Cloud Digital Leader Practice Test 47 — 15 Questions

Question 1

A company wants to protect its web application deployed on Google Cloud from OWASP Top 10 attacks and also block traffic from specific geographic regions. Which TWO services should they use together? (Choose 2)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud CDN. Cloud Armor provides WAF rules for OWASP Top 10 and geo-blocking. Cloud CDN caches content and can be used with Cloud Armor for edge protection.

Answer

Cloud Load Balancing

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 2

An engineer needs to prevent data exfiltration from a project by ensuring that Cloud Storage buckets can only be accessed from within a VPC network. Which TWO steps should they take? (Choose 2)

Accepted Answer

Set an ingress policy to allow access only from the VPC network. Create a VPC Service Controls perimeter that includes the project and restricts access to the VPC, and set ingress rules to allow traffic from the VPC.

Answer

Use IAM conditions to restrict access to the VPC

Answer

Enable Private Google Access on the VPC subnets

Answer

Create a firewall rule that denies all traffic to Cloud Storage

Question 3

A security team needs to monitor and analyze logs from multiple GCP projects to detect threats across the organization. They require a SIEM solution that can ingest logs from on-premises and other clouds. Which service should they use?

Accepted Answer

Chronicle. Chronicle is a Google Cloud SIEM that ingests logs from various sources, including on-premises and other clouds, and provides threat detection. Security Command Center is for vulnerability scanning, not SIEM.

Answer

Security Command Center

Answer

Cloud IDS

Answer

Cloud Logging

Question 4

An engineer wants to export billing cost data to BigQuery for custom reporting. They have created a BigQuery dataset and linked it to the billing account. However, the billing export tables are not being populated. What is the most likely cause?

Accepted Answer

The BigQuery dataset is in a different location from the billing account's default region. Billing export to BigQuery requires the billing account to be linked to a project that contains the dataset, and the dataset must be in the same location (e.g., US or EU) as the billing account's default region.

Answer

The billing export has not been enabled in the Cloud Console

Answer

The engineer does not have the Billing Administrator IAM role

Answer

The billing account is not linked to the project containing the BigQuery dataset

Question 5

A company runs Compute Engine instances for batch processing that are shut down on weekends. They want to automatically reduce costs without committing to a 1-year or 3-year term. Which discount type applies?

Accepted Answer

Sustained use discount. Sustained use discounts automatically apply for instances running more than 25% of a month, with no upfront commitment.

Answer

Sole-tenant node discounts

Answer

Preemptible VM discounts

Answer

Committed use discount

Question 6

A company wants to ensure data encryption at rest using customer-managed keys for Cloud SQL and Cloud Storage. Which TWO actions must they take? (Choose 2)

Accepted Answer

Create a key ring and cryptographic key in Cloud KMS. Create a key ring and key in Cloud KMS, then configure each service to use that key (CMEK).

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the service accounts

Answer

Enable CMEK in the project settings

Answer

Upload a custom key to Cloud HSM

Question 7

An organization wants to detect and respond to threats across their GCP environment, including finding misconfigurations, vulnerabilities, and potential malicious activity. Which service provides a unified view of security findings?

Accepted Answer

Security Command Center. Security Command Center is a central dashboard for security findings including vulnerabilities, misconfigurations, and threats.

Answer

Mandiant

Answer

Chronicle

Answer

Cloud Audit Logs

Question 8

An organization needs to protect a web application hosted on Google Cloud from DDoS attacks and SQL injection attempts. They want a managed security service that integrates with Cloud Load Balancing. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's managed DDoS protection and Web Application Firewall (WAF) service. It integrates with Cloud Load Balancing to filter traffic based on IP, geo, and HTTP headers, and includes preconfigured rules (e.g., OWASP) to block SQL injection. Cloud IDS is for network intrusion detection. reCAPTCHA Enterprise is for bot detection. VPC firewall rules are for network-level access control.

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Answer

VPC firewall rules

Question 9

A company wants to ensure that its Google Cloud resources can only be accessed from within a specific VPC network, preventing data exfiltration to the internet. They need to enforce this for Cloud Storage and BigQuery APIs. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create perimeters around managed services to restrict access to only allowed VPC networks.

Answer

Cloud NAT

Answer

VPC Firewall Rules

Answer

Private Google Access

Question 10

An organization has a compliance requirement to run workloads in specific geographic regions only. They want to prevent any resources from being created outside those regions. Which Google Cloud control should they use?

Accepted Answer

Organization policy with location restriction. Organization policies with location restrictions allow administrators to set constraints on where resources can be created. The constraint `gcp.resourceLocations` can be used to restrict allowed regions. IAM roles control who can create resources, but not where. VPC Service Controls restrict data access, not resource creation location. Cloud Audit Logs only record actions.

Answer

Cloud Audit Logs

Answer

VPC Service Controls

Answer

IAM conditions with resource location

Question 11

A developer wants to trigger a serverless function in response to a file being uploaded to a Cloud Storage bucket. Which Google Cloud service should they use?

Accepted Answer

Cloud Functions. Cloud Functions is an event-driven serverless compute service that can be triggered by Cloud Storage events (e.g., object finalize).

Answer

Compute Engine

Answer

Cloud Run

Answer

App Engine

Question 12

A business analyst needs to understand why cloud services bill differently for compute (VMs) versus object storage. Compute VMs are billed per second while they are running; Cloud Storage is billed per GB-month of data stored. Which cloud pricing principle explains why these billing units are different?

Accepted Answer

Cloud resources are billed based on their natural unit of consumption: compute time for VMs (per second running) and data volume over time for storage (per GB-month) — matching billing to how each resource is actually consumed. Cloud providers align billing units with the natural consumption pattern of each resource. Compute VMs consume CPU and memory continuously while running, making per-second billing the most granular and fair measure of actual usage. Object storage, by contrast, incurs cost primarily from the capacity occupied over time, so billing per GB-month directly reflects the resource's persistent footprint. This principle ensures customers pay only for what they use, in the unit that matches the resource's operational behavior.

Answer

Cloud providers bill different resources differently to maximize revenue by charging the highest rates for the most-used services

Answer

Storage is charged per GB-month because cloud providers cannot measure storage usage per second accurately

Answer

The billing difference is a temporary situation; cloud providers are working toward a single universal billing unit for all services

Question 13

A company wants to enforce that all Cloud Storage buckets in a project have uniform bucket-level access enabled. Which Google Cloud tool should they use?

Accepted Answer

Define an Organization Policy with a constraint on uniform bucket-level access.. Organization Policies in Google Cloud allow administrators to enforce constraints across the entire resource hierarchy. The constraint `constraints/storage.uniformBucketLevelAccess` can be applied at the project, folder, or organization level to require uniform bucket-level access on all Cloud Storage buckets, preventing any bucket from being created or updated without it.

Answer

Use Cloud Audit Logs to monitor and alert on non-compliant buckets.

Answer

Set an IAM policy to deny access to buckets without uniform access.

Answer

Use Cloud Key Management Service to rotate keys.

Question 14

A multinational corporation uses Cloud Identity-Aware Proxy (IAP) to secure access to applications. They notice that some users outside the corporate network can still reach the applications. What is the most likely misconfiguration?

Accepted Answer

IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.. Setting IAP to 'allUsers' allows unauthenticated access from any user on the internet, bypassing IAP's authentication and authorization checks. IAP should be configured with 'allAuthenticatedUsers' or a more specific set of principals to enforce identity verification before granting access to the application.

Answer

The firewall rules allow ingress from 0.0.0.0/0.

Answer

IAP is not enabled on the backend service.

Answer

The OAuth 2.0 client ID is misconfigured.

Question 15

A global e-commerce company wants to serve its website from Google Cloud with low latency to users worldwide. The website consists of static content (images, CSS) and dynamic content served by a backend application. Which combination of services should they use?

Accepted Answer

Cloud Storage with Cloud CDN for static content, and Compute Engine instances behind Cloud Load Balancing for dynamic content. Cloud CDN caches static content at edge locations (PoPs) for low-latency delivery. Cloud Load Balancing distributes traffic across backend instances in multiple regions, and the backend can be deployed on Compute Engine or GKE. Cloud Storage alone cannot serve dynamic content; Cloud Functions is serverless but not ideal for full web serving; Cloud Armor is a security service.

Answer

Compute Engine with Cloud Armor

Answer

Cloud Functions for all content

Answer

Cloud Storage only