Cloud Digital Leader Practice Test 49 — 15 Questions

Question 1

Which term describes the model where the cloud provider is responsible for the security of the cloud infrastructure, while the customer is responsible for security within their own cloud environment (data, applications, access management)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security responsibilities between the cloud provider and the customer. Google secures the physical infrastructure, hardware, hypervisor, and core services. The customer secures what they put in the cloud: data classification, access control, application security, network configuration, and compliance. The boundary between provider and customer responsibility varies by service model (IaaS vs. PaaS vs. SaaS).

Answer

Zero trust security model

Answer

Defense in depth strategy

Answer

Identity federation model

Question 2

A retail bank wants to launch new digital banking features quickly to compete with fintech startups while maintaining strict regulatory compliance. Which cloud transformation strategy best addresses both agility and compliance?

Accepted Answer

Implement a cloud-native architecture using GKE, Cloud Build, and Cloud IAM with compliance auditing. It leverages cloud-native services like Google Kubernetes Engine (GKE) for containerized microservices, Cloud Build for CI/CD automation, and Cloud IAM for fine-grained access control, enabling rapid feature deployment while maintaining compliance through integrated audit logging and policy enforcement. This architecture decouples agility from security, allowing the bank to iterate quickly without sacrificing regulatory requirements like PCI-DSS or SOX.

Answer

Move everything to a public cloud without additional access controls to maximize speed

Answer

Use a lift-and-shift migration to cloud VMs and rely on manual change management

Answer

Stick with on-premise systems for compliance and use cloud only for non-sensitive data

Question 3

Match each Google Cloud AI/ML term to its definition.

Accepted Answer

Vertex AI: A unified platform for AI/ML model development and deployment.. Vertex AI is the unified platform; AutoML automates model training; Cloud TPUs accelerate computation. Common confusions include swapping these definitions.

Answer

Vertex AI: A suite of tools to train high-quality models with minimal ML expertise.

Answer

Cloud TPU: A unified platform for AI/ML model development and deployment.

Question 4

An organization runs a multi-region web application behind a global external HTTP(S) load balancer. They want to protect against DDoS attacks and filter traffic based on IP reputation and request headers. Which service should they integrate with the load balancer?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF and DDoS protection, including IP blacklisting/whitelisting, rate limiting, and custom rules. Cloud CDN caches content, Cloud NAT provides outbound connectivity, and VPC Firewall rules are for network-level filtering inside VPC.

Answer

Cloud CDN

Answer

VPC firewall rules

Answer

Cloud NAT

Question 5

A technology company runs its containerized microservices on Google Kubernetes Engine (GKE). The development team frequently pushes new container images to Container Registry, and those images are deployed to a production cluster. The security team recently discovered that a few running containers have critical vulnerabilities from outdated base images. They want to enforce a policy that only vulnerability-scanned and approved images can be deployed in the production cluster. The team uses Cloud Build for CI/CD and Container Analysis for vulnerability scanning. Which solution should they implement to meet this requirement?

Accepted Answer

Enable Binary Authorization with a policy that requires attestations from Container Analysis for all deployments in the production cluster.. Binary Authorization enforces deployment-time policies that require signed attestations from trusted authorities (like Container Analysis) before an image can be deployed on GKE. By configuring a policy that mandates an attestation from Container Analysis (which performs vulnerability scanning), only images that have been scanned and approved can be deployed, directly meeting the requirement to block containers with critical vulnerabilities.

Answer

Use Cloud Security Scanner to scan the production cluster for vulnerabilities.

Answer

Enable Cloud Asset Inventory to monitor image vulnerabilities across projects.

Answer

Configure Cloud Build to run a vulnerability scan step before pushing images to Container Registry.

Question 6

A retail chain with 500 stores wants to implement dynamic pricing — adjusting prices in real-time based on demand signals, competitor pricing, inventory levels, and weather forecasts. This requires processing millions of data points and updating prices across all stores within minutes. Which cloud capabilities make this possible?

Accepted Answer

Real-time stream processing (Pub/Sub + Dataflow) combined with ML model serving (Vertex AI) to ingest signals and compute optimized prices at scale.. It combines real-time stream processing (Pub/Sub for ingesting millions of data points, Dataflow for processing them with low latency) with ML model serving (Vertex AI) to compute optimized prices on the fly. This architecture enables the sub-minute price updates required for dynamic pricing across 500 stores, leveraging Google Cloud's serverless, auto-scaling capabilities.

Answer

A relational database that stores all prices with daily batch updates from a pricing spreadsheet.

Answer

A cloud-hosted ERP system that replaces the on-premises inventory management system.

Answer

A static website hosted on Cloud Storage that displays current prices.

Question 7

What compliance certification verifies that an organization's Information Security Management System (ISMS) meets internationally recognized standards for managing information security risks?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive company information, ensuring it remains secure through risk management processes. This certification is recognized globally and is the primary standard for ISMS compliance.

Answer

SOC 2 Type II

Answer

PCI DSS

Answer

FedRAMP

Question 8

A company wants to run a critical stateful application on Compute Engine with the highest availability. The application requires block storage that can survive a zone failure. Which TWO actions should they take? (Choose TWO)

Accepted Answer

Use regional Persistent Disk. Regional Persistent Disk replicates data across zones synchronously, surviving a zone failure. The instances should be in a regional managed instance group to distribute across zones. Zonal PD and single-zone MIG would not survive zone failure.

Answer

Place instances in a zonal managed instance group

Answer

Enable object versioning on a Cloud Storage bucket

Answer

Use zonal Persistent Disk

Question 9

A data analyst needs to create interactive dashboards and reports from data stored in BigQuery. They want a fully managed business intelligence platform without building custom applications. Which Google Cloud product should they use?

Accepted Answer

Looker (Google Cloud's BI platform). Looker is a BI platform that connects to BigQuery and provides interactive dashboards, reports, and embedded analytics. Looker Studio is a free tool for simple visualizations. Data Studio is the old name. Vertex AI is for ML.

Answer

Looker Studio

Answer

Vertex AI

Answer

Data Studio

Question 10

A developer is deploying a web application on Compute Engine and needs to distribute traffic across multiple VM instances in different regions. They also need SSL termination and health checks. Which Google Cloud networking service should they use?

Accepted Answer

Cloud Load Balancing. Cloud Load Balancing (HTTP(S) Load Balancer) is a global, scalable load balancing service that distributes traffic across instance groups in multiple regions, provides SSL termination, and performs health checks. Cloud CDN is for caching content; Cloud Armor is for security policies; VPC peering connects networks.

Answer

VPC peering

Answer

Cloud Armor

Answer

Cloud CDN

Question 11

A team runs a production Compute Engine instance that has been running for 15 days in a 30-day month. They also have a second instance that runs occasionally for testing. They want to maximize cost savings without committing to a 1-year or 3-year term. Which discount will apply automatically?

Accepted Answer

Sustained use discount (SUD). Sustained use discounts automatically apply to instances that run for more than 25% of a month (i.e., >7.5 days). At 15 days, the instance qualifies for sustained use discounts. Committed use discounts require a pre-purchased commitment.

Answer

Committed use discount (CUD)

Answer

Preemptible VM discount

Answer

No discount applies automatically.

Question 12

A startup is building a mobile app and needs a real-time database that synchronises data across user devices automatically. The data model is document-based, and the app needs offline support. Which database should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database designed for mobile and web apps with real-time synchronization, offline support, and automatic multi-device sync. Cloud SQL is relational and not designed for mobile offline sync. Bigtable is for time-series. Memorystore is a cache.

Answer

Cloud Bigtable

Answer

Cloud SQL

Answer

Memorystore

Question 13

A startup's web application is being targeted by a denial-of-service attack that is flooding its servers with millions of fake requests per second. Which Google Cloud product provides automatic DDoS protection for the application?

Accepted Answer

Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application. Cloud Armor is the correct answer because it is Google Cloud's managed DDoS protection and Web Application Firewall (WAF) service. It uses Google's global infrastructure to absorb and filter volumetric attacks (e.g., SYN floods, UDP reflection attacks) at the edge, before traffic reaches the application. It integrates with Cloud Load Balancing to inspect and drop malicious requests based on pre-configured or adaptive rules.

Answer

Cloud Storage, by distributing the static content of the application across multiple storage regions

Answer

Cloud IAM, by revoking permissions for the IP addresses generating attack traffic

Answer

Cloud Monitoring, by alerting the team so they can manually scale up servers to absorb the attack

Question 14

A company's application traffic is served by a Google Cloud global HTTP load balancer. They want to understand how request traffic distributes across backend instances in different regions. Which metric best represents this distribution?

Accepted Answer

`loadbalancing/https/request_count` filtered by backend service and region.. The `loadbalancing/https/request_count` metric, when filtered by backend service and region, directly shows the number of requests handled by each regional backend. This allows you to see how traffic is distributed across regions, which is exactly what the question asks for.

Answer

`compute/instance/cpu/utilization` per instance group.

Answer

`networking/vm_flow/egress_bytes_count` per VM.

Answer

`logging/log_entry_count` filtered by region.

Question 15

A development team builds a mobile app using Firebase. They need a real-time database that syncs data across all connected clients instantly (e.g., a collaborative to-do app where all users see updates in real-time). Which Firebase/Google Cloud service provides this?

Accepted Answer

Cloud Firestore or Firebase Realtime Database for real-time data sync across all connected clients.. Cloud Firestore and Firebase Realtime Database are the only Firebase/Google Cloud services that provide real-time data synchronization across all connected clients. They use persistent WebSocket connections or HTTP long-polling to push updates instantly to every subscribed client, making them ideal for collaborative apps like a shared to-do list.

Answer

Cloud SQL with read replicas to distribute updates to clients.

Answer

BigQuery streaming inserts for real-time data delivery to mobile clients.

Answer

Cloud Pub/Sub subscriptions on the mobile clients.