Cloud Digital Leader Practice Test 49 — 15 Questions

Question 1

A data analytics team processes large datasets using Apache Spark. They want a fully managed service that allows them to run Spark jobs without provisioning clusters. Which Google Cloud service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dataproc. Dataproc is Google Cloud's fully managed Apache Spark and Hadoop service, letting teams submit Spark jobs to ephemeral or long-running clusters without provisioning infrastructure themselves. It supports Spark, Spark SQL, PySpark, Hive, and Pig, and integrates with Cloud Storage and BigQuery as data sources. That matches the requirement exactly.

Answer

BigQuery

Answer

Dataflow

Answer

Cloud Dataprep

Question 2

A company has a fixed budget for GCP and wants to prevent any cost overrun by automatically disabling all resources when the monthly budget is exceeded. Which approach should they use?

Accepted Answer

Create a Cloud Function triggered by a budget alert Pub/Sub message to stop resources.. GCP budget alerts only notify; they cannot directly disable resources. To automatically stop resources when a budget is exceeded, you route the budget's Pub/Sub notification to a Cloud Function that executes the shutdown logic, which is the documented pattern for automated cost control.

Answer

Use the Cost Management dashboard to manually stop resources.

Answer

Use Active Assist to automatically stop idle resources.

Answer

Set up a budget alert with the 'disable resource' action.

Question 3

An organization wants to tag resources with key-value metadata for cost allocation purposes (e.g., team: marketing, environment: prod). Which feature should be used?

Accepted Answer

Labels. In Google Cloud, Labels are the key-value pairs attached to resources specifically for metadata such as cost allocation, ownership, and environment. They are the supported mechanism for grouping and filtering resources in billing reports (e.g., by team or environment), which matches the requirement exactly.

Answer

Organization policy constraints

Answer

IAM custom roles

Answer

Tags (network tags)

Question 4

What is the primary purpose of Google Cloud Armor?

Accepted Answer

To protect applications from DDoS attacks and application-level threats. Google Cloud Armor is a security service that provides DDoS protection and WAF capabilities for applications behind Google Cloud load balancers. It filters malicious traffic at the edge, protecting against Layer 3/4 DDoS and Layer 7 application attacks like SQL injection and XSS. It is the primary tool for edge security in GCP.

Answer

To accelerate content delivery globally

Answer

To provide outbound internet connectivity to private instances

Answer

To manage virtual private cloud networking

Question 5

A multinational corporation wants to serve content to users worldwide with low latency. They plan to use Google Cloud's content delivery network and points of presence. Which cloud benefit enables this?

Accepted Answer

Global reach. Global reach is the correct benefit because Google Cloud's CDN and global points of presence (PoPs) place content close to users worldwide, reducing latency by serving from edge locations. This directly enables low-latency content delivery across multiple continents. Cost optimisation, scalability, and agility are valid cloud benefits but do not specifically describe the geographic distribution enabled by CDN PoPs.

Answer

Cost optimisation

Answer

Scalability

Answer

Agility

Question 6

What is a key business benefit of moving from a capital expenditure (CapEx) model for IT infrastructure to an operational expenditure (OpEx) model like pay-as-you-go cloud computing?

Accepted Answer

Improved cash flow by avoiding large upfront hardware purchases. The key business benefit of moving from CapEx to OpEx is improved cash flow because the organization avoids large upfront hardware purchases and instead pays only for what it consumes. This shifts spending from a capital budget to an operating budget, making costs variable and predictable. Eliminating IT staff, reducing software licenses, and guaranteeing performance are not inherent outcomes of the OpEx model.

Answer

Elimination of all IT staff

Answer

Reduced need for software licenses

Answer

Guaranteed performance improvement

Question 7

A company has applied a deny organization policy at the folder level that prevents the use of certain machine series. An IAM policy at the project level grants a user the role of compute.instanceAdmin. The user attempts to create a VM using a denied machine series. What will happen?

Accepted Answer

The VM creation is blocked by the deny policy at the folder level.. Organization policies in GCP are enforced hierarchically and act as guardrails independent of IAM. A deny policy applied at the folder level is inherited by all projects beneath it and blocks the denied action regardless of what IAM roles the user holds. Because the machine series is denied at the folder, the compute.instanceAdmin role at the project cannot override it, so VM creation fails.

Answer

The user is prompted to request a quota increase.

Answer

The VM is created successfully because the IAM policy allows it.

Answer

The deny policy is overridden by the project-level IAM policy.

Question 8

A company needs to set a budget for their GCP project and receive notifications when spending reaches 50%, 90%, and 100% of the budget. Which action should they take?

Accepted Answer

Configure a budget alert in Cloud Billing with threshold rules at 50%, 90%, and 100%.. The correct action is to configure a budget alert in Cloud Billing with threshold rules at 50%, 90%, and 100%. Budget alerts in GCP allow you to set multiple thresholds on a budget, and when spending reaches each threshold, notifications are sent via email or Pub/Sub. This directly meets the requirement of receiving notifications at specific percentages of the budget.

Answer

Enable Committed Use Discounts to reduce costs.

Answer

Set up billing export to BigQuery with scheduled queries.

Answer

Use Active Assist to set cost thresholds.

Question 9

Which Google Cloud resource serves as the root node in the resource hierarchy and is linked to a Google Workspace or Cloud Identity account?

Accepted Answer

Organization node. The Organization node is the root node in the Google Cloud resource hierarchy and is automatically created when a Google Workspace or Cloud Identity account is linked to Google Cloud. It sits above folders and projects, and serves as the root for applying organization-level IAM policies and constraints.

Answer

Billing account

Answer

Folder

Answer

Project

Question 10

Which statement best describes the shared responsibility model in Google Cloud?

Accepted Answer

Google is responsible for security of the infrastructure; customers are responsible for their data and configurations.. The Google Cloud shared responsibility model divides security duties: Google secures the underlying infrastructure (physical data centers, hardware, network, hypervisor), while customers are responsible for securing what they put in the cloud — their data, configurations, access controls, and application-level security. Option A accurately captures this division.

Answer

Google is responsible for all security aspects, including customer data.

Answer

Customers are responsible for physical security of data centers.

Answer

Security is entirely the customer's responsibility in IaaS.

Question 11

A company wants to reduce costs for their long-running Compute Engine instances by committing to a 1-year term. Which type of discount should they use?

Accepted Answer

Committed use discount. Committed use discounts (CUDs) are the correct choice for reducing costs on long-running Compute Engine instances by committing to a 1-year term. CUDs provide up to 57% discount for a 1-year commitment and up to 70% for a 3-year commitment, in exchange for a commitment to a certain amount of vCPU and memory usage in a specific region.

Answer

Sole-tenant node discount

Answer

Preemptible VM discount

Answer

Sustained use discount

Question 12

A company wants to implement a serverless event-driven architecture where object uploads to Cloud Storage trigger a function that processes the file and stores results in Firestore. The function needs to be written in Python. Which three Google Cloud services are required?

Accepted Answer

Cloud Functions. Cloud Functions (B) is correct because it is the serverless compute service that runs the Python function in response to the event, and it natively supports Python runtimes. Cloud Storage (D) is correct because it is the source of the event: object uploads (finalize events) to a bucket trigger the function, typically via an Eventarc or Cloud Storage trigger. Firestore (E) is correct because it is the destination datastore where the function writes the processing results, as required by the scenario. Pub/Sub (A) is not required because Cloud Storage events can trigger Cloud Functions directly without an explicit Pub/Sub topic, and Cloud Build (C) is a CI/CD service for building and deploying code, not a runtime component of this event-driven flow.

Answer

Pub/Sub

Answer

Cloud Build

Question 13

An organization wants to achieve a zero-trust security model on Google Cloud. Which TWO Google Cloud security capabilities support this goal? (Choose TWO.)

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise (B) is correct because it is Google Cloud's zero-trust access platform, enforcing identity- and context-aware access to applications and resources without relying on a traditional VPN or network perimeter. IAM (E) is correct because it provides fine-grained, identity-based authentication and authorization for Google Cloud resources, which is a foundational pillar of zero-trust ('never trust, always verify'). VPC firewalls (A) are network-perimeter controls based on IP ranges and tags, not identity, so they do not embody zero-trust principles. Cloud Armor (C) is an edge WAF/DDoS protection service that filters HTTP(S) traffic but does not implement zero-trust identity verification. Cloud KMS (D) manages encryption keys and supports data protection, but key management alone does not establish zero-trust access control.

Answer

VPC firewalls

Answer

Cloud Armor

Answer

Cloud Key Management Service (KMS)

Question 14

A company is evaluating total cost of ownership (TCO) for migrating a legacy application to Google Cloud. Which cost should they include in the cloud TCO calculation that is often overlooked?

Accepted Answer

Data egress fees. Data egress fees — the cost of moving data out of Google Cloud — are frequently overlooked in TCO calculations because teams focus on compute and storage pricing. For legacy applications that regularly transfer data to on-premises systems or other clouds, egress charges can accumulate significantly and materially affect the total cost of ownership.

Answer

Software licensing for operating systems

Answer

Cost of physical security for data centers

Answer

Cost of electricity for servers

Question 15

A company is building a data pipeline that ingests events from multiple sources, processes them in real-time, and stores the results in a data warehouse for analysis. They need a fully managed, serverless solution for stream processing. Which THREE Google Cloud services should they use?

Accepted Answer

Pub/Sub. Pub/Sub (B) is correct because it is the fully managed, serverless messaging service used to ingest events from multiple sources into the pipeline with at-least-once delivery and automatic scaling. Dataflow (C) is correct because it provides fully managed, serverless stream processing with Apache Beam, handling real-time transformations, windowing, and exactly-once processing. BigQuery (E) is correct because it is the serverless data warehouse where the processed results are stored for analysis via SQL. Dataproc (A) is not appropriate because it is a managed Hadoop/Spark service requiring cluster provisioning, not serverless stream processing. Cloud Functions (D) is event-driven compute for lightweight functions, not a stream-processing engine for continuous pipelines.

Answer

Dataproc

Answer

Cloud Functions