Cloud Digital Leader Practice Questions 1 — 50 Questions

Question 1

An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?

Accepted Answer

VPC Service Controls with an access level that includes the IP range. VPC Service Controls can restrict access based on IP addresses via access levels. IAP is for user authentication. Cloud Armor is for HTTP(S) load balancing. Firewall rules apply to network traffic, not API access to Cloud Storage.

Answer

Cloud Armor security policy

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Question 2

A financial services firm must comply with PCI DSS and wants to run workloads on Google Cloud. They need to isolate their production environment from development and enforce granular access controls. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls and IAM. Google Cloud's VPC Service Controls enable isolation of sensitive data in a VPC perimeter, while IAM provides granular access controls. Together they help meet compliance requirements.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Cloud VPN

Question 3

A finance team needs to analyze detailed cost data across multiple projects, including resource-level breakdowns, labels, and cost attribution. They want to export this data to a BigQuery dataset for custom analysis. Which billing export option should they enable?

Accepted Answer

Enable billing export to BigQuery (standard usage cost data). Standard billing export to a BigQuery dataset provides detailed cost data with resource-level items, labels, and cost breakdowns. It is the recommended method for granular analysis.

Answer

Use the Cloud Billing API to pull cost data programmatically

Answer

Set up a budget alert with notifications to Pub/Sub and ingest into BigQuery

Answer

Enable billing export to Cloud Storage in CSV format

Question 4

A security engineer wants to block malicious traffic patterns at the edge of Google's network before it reaches their application. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is a web application firewall (WAF) and DDoS protection service that works with Cloud Load Balancing to filter traffic based on IP addresses, geo-location, and Layer 7 attributes. Cloud CDN caches content, Cloud DNS resolves domain names, and VPC firewall rules protect at the instance level, not at the edge.

Answer

VPC firewall rules

Answer

Cloud DNS

Answer

Cloud CDN

Question 5

A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow creating perimeters that restrict access to Google Cloud services to trusted VPCs and IP ranges.

Answer

VPC firewall rules

Answer

Cloud Armor

Answer

IAM conditions

Question 6

An organization wants to use Google Cloud for processing healthcare data subject to HIPAA regulations in the United States. Which contractual document must the organization obtain from Google before storing Protected Health Information (PHI) in Google Cloud?

Accepted Answer

A Business Associate Agreement (BAA), which is legally required by HIPAA before any covered entity can process Protected Health Information with a cloud provider. Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Answer

A Non-Disclosure Agreement (NDA) to prevent Google from disclosing the existence of the healthcare application

Answer

A Data Processing Agreement (DPA) as required under GDPR for European data subjects

Answer

An ISO 27001 certificate issued by Google Cloud demonstrating information security compliance

Question 7

An operations team tracks the following metrics for their customer portal: request latency p99, error rate, and requests per second. In Site Reliability Engineering terminology, what are these metrics called, and what do they collectively define?

Accepted Answer

Service Level Indicators (SLIs), which measure specific dimensions of service behavior from the user's perspective and collectively define how reliability is quantified. In Site Reliability Engineering (SRE), the metrics p99 latency, error rate, and requests per second are classified as Service Level Indicators (SLIs). SLIs are carefully chosen quantitative measures of specific aspects of the service's behavior, such as availability, latency, or throughput, as experienced by the end user. Collectively, these SLIs define how reliability is quantified and are used to set and monitor Service Level Objectives (SLOs).

Answer

Key Performance Indicators (KPIs) that define the overall health of the business

Answer

Service Level Agreements (SLAs), defining the contractual commitments made to customers

Answer

Operational metrics that are only relevant to the infrastructure team and not to business stakeholders

Question 8

A company is moving a regulated workload to Google Cloud and must ensure that their encryption keys are stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3 validation. Which Google Cloud key management option satisfies this requirement?

Accepted Answer

Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules. Cloud HSM is the correct choice because it provides a dedicated HSM service that stores and manages encryption keys in FIPS 140-2 Level 3 validated hardware security modules. This directly meets the regulatory requirement for a hardware security module with that specific validation level, as opposed to software-backed or customer-supplied key options.

Answer

Cloud KMS software-backed keys, which are managed by Google and stored in Google's secure key management infrastructure

Answer

Customer-supplied encryption keys (CSEK), where the customer provides the key with each API request

Answer

Secret Manager, which stores API keys and credentials with automatic rotation

Question 9

A company's security architect wants to implement 'privacy by design' principles when building a new customer data platform on Google Cloud. What does privacy by design mean in this context?

Accepted Answer

Privacy by design means privacy protections (encryption, data minimization, access controls, retention policies) are architected into the system from the start, not added after deployment.. Privacy by design is a foundational principle that requires embedding privacy controls—such as encryption, data minimization, access controls, and retention policies—into the architecture of a system from the initial design phase, rather than retrofitting them after deployment. In the context of Google Cloud, this means using services like Cloud KMS for encryption, IAM for fine-grained access control, and data lifecycle policies to minimize data collection and enforce retention limits from the start. Option B correctly captures this proactive, integrated approach.

Answer

Privacy by design means the platform must refuse to collect any personal data from customers.

Answer

Privacy by design is a legal requirement that mandates using only on-premises systems for customer data.

Answer

Privacy by design means storing all data in an encrypted format and using a VPN for all access.

Question 10

A developer needs to store application secrets (database passwords, API keys, OAuth tokens) securely so that they are not hardcoded in source code or environment variables. The secrets should be automatically versioned and rotatable. Which Google Cloud product is designed for this secure secrets management requirement?

Accepted Answer

Secret Manager, which stores secrets encrypted at rest with automatic versioning, rotation support, and fine-grained IAM access control. Secret Manager is Google Cloud's dedicated service for storing application secrets such as database passwords, API keys, and OAuth tokens. It provides encryption at rest using AES-256, automatic versioning (each new secret version is immutable and timestamped), and built-in rotation support via scheduled rotation policies. Fine-grained IAM roles (e.g., roles/secretmanager.secretAccessor) ensure least-privilege access without exposing secrets in source code or environment variables.

Answer

Cloud Storage, by storing secrets in an encrypted bucket with restricted IAM access

Answer

Cloud KMS, which generates encryption keys for encrypting application data

Answer

Cloud SQL, by storing secrets in an encrypted database table with restricted access

Question 11

An architect is evaluating whether to use a relational database or a NoSQL database for a new application that must store product catalog data. Products have highly variable attributes — a book has ISBN, author, and genre; a bicycle has frame size, wheel diameter, and material. Which database characteristic makes NoSQL document databases advantageous for this use case?

Accepted Answer

NoSQL document databases support flexible schemas where each document can have different fields — making them well-suited for product catalogs where different product types have different attributes. NoSQL document databases, such as MongoDB, store data in flexible, schema-less documents (often JSON or BSON). This allows each document to have a different set of fields, making them ideal for product catalogs where a book and a bicycle have entirely different attributes (e.g., ISBN vs. frame size). Relational databases require a predefined schema with fixed columns, forcing you to either create many sparse columns or use complex join tables to handle variable attributes.

Answer

NoSQL databases always provide faster query performance than relational databases for all use cases

Answer

NoSQL databases support ACID transactions better than relational databases, making them safer for product catalog updates

Answer

NoSQL databases are simpler to query because they don't require learning SQL

Question 12

A cloud operations team wants to ensure that all cloud resources created in their Google Cloud organization comply with company naming standards and required cost allocation labels. Which Google Cloud capability can automatically enforce these standards on resource creation?

Accepted Answer

Organization Policy Service with custom constraints or required label policies that prevent resource creation if naming and label standards are not met. Organization Policy Service with custom constraints or required label policies is correct because it provides a preventive control that blocks resource creation if the resource does not meet defined naming and label standards. This is enforced at the Google Cloud resource hierarchy level before any resource is provisioned, ensuring compliance automatically without relying on post-creation detection or manual processes.

Answer

Cloud Billing reports, which flag resources missing required labels after they are created

Answer

Cloud Monitoring alerts that notify the team when non-compliant resources are detected

Answer

Cloud IAM roles that only grant resource creation permissions to employees who have passed a naming standards training

Question 13

A company's DevOps team wants to orchestrate a complex workflow that involves calling multiple Google Cloud APIs in sequence — first running a Cloud Build job, then checking the results, then either deploying to Cloud Run or sending a notification. Which Google Cloud product is designed for orchestrating multi-step workflow logic?

Accepted Answer

Google Cloud Workflows, which orchestrates multi-step processes by calling APIs in sequence with conditional logic, error handling, and state management. Google Cloud Workflows is the correct choice because it is a fully managed orchestration platform specifically designed to define multi-step workflows that call Google Cloud APIs and external services in sequence. It supports conditional logic (e.g., if-then-else), error handling (e.g., retries with exponential backoff), and state management, making it ideal for the described scenario of running a Cloud Build job, checking results, and conditionally deploying to Cloud Run or sending a notification.

Answer

Cloud Scheduler, which triggers a series of jobs at specified cron intervals

Answer

Cloud Pub/Sub, by publishing messages between pipeline stages to trigger each subsequent step

Answer

Cloud Run, by writing the orchestration logic as a container application that calls other services sequentially

Question 14

A data engineering team needs to build a pipeline that reads event data from Pub/Sub in real time, applies transformations and aggregations, and writes results to BigQuery — all without managing any infrastructure. Which Google Cloud product is designed for this serverless stream and batch data processing use case?

Accepted Answer

Cloud Dataflow, Google Cloud's serverless stream and batch data processing service built on Apache Beam. Cloud Dataflow is Google Cloud's fully managed, serverless service for both stream and batch data processing, built on Apache Beam. It directly reads from Pub/Sub, applies transformations and aggregations using the Beam SDK, and writes the results to BigQuery without requiring any infrastructure management, making it the correct choice for this use case.

Answer

Cloud Composer, Google Cloud's managed Apache Airflow service for workflow orchestration

Answer

Cloud Dataproc, Google Cloud's managed Spark and Hadoop service

Answer

BigQuery directly, using streaming inserts to load Pub/Sub data in real time

Question 15

An SRE team is practicing 'chaos engineering' by simulating a zone-level failure in their staging environment. They find that their application does not automatically recover — traffic is not redirected and the service remains down. What architectural component is most likely missing?

Accepted Answer

A load balancer with health checks across multiple zones is most likely missing — without it, there is no mechanism to detect the zone failure and automatically redirect traffic to healthy instances in surviving zones. In a zone-level failure, traffic cannot be redirected to healthy instances in surviving zones without a load balancer that performs health checks across multiple zones. Google Cloud's external or internal load balancers (e.g., HTTP(S) Load Balancer, TCP/UDP Network Load Balancer) use health checks to detect unhealthy instances and automatically route traffic only to healthy backends. Without this component, the application has no mechanism to detect the zone failure and reroute traffic, leaving the service down.

Answer

The application needs more replicas in the failing zone to survive the failure

Answer

The application needs a larger machine type to handle the full traffic load without the failed zone's capacity

Answer

Cloud Monitoring alerts need to be configured to notify the team when a zone fails, enabling manual traffic redirection

Question 16

A large bank is undergoing a cloud transformation. The CTO argues that the transformation will require a 'bimodal IT' approach — running two modes of IT simultaneously. What does bimodal IT mean in this context, and what is its primary criticism?

Accepted Answer

Bimodal IT runs stable core systems (Mode 1) alongside an agile innovation team (Mode 2); critics argue it creates organizational division, delays core modernization, and produces digital capabilities that eventually can't integrate with unreformed core systems. Bimodal IT, as described by Gartner, separates IT into Mode 1 (traditional, stable, and risk-averse systems) and Mode 2 (agile, exploratory, and fast-moving innovation teams). In a cloud transformation context, Mode 1 typically runs legacy core banking systems on-premises or in a private cloud, while Mode 2 rapidly develops cloud-native applications. The primary criticism is that this creates a permanent organizational and technical divide, where Mode 2 builds digital capabilities that cannot integrate with the unreformed, monolithic Mode 1 systems, leading to technical debt and delaying the necessary modernization of the core.

Answer

Bimodal IT means using two different cloud providers for redundancy; the criticism is that it creates vendor lock-in with two providers instead of one

Answer

Bimodal IT means running both cloud and on-premises systems; the criticism is that hybrid environments are too complex to manage

Answer

Bimodal IT has no critics — it is universally accepted as the best approach to banking digital transformation

Question 17

A logistics company needs to send millions of shipment status updates per day from IoT tracking devices to backend systems for processing and storage. The solution must decouple the tracking devices from the backend and handle traffic spikes without losing messages. Which Google Cloud product best fits this asynchronous messaging requirement?

Accepted Answer

Cloud Pub/Sub, Google's fully managed messaging service that decouples producers from consumers and handles massive message volumes reliably. Cloud Pub/Sub is the correct choice because it is a fully managed, asynchronous messaging service designed to decouple producers (IoT devices) from consumers (backend systems). It can handle millions of messages per second, provides at-least-once delivery, and buffers messages during traffic spikes, ensuring no data loss without requiring the backend to be always available.

Answer

Cloud SQL, to store each tracking update as a row in a relational database as it arrives

Answer

Cloud Storage, to have each device upload a file containing its status update

Answer

Cloud Load Balancing, to distribute incoming tracking requests evenly across backend servers

Question 18

An organization runs its entire infrastructure on a single public cloud provider (Google Cloud). All applications, data, and services live in Google Cloud's infrastructure. Which deployment model describes this?

Accepted Answer

Public cloud. The organization is using a single public cloud provider, Google Cloud, which delivers computing resources over the public internet on a pay-as-you-go basis. In a public cloud deployment, the infrastructure is owned and operated by the cloud provider and shared across multiple tenants, which matches the scenario where all applications, data, and services reside in Google Cloud's infrastructure.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 19

A DevOps team wants to automate their software build, test, and deployment process on Google Cloud. They need a service that triggers automatically when code is pushed to a repository, builds container images, runs tests, and deploys to production. Which Google Cloud product orchestrates this CI/CD pipeline?

Accepted Answer

Cloud Build, Google Cloud's managed CI/CD service that triggers on code pushes, builds images, runs tests, and deploys automatically. Cloud Build is Google Cloud's managed CI/CD service that directly supports the described workflow: it can be triggered automatically by code pushes to a repository (e.g., Cloud Source Repositories, GitHub, Bitbucket), then execute a series of steps defined in a build configuration file (cloudbuild.yaml) to build container images, run tests, and deploy to production environments such as Google Kubernetes Engine, Cloud Run, or Compute Engine. This makes it the correct choice for orchestrating the entire CI/CD pipeline.

Answer

Cloud Composer, Google Cloud's managed Apache Airflow service

Answer

Cloud Scheduler, which triggers periodic jobs on a cron schedule

Answer

Eventarc, which routes events from Google Cloud services to Cloud Run functions

Question 20

An operations team has been asked to estimate the annual cost impact of a proposed new cloud architecture. The architecture would replace 50 on-demand n2-standard-4 VMs (running 24/7) with an autoscaling group that averages 10 VMs under normal load but scales to 50 during peak hours (approximately 8 hours per day). Which analytical approach best estimates the cost impact?

Accepted Answer

Model the actual usage pattern: calculate cost for (16 normal hours × 10 VMs) + (8 peak hours × 50 VMs) per day, compare to fixed cost of 50 VMs × 24 hours, and use Google Cloud Pricing Calculator to price the VM type. It accurately models the variable usage pattern of the autoscaling group: 16 hours at 10 VMs plus 8 peak hours at 50 VMs per day. This approach then compares the daily cost to the fixed 50 VMs × 24 hours baseline, using the Google Cloud Pricing Calculator to price the n2-standard-4 instance type. This reflects the pay-per-use billing model of Google Compute Engine, where autoscaling does not change per-VM pricing but reduces total cost by running fewer instances during off-peak hours.

Answer

Assume the autoscaling group always runs at average load (10 VMs) and multiply by the annual hours to get the new cost

Answer

Request a custom quote from Google Cloud sales since pricing for autoscaling groups is negotiated individually

Answer

The cost will be identical since autoscaling groups use the same VM type as the fixed fleet