Cloud Digital Leader Practice Test 48 — 15 Questions

Question 1

A company uses Google Cloud across 5 teams, 20 projects, and 3 regions. They want to enforce a standard that all resources include specific labels (e.g., `team`, `environment`, `cost-center`) for cost attribution and governance. What is the most scalable way to enforce this labeling standard?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforce labeling through IaC templates with required label variables in CI/CD pipelines, and use Cloud Asset Inventory to audit compliance.. It combines Infrastructure as Code (IaC) templates with required label variables in CI/CD pipelines to enforce labeling at resource creation time, and uses Cloud Asset Inventory to audit and detect non-compliant resources. This approach is scalable across 5 teams, 20 projects, and 3 regions because it automates enforcement and provides continuous compliance monitoring without manual intervention.

Answer

Send monthly reminders to all teams via email to add labels to their resources.

Answer

Manually add labels to all existing and new resources through the Cloud Console.

Answer

Grant only project owners permission to create resources, and rely on them to enforce labeling.

Question 2

Which TWO statements about Cloud Identity-Aware Proxy (IAP) are correct?

Accepted Answer

IAP can be used to protect access to Compute Engine VMs via SSH and RDP without a VPN. Cloud IAP enables identity-based access to Compute Engine instances via SSH and RDP without requiring a VPN or bastion host. IAP uses the user's identity and request context to create a secure tunnel, forwarding traffic to the instance over HTTPS and verifying the user's credentials before allowing the connection.

Answer

IAP encrypts data at rest by default

Answer

IAP only works with Google Cloud applications

Answer

IAP requires using a third-party identity provider

Question 3

Two competing retail companies adopt cloud at the same time. Company A uses cloud to run its existing applications more cheaply (lift-and-shift). Company B uses cloud to build new personalized customer experiences, real-time inventory optimization, and a mobile-first shopping platform. Five years later, Company B significantly outperforms Company A. What does this outcome illustrate?

Accepted Answer

Cloud adoption creates competitive advantage only when used to transform business models and customer experiences, not just to reduce infrastructure costs. Company B used cloud as a platform for innovation—building new personalized experiences, real-time inventory optimization, and a mobile-first platform—which transformed its business model and customer engagement. Company A merely replicated its existing applications in the cloud (lift-and-shift) to cut costs, without changing how it creates value. The outcome illustrates that cloud's competitive advantage comes from enabling business transformation, not from infrastructure cost savings alone. This aligns with the core cloud value proposition: agility, speed of innovation, and the ability to rapidly experiment and scale new services.

Answer

Company B must have spent more on cloud than Company A, proving that higher cloud investment always produces better outcomes

Answer

Company A made a mistake by moving to cloud; it should have stayed on-premises to avoid disruption

Answer

Company B succeeded because it used a different cloud provider with superior technology

Question 4

A large hospital network wants to move patient records to the cloud and enable doctors to access records from any device. The Chief Medical Officer is supportive, but the legal department raises data privacy concerns, and the IT department fears job losses. Which aspect of digital transformation does this scenario highlight?

Accepted Answer

Digital transformation requires aligning technology with people and culture — managing stakeholder concerns and change resistance is often harder than the technical migration.. Digital transformation is not solely about technology adoption; it critically involves managing the human and cultural aspects of change. In this scenario, the legal department's privacy concerns and the IT department's fear of job losses represent stakeholder resistance that must be addressed through communication, retraining, and policy alignment. Successful cloud migration in healthcare requires balancing technical migration with change management to ensure adoption and compliance.

Answer

The primary challenge is selecting the correct cloud database for patient records.

Answer

The hospital should delay cloud adoption until quantum computing makes it more secure.

Answer

The legal department's concerns prove that healthcare organizations cannot use public cloud.

Question 5

A data analytics firm wants to query data across Cloud Storage and BigQuery without moving the data. They need a single SQL interface. Which Google Cloud service enables this?

Accepted Answer

BigQuery external tables (federated queries). BigQuery external tables (federated queries) allow SQL queries directly against data stored in Cloud Storage (CSV, JSON, Parquet, Avro, ORC) without loading it into BigQuery. This provides a single SQL interface across both native BigQuery tables and external data sources, satisfying the requirement to query without moving data.

Answer

Dataproc with Spark SQL

Answer

Cloud SQL federated queries

Answer

BigQuery Omni

Question 6

Which term describes a physical or conceptual object (like a factory machine, building, or supply chain) that is represented as a digital model in the cloud, allowing simulation and analysis without touching the physical object?

Accepted Answer

Digital twin — a real-time digital model of a physical object or system updated by sensor data.. A digital twin is a virtual representation of a physical object or system—such as a factory machine, building, or supply chain—that is continuously updated with real-time sensor data. This model lives in the cloud, enabling simulation, monitoring, and analysis without needing to interact with the physical asset. The key differentiator is the bidirectional data flow between the physical and digital worlds, which allows predictive maintenance and optimization.

Answer

Virtual machine — a software-based simulation of a computer.

Answer

Container — a lightweight application packaging format.

Answer

Microservice — a small, independently deployable application component.

Question 7

What is 'infrastructure as code' (IaC), and what problem does it solve compared to manually configuring cloud resources through a web console?

Accepted Answer

IaC defines infrastructure in version-controlled code files, enabling reproducible, automated, and consistent environment provisioning versus error-prone manual console configuration.. Infrastructure as Code (IaC) is the practice of managing and provisioning cloud resources through machine-readable definition files (e.g., YAML, JSON, HCL) rather than through manual processes like clicking in a web console. The core problem it solves is eliminating the error-prone, inconsistent, and non-reproducible nature of manual configuration by enabling version-controlled, automated, and repeatable deployments. Tools like Terraform, AWS CloudFormation, and Azure Resource Manager (ARM) templates are common IaC implementations that enforce desired state configuration and drift detection.

Answer

IaC is a programming language specifically for writing cloud applications.

Answer

IaC is a tool that automatically discovers and documents existing cloud infrastructure.

Answer

IaC requires writing custom Python scripts for every cloud resource type.

Question 8

A cloud architect is reviewing logs from a production incident. She wants to search all log entries across multiple Google Cloud projects for error messages containing a specific string. Which Google Cloud product enables centralized log searching and analysis across an entire organization?

Accepted Answer

Cloud Logging, which centralizes logs from all Google Cloud services and projects and supports powerful filtering and search queries across an organization. Cloud Logging (formerly Stackdriver Logging) is the Google Cloud service designed to ingest, store, and analyze log data from all Google Cloud services and projects. It supports centralized log aggregation across an entire organization via aggregated sinks and the Logs Explorer, enabling powerful filtering and search queries (e.g., using the `textPayload` or `jsonPayload` fields) to find specific error strings across multiple projects without needing to export data elsewhere.

Answer

Cloud Monitoring, which provides metric dashboards and alerting

Answer

BigQuery, by exporting logs to a dataset and running SQL queries to find matching error entries

Answer

Cloud Trace, which provides distributed request tracing for latency analysis

Question 9

A company is evaluating whether to adopt a multi-cloud strategy (using two or more cloud providers for different workloads). An engineer lists the following arguments: (1) resilience against a single cloud provider outage, (2) negotiating leverage on pricing, (3) using best-of-breed services from each provider. A cloud architect cautions that multi-cloud also introduces significant challenges. What is the most significant operational challenge of a multi-cloud approach?

Accepted Answer

Significantly increased operational complexity: teams need expertise in multiple providers' tools, security models, and APIs, while governance, monitoring, and cost management must span inconsistent environments. Multi-cloud environments inherently increase operational complexity. Teams must master distinct APIs, security models (e.g., IAM policies differ between AWS and GCP), monitoring tools (e.g., CloudWatch vs. Cloud Monitoring), and cost management consoles. Governance and compliance must be enforced consistently across heterogeneous platforms, which often requires custom tooling or third-party solutions, making day-to-day operations significantly more challenging than a single-cloud approach.

Answer

Multi-cloud requires purchasing separate hardware for each cloud provider's environment

Answer

Cloud providers refuse to allow customers to use competing providers simultaneously

Answer

Multi-cloud makes it impossible to use any managed services because applications must be portable across providers

Question 10

A company runs a multi-tenant SaaS application on Google Cloud where each customer's data must be strictly isolated from other customers'. A security architect is evaluating approaches: (A) logical isolation using application-level tenant IDs in a shared database, (B) IAM-based separation using separate service accounts per tenant, or (C) infrastructure-level isolation with separate Google Cloud projects per tenant. Which approach provides the strongest isolation guarantee?

Accepted Answer

Separate Google Cloud projects per tenant, which provides the strongest isolation: separate IAM boundaries, separate resource namespaces, separate audit logs, and no shared database instances with other tenants. Separate Google Cloud projects provide the strongest isolation guarantee by creating independent IAM boundaries, resource namespaces, audit logs, and network configurations. This approach ensures that no shared database instances or other resources exist between tenants, eliminating any risk of cross-tenant data leakage through application bugs or misconfigurations. In contrast, logical isolation (A) relies on application-level tenant IDs which can be bypassed by software vulnerabilities, and IAM-based separation (C) still shares the underlying project infrastructure, including the same database and network.

Answer

Logical isolation using application-level tenant IDs, because it is the most cost-efficient and sufficient for regulated workloads

Answer

IAM-based separation using separate service accounts per tenant within a shared project, because IAM provides cryptographically enforced access control

Answer

All three approaches provide equivalent isolation because Google Cloud's hypervisor ensures complete tenant separation at the hardware level

Question 11

A company's analytics team wants to enable business users to create their own reports and dashboards from a governed set of BigQuery data, without writing SQL. At the same time, the data engineering team must maintain centralized control over how key metrics (like 'revenue' or 'active users') are defined. Which Google Cloud product architecture best meets both requirements?

Accepted Answer

Looker with LookML semantic layer: data engineers centrally govern metric definitions in LookML, business users create self-service reports through Looker's interface using those governed definitions — no SQL required. Looker with LookML provides a semantic layer where data engineers centrally define governed metric definitions (e.g., 'revenue' as SUM(price * quantity) with specific filters). Business users can then create self-service reports and dashboards via Looker's drag-and-drop interface without writing SQL, ensuring consistency and control over key metrics.

Answer

Looker Studio connected directly to BigQuery, allowing each business user to create their own metric definitions

Answer

Sharing BigQuery query templates with business users and training them to modify them for their reports

Answer

Building a custom web application that wraps BigQuery APIs and presents data to business users

Question 12

A company wants to protect its web application running on Google Cloud from DDoS attacks and SQL injection. Which service should they use?

Accepted Answer

Cloud Armor. Google Cloud Armor is the edge security service that provides DDoS protection and WAF capabilities, including preconfigured rules for SQL injection (SQLi) and cross-site scripting (XSS). It attaches to HTTP(S) load balancers to filter malicious traffic before it reaches the application.

Answer

reCAPTCHA Enterprise

Answer

Cloud CDN

Answer

VPC firewall rules

Question 13

A small startup wants to protect its web application from common attacks like SQL injection and cross-site scripting (XSS). They also need DDoS protection. Which Google Cloud security service should they use?

Accepted Answer

Cloud Armor. Google Cloud Armor is a web application firewall (WAF) and DDoS protection service that filters HTTP(S) traffic at the edge of Google's network. It provides preconfigured WAF rules to block OWASP Top 10 attacks such as SQL injection and XSS, and it includes built-in DDoS protection for external HTTP(S) load balancers. For a small startup needing both WAF and DDoS protection in one service, Cloud Armor is the correct choice.

Answer

Security Command Center

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 14

A company wants to enforce the principle of least privilege by granting a service account only the permissions necessary to publish messages to a specific Pub/Sub topic. Which IAM approach should they use?

Accepted Answer

Grant the roles/pubsub.publisher role to the service account at the topic level. To enforce least privilege for a service account that only needs to publish to a specific Pub/Sub topic, you should grant the roles/pubsub.publisher role at the topic level. This scopes the permission to that single topic, preventing the service account from publishing to other topics or accessing other resources. This is the most granular and least-privilege approach.

Answer

Grant the roles/editor role to the service account at the project level

Answer

Grant the roles/pubsub.subscriber role to the service account at the topic level

Answer

Grant the roles/pubsub.publisher role to the service account at the project level

Question 15

What is a key benefit of using a Platform as a Service (PaaS) offering like App Engine compared to Infrastructure as a Service (IaaS) like Compute Engine?

Accepted Answer

No need to manage the underlying OS or runtime environment. PaaS platforms like App Engine abstract away the operating system, runtime patches, scaling, and infrastructure management, so developers only ship application code. IaaS like Compute Engine gives you a VM where you remain responsible for OS patching, runtime installation, and capacity planning. The core PaaS benefit is therefore the elimination of OS/runtime management overhead.

Answer

Lower cost for always-on workloads

Answer

Full control over the operating system and hardware

Answer

Ability to install custom software on the server