Cloud Digital Leader Practice Test 50 — 15 Questions

Question 1

A hospital runs a patient records system that must remain on-premises due to strict regulatory data residency requirements. However, they also want to use cloud-based AI for diagnostic imaging analysis. Which cloud deployment model best describes their architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hybrid cloud — combining on-premises infrastructure with public cloud services.. The hospital must keep patient records on-premises to comply with data residency regulations, but wants to leverage cloud-based AI for diagnostic imaging. A hybrid cloud model combines on-premises infrastructure (for sensitive data) with public cloud services (for AI processing), allowing data to remain resident while compute-intensive tasks are offloaded. This matches the scenario exactly, as hybrid cloud enables workload distribution across private and public environments.

Answer

Public cloud — all workloads run in a provider's infrastructure.

Answer

Private cloud — all workloads run in the hospital's own infrastructure.

Answer

Multi-cloud — using multiple public cloud providers simultaneously.

Question 2

A bank's innovation team proposes building a new digital lending product using cloud services. The risk team objects, citing regulatory concerns about data sovereignty and auditability in cloud environments. What is the most effective way for the innovation team to address these concerns?

Accepted Answer

Demonstrate that Google Cloud provides the specific regulatory controls needed: data residency configuration, comprehensive audit logging, compliance certifications, and contractual frameworks that satisfy the bank's regulatory requirements. Regulatory concerns about cloud are real but addressable. Cloud providers offer compliance certifications (SOC 2, ISO 27001, banking-specific standards), data residency controls, comprehensive audit logging, and contractual frameworks (BAAs, DPAs). The innovation team should demonstrate that the specific controls required by regulators exist and are configurable, rather than treating cloud as incompatible with regulation.

Answer

Avoid cloud entirely for the new product and build on-premises to eliminate regulatory concerns

Answer

Ignore the risk team's concerns and proceed with cloud development, as regulators have approved cloud for all banking applications globally

Answer

Commission a multi-year study to determine whether cloud regulation will change before proceeding

Question 3

A company's security team wants to ensure that only approved corporate devices can access Google Cloud resources, regardless of whether the user has valid credentials. Which Google Cloud security capability enforces device-level access requirements?

Accepted Answer

Access Context Manager, which enforces device-level access requirements as part of context-aware access control policies. Access Context Manager is the correct choice because it allows security teams to define context-aware access policies that include device-level attributes such as device OS type, device ID, and whether the device is managed (e.g., via endpoint verification or third-party EMM). This enforces device-level access requirements even if the user has valid credentials, directly addressing the scenario.

Answer

Cloud Armor, which filters incoming requests based on IP allowlists and denylists

Answer

Identity-Aware Proxy (IAP), which provides application-level authentication but without device checks

Answer

VPC Service Controls, which restrict access to Google APIs based on network perimeter membership

Question 4

A traditional insurance company is facing competition from 'insurtech' startups that use telematics data, AI, and cloud platforms to offer usage-based, real-time personalized insurance products. The traditional company's CTO proposes a cloud-first digital transformation. Which business model change most clearly represents digital transformation rather than digitization?

Accepted Answer

Offering usage-based, dynamically priced insurance products using real-time telematics data and ML-driven individual risk assessment — replacing demographic-table pricing with behavioral data. Usage-based, real-time personalized insurance (pricing based on actual driving behavior, individual risk profiles, or real-time sensor data) represents a fundamental business model transformation. It replaces actuarial tables and demographic-based pricing with individual behavioral data. This is impossible without cloud-scale data processing and ML — it's not just automating existing processes but creating an entirely new product category.

Answer

Converting paper policy documents to digital PDFs stored in cloud document management systems

Answer

Replacing the claims processing fax machine with an online portal

Answer

Moving the company's email system to Google Workspace to improve employee collaboration

Question 5

A team uses multiple cloud services and wants to deploy all resources — VPCs, Cloud SQL databases, GKE clusters, and IAM roles — using a declarative, open-source infrastructure-as-code tool that works across multiple cloud providers. Which tool integrates natively with Google Cloud for this purpose?

Accepted Answer

Terraform. Terraform is the correct choice because it is a declarative, open-source infrastructure-as-code tool that supports multiple cloud providers, including Google Cloud, through its provider plugin architecture. It allows you to manage VPCs, Cloud SQL databases, GKE clusters, and IAM roles using HashiCorp Configuration Language (HCL) and integrates natively with Google Cloud via the google provider.

Answer

Cloud Deployment Manager — Google's native IaC service.

Answer

Cloud Build — it builds and deploys application code.

Answer

Ansible — it automates server configuration management.

Question 6

A company's security team wants to be alerted when someone with administrative permissions changes an IAM policy in their Google Cloud organization. Which Google Cloud capability enables this detection?

Accepted Answer

Admin Activity audit logs combined with Cloud Monitoring log-based alerting, which records and alerts on IAM policy modifications by any principal. Admin Activity audit logs record all changes to IAM policies and other configuration changes in Google Cloud. By combining these logs with Cloud Monitoring log-based alerting, the security team can create a specific alert that triggers whenever an IAM policy is modified by a principal with administrative permissions, enabling real-time detection of unauthorized changes.

Answer

Data Access audit logs, which record when data is read from Cloud Storage buckets

Answer

Cloud Armor, which blocks unauthorized IAM policy changes at the network layer

Answer

VPC flow logs, which capture all network traffic including IAM API calls

Question 7

An e-commerce platform uses Compute Engine to serve its website. During a flash sale, traffic spikes and some instances become unhealthy. The team wants to automatically replace unhealthy instances and maintain a minimum number of running instances. Which TWO features should they configure? (Choose 2)

Accepted Answer

Managed instance group (MIG). Managed instance groups (MIGs) provide autoscaling and autohealing. Autoscaling adjusts the number of instances based on load, and autohealing replaces unhealthy instances automatically.

Answer

Regional load balancer

Answer

Cloud CDN

Answer

Cloud NAT

Question 8

A company's security policy requires that when an employee is terminated, their access to all cloud resources must be revoked immediately — including any active sessions. Which approach most comprehensively achieves this in a Google Cloud environment integrated with Google Workspace?

Accepted Answer

Disabling the employee's Google Workspace account (which immediately invalidates all active sessions and prevents new authentication), then auditing for and revoking any service account keys they created. Disabling the Google Workspace account immediately invalidates all active sessions and prevents new authentication because Google Cloud IAM relies on the Workspace identity for user-based access. This single action revokes access across all Google Cloud projects and services that use that identity, including Cloud Console, gcloud CLI, and API sessions. Auditing and revoking service account keys the user created is necessary because those keys are not tied to the user's Workspace account and remain valid until explicitly deleted.

Answer

Manually reviewing and removing the employee's IAM bindings across all Google Cloud projects one by one

Answer

Changing the employee's password immediately — they can no longer log in with the old password

Answer

Waiting until the end of the business day to revoke access to avoid disrupting active workflows

Question 9

An organization needs to store archival data that must be retained for 10 years for compliance. Access to this data is expected to be less than once a year, and retrieval can take up to 24 hours. Which Cloud Storage class is the MOST cost-effective for this data?

Accepted Answer

Archive storage class. Archive storage is the lowest-cost class designed for long-term preservation with retrieval times in hours.

Answer

Coldline storage class

Answer

Nearline storage class

Answer

Standard storage class

Question 10

A company is running a PostgreSQL database on Cloud SQL and needs to ensure high availability with automatic failover in the event of a zone failure. Which configuration should they use?

Accepted Answer

Enable regional persistent disk and configure a standby instance in a different zone.. Enabling regional persistent disk allows the primary and standby Cloud SQL instances to share the same underlying storage across zones. When a zone failure occurs, the standby instance in a different zone automatically takes over with no data loss, providing high availability with automatic failover.

Answer

Use point-in-time recovery.

Answer

Configure connection pooling.

Answer

Set up a cross-region read replica.

Question 11

A regulated financial services firm must ensure that its data never leaves a specific geographic region (EU) for compliance with GDPR data residency requirements. Which Google Cloud features help enforce this requirement?

Accepted Answer

Select EU regions for all resources and apply the `gcp.resourceLocations` org policy to restrict resource creation to EU regions only.. The `gcp.resourceLocations` organization policy constraint explicitly restricts the physical location where Google Cloud resources can be created. By setting this policy to allow only EU regions, the organization ensures that no compute, storage, or database resources can be provisioned outside the EU, directly enforcing GDPR data residency requirements. This policy is evaluated at resource creation time and applies to all projects under the organization, providing a hard enforcement boundary.

Answer

Enable Cloud Armor on all load balancers to block non-EU traffic.

Answer

Use HTTPS for all connections to ensure data is encrypted when it leaves the EU.

Answer

Enable Google Workspace's regional storage settings to restrict where emails are stored.

Question 12

An organization's security team reviews their Google Cloud environment and finds that several Cloud Storage buckets have `allAuthenticatedUsers` bindings, and multiple service accounts have the Owner role. Which Google Cloud tool automatically identifies these types of high-risk IAM configurations?

Accepted Answer

Security Command Center (SCC) with IAM Recommender and Security Health Analytics.. Security Command Center (SCC) with Security Health Analytics and IAM Recommender is the correct tool because it automatically scans for high-risk IAM configurations, such as `allAuthenticatedUsers` bindings on Cloud Storage buckets and service accounts with the Owner role. Security Health Analytics detects misconfigurations against CIS benchmarks and Google Cloud best practices, while IAM Recommender provides actionable recommendations to reduce excessive permissions. This combination proactively identifies and helps remediate these specific security risks without requiring manual log review or billing analysis.

Answer

Cloud Audit Logs — reviewing all recent IAM changes.

Answer

Cloud Billing reports — they flag expensive configurations that indicate security issues.

Answer

Cloud Monitoring — it alerts when IAM policies are modified.

Question 13

A cloud operations engineer notices that the managed instance group 'my-mig' has been scaling up frequently, but the application performance is still degraded. The CPU utilization metric shows high values. What is most likely the issue?

Accepted Answer

The scaling metric is not appropriate; consider using a custom metric that better reflects application load.. The autoscaler is using CPU utilization as the scaling metric, but high CPU does not necessarily correlate with application performance degradation. If the application is bottlenecked on memory, I/O, or request queuing, CPU may remain high while throughput suffers. A custom metric (e.g., requests per second, latency, or queue depth) would better reflect actual application load and enable more accurate scaling decisions.

Answer

The target size is set to 10, which is lower than the current needed capacity.

Answer

The instance group is using preemptible VMs which are being reclaimed frequently.

Answer

The autoscaler is using a cooldown period that is too long, preventing it from scaling down.

Question 14

A company runs a containerized microservices application on Google Kubernetes Engine (GKE). They want to expose a set of services externally with a single IP address, implement SSL termination, and protect against DDoS attacks. Which THREE Google Cloud services should they use together?

Accepted Answer

Cloud Armor. Cloud Load Balancing provides a single anycast IP and SSL termination. Cloud CDN accelerates content delivery and can be integrated with the load balancer. Cloud Armor provides DDoS protection and WAF capabilities. Cloud NAT is for outbound internet access, Cloud VPN for site-to-site VPN, and Cloud Interconnect for dedicated connectivity.

Answer

Cloud NAT

Answer

Cloud VPN

Question 15

A retail company runs a web application on Google Kubernetes Engine (GKE). They want to automatically scale the application based on custom metrics (e.g., number of items in a shopping cart). Which TWO resources should they configure?

Accepted Answer

Custom Metrics Stackdriver Adapter. Horizontal Pod Autoscaler (HPA) can scale pods based on custom metrics. Custom Metrics adapter (e.g., Stackdriver adapter) exposes application metrics to HPA.

Answer

Cluster Autoscaler

Answer

Vertical Pod Autoscaler (VPA)

Answer

Cloud Load Balancing