDN for static content, and Compute Engine instances behind Cloud Load Balancing for dynamic content. Serving a global website with both static and dynamic content is best done by offloading static assets to Cloud Storage fronted by Cloud CDN for edge caching, while running the dynamic backend on Compute Engine instances behind Cloud Load Balancing for global anycast routing and health-checked distribution. This combination minimizes latency and scales each tier independently.

Answer

Compute Engine with Cloud Armor

Answer

Cloud Functions for all content

Answer

Cloud Storage only

Question 8

A company uses Cloud Functions to process image uploads. Each image triggers a function that uses Vision API to extract text and stores results in Firestore. The function sometimes fails due to timeout when images are large. How should they redesign for reliability and scale?

Accepted Answer

Use Cloud Tasks with Cloud Run to process images asynchronously. Redesigning to use Cloud Tasks with Cloud Run allows asynchronous processing of image uploads. Cloud Tasks can queue the work and trigger Cloud Run services, which can scale independently and have longer timeouts (up to 60 minutes). This decouples the upload from processing, improving reliability and scalability, and avoids Cloud Functions' timeout limits.

Answer

Use Cloud Scheduler to trigger the function every minute

Answer

Increase the function timeout to 60 minutes

Answer

Use Compute Engine VMs with startup scripts

Question 9

A company runs batch processing jobs using preemptible VMs to reduce costs. They need to ensure these jobs can scale out significantly during peak hours. Which Compute Engine pricing model should they combine with autoscaling to optimize cost for these workloads?

Accepted Answer

Preemptible VMs with no further discounts.. Preemptible VMs already provide significant cost savings (up to 60-91% off standard VMs) and are ideal for fault-tolerant batch jobs. Combining them with autoscaling allows scaling during peak hours without any additional discounts. Sustained use discounts do not apply to preemptible VMs, and committed use discounts require upfront commitments unsuitable for variable workloads. Sole-tenant nodes are designed for dedicated hardware, not cost optimization. Therefore, using preemptible VMs with no further discounts is the optimal cost-effective solution.

Answer

Sole-tenant nodes.

Answer

Sustained use discounts.

Answer

Committed use discounts.

Question 10

A company wants to connect its on-premises data center to Google Cloud securely and with low latency. Which Google Cloud service should they use?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, private physical connection between an on-premises data center and Google Cloud, bypassing the public internet. This results in lower latency, higher throughput, and more consistent performance than internet-based options. It is the recommended service for secure, low-latency hybrid connectivity at enterprise scale.

Answer

Cloud NAT

Answer

Cloud VPN

Answer

Cloud CDN

Question 11

A company wants to analyze petabytes of sales data using SQL queries with sub-second response times for dashboards. They need a fully managed, serverless solution that separates storage and compute. Which service meets these requirements?

Accepted Answer

BigQuery. BigQuery is a fully managed, serverless, petabyte-scale data warehouse that separates storage and compute, and supports SQL queries with sub-second response times for dashboards via its columnar storage and slot-based execution. It requires no infrastructure management and scales automatically. These characteristics match the stated requirements exactly.

Answer

Cloud SQL

Answer

Cloud Spanner

Answer

Dataflow

Question 12

A company is moving a sensitive database to Cloud SQL. They need to encrypt data at rest using customer-managed encryption keys (CMEK) and rotate the key every 30 days. How should they set this up?

Accepted Answer

Create a key in Cloud KMS, specify it as the CMEK for Cloud SQL, and set rotation period to 30 days. To use CMEK with Cloud SQL, you create a key in Cloud KMS, grant the Cloud SQL service account access, and specify that key as the CMEK for the instance. Setting the key's rotation period to 30 days automates rotation, meeting the requirement without manual intervention. This is the standard, supported configuration.

Answer

Enable encryption by default in Cloud SQL settings

Answer

Use Cloud HSM to generate a key and import it to Cloud SQL

Answer

Create a key in Cloud KMS and manually rotate it each month

Question 13

A company is migrating a legacy monolithic application to Google Cloud. They want to reduce operational overhead while maintaining the ability to run the application without rewriting code. Which migration strategy should they use?

Accepted Answer

Lift and shift (rehosting). Lift and shift (rehosting) moves the application to Google Cloud with minimal or no code changes, which directly satisfies the requirement to avoid rewriting code while reducing the operational burden of running on-premises hardware. It is the fastest migration strategy and preserves the existing monolithic architecture.

Answer

Retiring

Answer

Replatforming (lift, tinker, and shift)

Answer

Refactoring (rearchitecting)

Question 14

A company needs to audit all actions performed by administrators on their Google Cloud project, including who accessed what resource and when. Which logging feature should they enable?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs record all administrative and data access activities in Google Cloud, including who did what, where, and when. They are specifically designed for auditing and compliance, capturing Admin Activity, Data Access, System Event, and Policy Denied logs. Enabling Cloud Audit Logs provides the detailed trail needed to audit administrator actions across the project.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

VPC Flow Logs

Question 15

Which Google Cloud service helps identify and classify sensitive data such as credit card numbers or personal health information in Cloud Storage and BigQuery?

Accepted Answer

Data Loss Prevention (DLP) API. The Data Loss Prevention (DLP) API is specifically designed to discover, classify, and protect sensitive data such as credit card numbers, personal health information, and other PII. It can scan Cloud Storage buckets and BigQuery tables, using built-in infoType detectors to identify and classify sensitive content. This makes it the correct service for the described requirement.

Answer

Security Command Center

Answer

Cloud Data Catalog

Answer

Access Transparency