Cloud Digital Leader Practice Test 5 — 10 Questions

Question 1

A company exports all their Google Cloud logs to Cloud Storage for long-term retention required by their compliance policy (7-year log retention). Which Cloud Logging feature enables routing logs to Cloud Storage?

Accepted Answer

Configure a Cloud Logging sink (log router) that routes logs to a Cloud Storage bucket.. Cloud Logging uses sinks (log routers) to export logs to supported destinations, including Cloud Storage. A sink defines a filter and a destination; when configured, it routes matching log entries to the specified Cloud Storage bucket for long-term retention. This is the only native mechanism for continuous, automated log export without custom scripting.

Answer

Cloud Logging automatically archives all logs to Cloud Storage with no configuration needed.

Answer

Enable log streaming in Cloud Storage settings to receive logs from Cloud Logging.

Answer

Use the Cloud Logging API to periodically download logs and upload them to Cloud Storage.

Question 2

A company's monolithic application is difficult to update because any change requires testing and redeploying the entire application, causing multi-hour downtime during updates. The team is considering a microservices architecture. What is the primary benefit of microservices in this context?

Accepted Answer

Each service can be updated and deployed independently, enabling teams to release changes faster with lower risk and without full-application downtime.. Microservices architecture decomposes a monolithic application into small, independently deployable services. Each service can be updated, scaled, and deployed without affecting other services. This eliminates the 'entire-application-redeploy' problem — updating the payment service doesn't require redeploying the catalog or user management services. Cloud platforms support microservices with containers (GKE), serverless functions (Cloud Run), and managed messaging (Pub/Sub) for service communication.

Answer

Microservices always cost less than monolithic applications to run.

Answer

Microservices eliminate the need for testing because each service is small enough to be bug-free.

Answer

Microservices allow applications to run on any hardware without modification.

Question 3

After a major production outage, the engineering team conducts a review of what happened, why it happened, and how to prevent it in the future. This document is shared with all engineering teams. What is this practice called, and why does Google's SRE culture emphasize it?

Accepted Answer

Blameless postmortem — documenting the incident, root causes, and preventive actions to drive systemic learning without individual blame.. Option B is correct because a blameless postmortem is a core SRE practice that focuses on documenting incidents, root causes, and preventive actions without assigning individual blame. Google's SRE culture emphasizes this to foster psychological safety, enabling teams to openly share failures and drive systemic improvements, which is essential for maintaining high reliability in large-scale distributed systems.

Answer

Performance review — identifying which engineers caused the outage for disciplinary action.

Answer

Capacity planning review — ensuring enough servers are provisioned to prevent future outages.

Answer

Change advisory board (CAB) review — approving that the outage fix is safe to deploy.

Question 4

Google Cloud's infrastructure is designed to be highly available across multiple failure domains. What are 'availability zones' in Google Cloud, and how do they differ from 'regions'?

Accepted Answer

A region is a geographic area containing multiple isolated zones; zones have independent failure domains but low-latency connectivity within the region.. Option B is correct because in Google Cloud, a region is a specific geographic location composed of multiple zones, each of which is an isolated failure domain with independent power, cooling, and networking. Zones within the same region are connected by low-latency, high-bandwidth links, enabling high availability and fault tolerance for applications. This design ensures that a failure in one zone does not affect resources in another zone within the same region.

Answer

Zones are continents; regions are individual countries within a continent.

Answer

Zones and regions are different terms for the same thing — Google uses them interchangeably.

Answer

A zone is a global resource; a region is a local data center.

Question 5

A company's application traffic is served by a Google Cloud global HTTP load balancer. They want to understand how request traffic distributes across backend instances in different regions. Which metric best represents this distribution?

Accepted Answer

`loadbalancing/https/request_count` filtered by backend service and region.. The `loadbalancing/https/request_count` metric, when filtered by backend service and region, directly shows the number of requests handled by each regional backend. This allows you to see how traffic is distributed across regions, which is exactly what the question asks for.

Answer

`compute/instance/cpu/utilization` per instance group.

Answer

`networking/vm_flow/egress_bytes_count` per VM.

Answer

`logging/log_entry_count` filtered by region.

Question 6

A company currently uses Hadoop and Spark for batch data processing on a large on-premises cluster. They want to migrate these workloads to Google Cloud with minimal rewriting of existing Spark and Hadoop jobs. Which Google Cloud service is the best fit?

Accepted Answer

Cloud Dataproc — managed Apache Spark and Hadoop with minimal code changes.. Cloud Dataproc is a managed service for running Apache Spark and Hadoop clusters on Google Cloud. It supports the same open-source versions of Spark and Hadoop that the company currently uses, allowing them to migrate their existing batch processing workloads with minimal code changes. This makes it the best fit for the stated requirement of minimal rewriting.

Answer

Cloud Dataflow — it runs all Spark and Hadoop jobs natively.

Answer

BigQuery — it runs Spark SQL queries via BigQuery Spark stored procedures.

Answer

Google Kubernetes Engine — deploy Spark clusters on Kubernetes.

Question 7

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

Accepted Answer

Customers can schedule tours of Google data centers to verify security practices directly.. Option C is correct because Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Answer

Biometric authentication and badge access controls at multiple security perimeters.

Answer

24/7 on-site security personnel who monitor the facility continuously.

Answer

Secure hardware destruction procedures for decommissioned storage devices.

Question 8

What is the difference between a Service Level Indicator (SLI), a Service Level Objective (SLO), and a Service Level Agreement (SLA)?

Accepted Answer

SLI is the measured metric; SLO is the internal target for that metric; SLA is the contractual customer commitment.. Option B is correct because it accurately defines the relationship: an SLI is a specific metric (e.g., request latency at the 99th percentile), an SLO is the internal target for that metric (e.g., 99.9% of requests under 200ms), and an SLA is the contractual commitment to a customer (e.g., 99.9% uptime with financial penalties). This aligns with Google Cloud's Site Reliability Engineering (SRE) practices, where SLIs are measured, SLOs are internal goals, and SLAs are legal agreements.

Answer

SLI is the contract with customers; SLO is the internal target; SLA is the measurement.

Answer

SLI, SLO, and SLA are all the same thing — different names for uptime guarantees.

Answer

SLA is measured in milliseconds; SLO is measured in percentage; SLI has no unit.

Question 9

A company wants to proactively identify underutilized Compute Engine VMs (high provisioned capacity but low actual usage) to reduce costs. Which Google Cloud tool provides recommendations for right-sizing VMs?

Accepted Answer

Active Assist Recommender — ML-based VM rightsizing recommendations.. Google Cloud's Active Assist provides intelligent recommendations including VM rightsizing recommendations. These are powered by ML analysis of actual VM CPU and memory utilization over the past 8 days. The recommendations appear in the Cloud Console (Compute Engine → VM instances → Recommendations) and in the Recommender API. Rightsizing recommendations suggest optimal machine types based on observed usage, often identifying VMs that can be downsized to save significant costs.

Answer

Cloud Monitoring — set alerts for low CPU utilization.

Answer

Cloud Asset Inventory — lists all VMs and their configurations.

Answer

Cloud Billing budgets — set spending limits to prevent overspend.

Question 10

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

Accepted Answer

Access Context Manager with device policy conditions requiring managed, compliant devices.. Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Answer

Cloud Armor — it inspects device fingerprints on incoming requests.

Answer

Cloud Firewall rules that allow only corporate office IP ranges.

Answer

Two-step verification — the second factor proves the device is trusted.