Cloud Digital Leader Practice Test 47 — 15 Questions

Question 1

A company wants to store archival data that must be retained for 10 years. The data is accessed less than once a year. Which Cloud Storage class is the most cost-effective?

Accepted Answer

Archive Storage. Archive Storage is the most cost-effective option for data that must be retained for 10 years and is accessed less than once a year. This class offers the lowest storage cost among Google Cloud Storage classes, specifically designed for long-term preservation of data that is rarely accessed, with a minimum storage duration of 365 days and higher retrieval costs that are acceptable given the infrequent access pattern.

Answer

Standard Storage

Answer

Nearline Storage

Answer

Coldline Storage

Question 2

A company wants to connect its on-premises data center to Google Cloud with a reliable, lower-latency connection that doesn't traverse the public internet, but doesn't need the bandwidth of a full Dedicated Interconnect. Which Google Cloud connectivity product is most appropriate?

Accepted Answer

Partner Interconnect, which provides private connectivity through a service provider partner's network — supporting lower bandwidth tiers without requiring a direct physical fiber connection. Partner Interconnect is the correct choice because it provides private connectivity between an on-premises data center and Google Cloud via a service provider partner's network, offering lower bandwidth tiers (e.g., 50 Mbps to 10 Gbps) without requiring a direct physical fiber connection. This meets the requirements for a reliable, lower-latency connection that avoids the public internet, while Dedicated Interconnect would be overkill for bandwidth needs below 10 Gbps.

Answer

Cloud VPN, which creates an encrypted IPsec tunnel over the public internet

Answer

Dedicated Interconnect, which requires provisioning a 10 Gbps or 100 Gbps dedicated physical fiber connection

Answer

Cloud CDN, which caches content at edge locations close to the on-premises data center

Question 3

A security team wants to ensure that only container images built by their approved CI/CD pipeline can run in their GKE cluster. Images built outside the approved process — even by internal engineers — should be blocked. Which Google Cloud security feature enforces this?

Accepted Answer

Binary Authorization — requiring cryptographic attestations for container images before they can be deployed to GKE.. Binary Authorization is the correct answer because it enforces deployment-time policy by requiring that container images have a valid cryptographic attestation (e.g., from a trusted CI/CD pipeline) before they can be scheduled on GKE. This ensures that only images built and signed by the approved process are allowed to run, blocking all others regardless of who built them.

Answer

Cloud Armor — it blocks unauthorized container images at the load balancer.

Answer

Cloud IAM — restricting `container.pods.create` permission to only the CI/CD service account.

Answer

Artifact Registry vulnerability scanning — blocking images with CVEs from being deployed.

Question 4

Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?

Accepted Answer

No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.. Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).

Answer

Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.

Answer

Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.

Answer

Customers must purchase the Security Command Center Premium tier to enable data encryption.

Question 5

According to the NIST definition of cloud computing, which characteristic allows users to unilaterally provision computing resources such as server time and network storage without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the NIST characteristic that allows a consumer to unilaterally provision computing capabilities, such as server time and network storage, automatically without requiring human interaction with each service provider. This is the defining trait that enables users to spin up resources via APIs or portals on demand.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 6

A startup's website becomes unexpectedly popular and traffic spikes 50x within minutes. The application is hosted on Google Cloud. Which Google Cloud product automatically increases the number of application instances in response to this traffic spike without manual intervention?

Accepted Answer

Managed Instance Groups with autoscaling (for VMs) or Cloud Run (for containers), which automatically provision additional instances based on traffic load without manual intervention. Managed Instance Groups (MIGs) with autoscaling and Cloud Run both automatically adjust the number of running instances or container replicas based on real-time metrics like CPU utilization, request rate, or latency. When traffic spikes 50x, the autoscaler detects the increased load and provisions new VMs or container instances without any manual intervention, ensuring the application remains responsive. This is the only option that provides automatic, infrastructure-level scaling in response to load.

Answer

Cloud Monitoring, which detects the traffic spike and sends an alert to the operations team to manually scale up

Answer

Cloud Load Balancing, which distributes traffic evenly across existing instances to handle the spike

Answer

Cloud Billing, which automatically increases the spending limit when traffic spikes occur

Question 7

You are monitoring Compute Engine instances with Cloud Monitoring. You notice that autoscaling is not triggering even though CPU utilization is above 80% for several minutes. The managed instance group has autoscaling based on CPU utilization with a target of 0.8. What is the most likely cause?

Accepted Answer

The maximum number of instances is already reached.. The most likely cause is that the managed instance group has already reached its configured maximum number of instances. When the maximum instance count is hit, the autoscaler cannot add more instances even if CPU utilization exceeds the target of 0.8 (80%). This is a common boundary condition in autoscaling logic where the scaling policy is overridden by the hard limit.

Answer

The autoscaler is disabled.

Answer

The minimum number of instances is set too high.

Answer

The cool-down period is too long.

Question 8

A company wants to store encryption keys for encrypting data at rest in Cloud Storage, and also needs to automatically rotate the keys every 30 days. Additionally, they require an audit log of key usage. Which TWO services should they use? (Choose two.)

Accepted Answer

Cloud KMS. Cloud KMS (C) is correct because it is the Google Cloud service designed to create and manage cryptographic keys used for encrypting data at rest, including Cloud Storage objects via customer-managed encryption keys (CMEK), and it natively supports automatic key rotation schedules (e.g., every 30 days) through rotation periods on key versions. Cloud Audit Logs (D) is correct because it records administrative and data-access activity on Cloud KMS keys, such as Encrypt/Decrypt operations and key rotation events, providing the required audit trail of key usage. Cloud HSM (A) is not the right choice here because it is a hardware security module backing for Cloud KMS keys, not a separate service that provides rotation scheduling or audit logging by itself. Secret Manager (B) stores secrets like passwords and API keys, not encryption keys for data-at-rest encryption with rotation. Cloud Storage (E) is the data store being encrypted, not a key management or auditing service.

Answer

Cloud HSM

Answer

Secret Manager

Answer

Cloud Storage

Question 9

A startup is building a mobile app and needs a real-time database that synchronises data across user devices automatically. The data model is document-based, and the app needs offline support. Which database should they use?

Accepted Answer

Firestore. Firestore is Google Cloud's serverless, document-oriented NoSQL database that provides real-time synchronization across devices via listeners, plus built-in offline persistence for mobile and web SDKs. Its document/collection data model and automatic multi-device sync directly match the startup's requirements.

Answer

Cloud Bigtable

Answer

Cloud SQL

Answer

Memorystore

Question 10

A data analytics company uses BigQuery for large-scale queries. They notice that some queries are very expensive due to scanning large amounts of data. They want to reduce costs without changing query logic. Which feature should they use?

Accepted Answer

Partitioning and clustering tables. Partitioning and clustering tables in BigQuery physically organize data into smaller, manageable segments based on specified columns (e.g., date or timestamp). This allows queries to use partition pruning and clustering-based block pruning to scan only the relevant data, drastically reducing the amount of data processed and thus lowering costs without altering the query logic.

Answer

Query caching

Answer

Authorized views

Answer

Flat-rate pricing with reservations

Question 11

A bank's innovation team proposes building a new digital lending product using cloud services. The risk team objects, citing regulatory concerns about data sovereignty and auditability in cloud environments. What is the most effective way for the innovation team to address these concerns?

Accepted Answer

Demonstrate that Google Cloud provides the specific regulatory controls needed: data residency configuration, comprehensive audit logging, compliance certifications, and contractual frameworks that satisfy the bank's regulatory requirements. Demonstrating that Google Cloud provides the specific regulatory controls needed (B) is correct because it directly addresses the risk team's concerns by showing concrete evidence of data residency, audit logging, compliance certifications, and contractual frameworks. This approach is proactive and collaborative, aligning with regulatory requirements rather than avoiding or ignoring them. It allows the innovation team to proceed with cloud adoption while satisfying the risk team.

Answer

Avoid cloud entirely for the new product and build on-premises to eliminate regulatory concerns

Answer

Ignore the risk team's concerns and proceed with cloud development, as regulators have approved cloud for all banking applications globally

Answer

Commission a multi-year study to determine whether cloud regulation will change before proceeding

Question 12

A company's employees use Google Workspace for email, documents, and collaboration. The IT team wants to require all employees to use a physical security key (like a YubiKey) as their second authentication factor when signing in — eliminating phishing-vulnerable SMS and authenticator app codes. Which Google Workspace security capability supports this requirement?

Accepted Answer

Google Workspace 2-Step Verification policy configured to require hardware security keys (FIDO2/WebAuthn) for all employees, making it impossible to sign in without a physical key. Google Workspace's 2-Step Verification policy allows administrators to enforce the use of hardware security keys (FIDO2/WebAuthn) as the sole second factor. This policy can be configured to require a physical security key for all employees, effectively blocking sign-ins that use SMS or authenticator app codes, which are vulnerable to phishing. The policy directly meets the IT team's requirement to eliminate phishing-vulnerable authentication methods.

Answer

Google Workspace Advanced Protection Program, which enforces hardware security key requirements for high-risk users

Answer

Google Cloud Identity-Aware Proxy, which enforces hardware key authentication for all Google Workspace apps

Answer

Cloud Armor, which blocks sign-in attempts that don't come from corporate IP addresses, eliminating the need for 2FA

Question 13

A software team is using Google Cloud and wants to understand the difference between 'scaling up' (vertical scaling) and 'scaling out' (horizontal scaling) for their web application. Which description correctly distinguishes these two approaches?

Accepted Answer

Vertical scaling (scaling up) increases the resources of an individual server (more CPU, RAM), while horizontal scaling (scaling out) adds more servers to distribute load — horizontal scaling is generally preferred in cloud environments for its flexibility and lack of a ceiling. Ly distinguishes vertical scaling (scaling up) as increasing the resources (CPU, RAM) of an existing server, and horizontal scaling (scaling out) as adding more servers to distribute the load. In cloud environments like Google Cloud, horizontal scaling is generally preferred because it offers near-infinite scalability, better fault tolerance, and no single point of failure, unlike vertical scaling which has a hardware ceiling and can cause downtime during upgrades.

Answer

Scaling up adds more servers to handle increased load; scaling out makes each server more powerful by adding CPU and RAM

Answer

Both scaling up and scaling out describe the same approach — adding more cloud resources to handle increased demand

Answer

Scaling up is only possible in cloud environments; on-premises systems can only scale out

Question 14

An organization's Chief Digital Officer is building a case for cloud investment by framing it in terms of 'cloud as a strategic asset rather than a cost center.' Which argument most strongly supports this framing?

Accepted Answer

Cloud enables new revenue streams, faster product launches, data-driven competitive differentiation, and innovation capabilities that directly drive business growth — making cloud investment as strategic as R&D or customer acquisition. It directly aligns with the framing of 'cloud as a strategic asset' by highlighting how cloud computing enables new revenue streams, faster product launches, data-driven differentiation, and innovation — all of which drive business growth. This contrasts with viewing cloud purely as a cost center, as it emphasizes competitive advantage and long-term value creation, similar to R&D or customer acquisition investments.

Answer

Cloud reduces data center costs, making IT a more efficient cost center rather than a business liability

Answer

Cloud is always less expensive than on-premises, so it should be viewed as a cost-savings program rather than a strategic investment

Answer

Cloud providers assume liability for all security breaches, making cloud a risk-reduction tool rather than a strategic enabler

Question 15

A company's cloud costs have grown faster than its business. The FinOps team is implementing cloud cost governance. Which practice most effectively ensures that individual teams are accountable for their cloud spending?

Accepted Answer

Implementing consistent resource labeling and chargeback reporting so each team's cloud spending is visible and attributed to them. Implementing consistent resource labeling and chargeback reporting directly enables cost attribution to individual teams. In Google Cloud, labels are key-value pairs attached to resources, and when combined with billing export to BigQuery, they allow granular cost breakdowns per team. This creates clear accountability by making each team's spending visible and chargeable back to their budget, which is the core principle of cloud cost governance.

Answer

Requiring all teams to use only the cheapest available cloud service options regardless of technical requirements

Answer

Consolidating all cloud accounts under a single centralized IT team that controls all cloud resource creation

Answer

Disabling all non-production environments to eliminate spending outside of production