Cloud Digital Leader Practice Questions 2 — 50 Questions

Question 1

An enterprise needs advanced business intelligence capabilities: governed semantic models that business users query with natural language, embedded analytics in their customer-facing application, and centralized data access controls. Which Google Cloud analytics product is purpose-built for these enterprise BI requirements?

Accepted Answer

Looker (enterprise BI platform with LookML semantic layer). Looker is purpose-built for enterprise BI with its LookML semantic modeling layer, which governs data definitions and access controls. It supports natural language querying through Looker's 'Ask Looker' feature and enables embedded analytics via its API and SDK, directly matching the requirements for governed semantic models, natural language queries, and embedded analytics.

Answer

Looker Studio (free BI dashboards)

Answer

BigQuery — it provides natural language querying via BQML.

Answer

Vertex AI — it builds ML models that answer business questions.

Question 2

A city government deploys thousands of IoT sensors (traffic, air quality, energy usage, waste levels) and analyzes the data in real time to optimize traffic signals, dispatch waste collection vehicles proactively, and adjust street lighting automatically. What concept describes this use of cloud and IoT?

Accepted Answer

Smart city — using cloud, IoT, and AI to optimize city operations and resource utilization in real time.. A smart city uses digital technology — IoT sensors, cloud analytics, AI, and connectivity — to optimize city operations, improve resident quality of life, and use resources more efficiently. Cloud platforms receive sensor data via IoT Core or Pub/Sub, process it with Dataflow, analyze patterns with BigQuery and AI, and trigger automated responses (traffic signal changes, dispatch notifications). This is one of the most impactful applications of cloud transformation at city scale.

Answer

E-government — providing digital access to government services online.

Answer

Digital twin — creating virtual replicas of city infrastructure.

Answer

Edge computing — processing data locally at each sensor to reduce cloud bandwidth.

Question 3

A healthcare organization wants to build an application that ingests FHIR-formatted patient records from multiple hospital systems, normalizes them, and makes them queryable by clinical researchers. Which Google Cloud service is purpose-built for healthcare data interoperability?

Accepted Answer

Cloud Healthcare API with FHIR store support.. The Cloud Healthcare API with FHIR store support is purpose-built for healthcare data interoperability because it natively handles FHIR (Fast Healthcare Interoperability Resources) standards, including resource validation, versioning, and search. It provides a managed service that ingests, normalizes, and stores FHIR-formatted patient records from multiple hospital systems, enabling secure querying by clinical researchers without requiring custom ETL pipelines.

Answer

BigQuery — store FHIR JSON records and query them with SQL.

Answer

Cloud SQL — store patient records in a relational schema.

Answer

Google Forms — collect patient data directly from hospitals via web forms.

Question 4

A company uses service accounts to allow their application running on a Compute Engine VM to access Cloud Storage. Which is the most secure way to configure this service account access?

Accepted Answer

Attach the service account to the Compute Engine VM; the application obtains credentials automatically via the metadata server with no key files needed.. Option B is correct because attaching a service account to a Compute Engine VM allows the application to automatically obtain short-lived OAuth 2.0 access tokens from the instance metadata server (http://169.254.169.254). This eliminates the need to download, store, or manage any long-lived service account key files, which are a significant security risk. The metadata server provides credentials that are automatically rotated and scoped to the service account's IAM roles, making this the most secure method for accessing Cloud Storage from a VM.

Answer

Download the service account key JSON file and store it in the application's source code repository.

Answer

Grant all users the Storage Admin role so the application can access Cloud Storage through their credentials.

Answer

Create a shared service account key file accessible to all VMs via a Cloud Storage bucket.

Question 5

A company's application is called 'stateless' because it doesn't store any user session data in the application server's memory. Each request contains all necessary information. Why is statelessness important for cloud scalability?

Accepted Answer

Stateless applications can be scaled horizontally without session loss because any instance can handle any request — enabling easy addition/removal of instances.. Statelessness is critical for cloud scalability because it enables horizontal scaling: any instance can process any request without needing to recall previous interactions. Since no session data is stored locally, new instances can be added or removed dynamically without risk of session loss, allowing the application to handle fluctuating loads efficiently. This aligns with the cloud's elasticity model, where resources are provisioned on demand.

Answer

Stateless applications use less storage because they don't store any data.

Answer

Stateless applications are more secure because they don't remember who the user is.

Answer

Stateless applications eliminate the need for databases since no data is stored.

Question 6

A company's cloud costs have increased by 40% over the past quarter. The operations team wants to identify and address the root causes. Which cost optimization strategies should they investigate first?

Accepted Answer

Identify idle and underutilized resources (oversized VMs, unused disks, unattached IPs), apply lifecycle policies to storage, and commit to CUDs for stable workloads.. Option B is correct because the first step in cloud cost optimization is to identify and eliminate waste from idle or oversized resources, which is the most common source of cost inefficiency. Applying lifecycle policies to storage and committing to Committed Use Discounts (CUDs) for stable workloads are proven strategies to reduce costs without compromising performance. This approach aligns with Google Cloud's recommended FinOps practices, focusing on immediate, high-impact savings before considering architectural changes.

Answer

Immediately upgrade all infrastructure to the latest generation hardware for better efficiency.

Answer

Migrate all workloads to Spot VMs immediately to reduce costs by 90%.

Answer

Switch cloud providers to whoever has the lowest advertised list price.

Question 7

A company stores encryption keys in Cloud KMS to protect sensitive data. What does Cloud KMS provide that standard application-layer encryption does not?

Accepted Answer

Centralized key lifecycle management with IAM-controlled access, audit logs, rotation policies, and optional HSM-backed key protection.. Cloud KMS provides centralized key lifecycle management, including IAM-based access control, audit logging, automatic key rotation, and optional HSM-backed key protection. Standard application-layer encryption typically embeds keys within the application code or configuration, lacking these governance and security controls. This separation of key management from application logic is a core security best practice.

Answer

Faster encryption performance because Google's hardware is optimized for cryptographic operations.

Answer

The ability to encrypt data without any performance impact on the application.

Answer

Free unlimited encryption for all data stored in Google Cloud.

Question 8

A company's PostgreSQL database has grown to 50 TB and their application requires near-zero downtime, automatic failover, and the ability to scale reads horizontally without the migration complexity of switching to Spanner. Which Google Cloud database product is specifically designed as a fully managed, highly scalable PostgreSQL-compatible database?

Accepted Answer

AlloyDB for PostgreSQL. AlloyDB for PostgreSQL is a fully managed, PostgreSQL-compatible database service designed for high scalability, near-zero downtime, and automatic failover. It separates compute and storage to enable horizontal read scaling with read pools, and it uses a columnar engine for analytical acceleration, making it ideal for large workloads like 50 TB without the migration complexity of Spanner.

Answer

Cloud SQL (PostgreSQL)

Answer

Cloud Spanner

Answer

Bare metal PostgreSQL on Compute Engine

Question 9

Google Cloud runs its own infrastructure operations using the Site Reliability Engineering (SRE) model, which Google invented. What is the core principle that distinguishes SRE from traditional IT operations?

Accepted Answer

SRE applies software engineering principles to operations — automating toil, using quantitative SLOs, and treating reliability as an engineered system property.. Option B is correct because the core principle of SRE is applying software engineering practices to operations work. This means automating manual toil, defining quantitative Service Level Objectives (SLOs) to measure reliability, and treating reliability as an engineered property of the system — not as an afterthought. This contrasts with traditional IT operations, which often rely on manual processes and reactive troubleshooting.

Answer

SRE teams never allow production deployments to ensure maximum stability.

Answer

SRE relies entirely on external monitoring vendors to detect and respond to all incidents.

Answer

SRE means development and operations teams are separate departments that communicate only via ticketing systems.

Question 10

A Virtual Private Cloud (VPC) in Google Cloud provides network isolation. What does 'network isolation' mean in this context, and why is it important?

Accepted Answer

VPC provides a logically isolated private network where resources are separated from other customers' networks by default, preventing unauthorized cross-customer traffic.. Option B is correct because a Google Cloud VPC provides a logically isolated private network within the shared Google Cloud infrastructure. This isolation ensures that resources in one customer's VPC cannot directly communicate with resources in another customer's VPC by default, preventing unauthorized cross-customer traffic. This is achieved through software-defined networking (SDN) constructs like virtual firewalls and routing tables, not through physical separation.

Answer

Network isolation means the VPC blocks all internet access — resources cannot communicate with external services.

Answer

Network isolation means all traffic within the VPC is automatically encrypted.

Answer

A VPC requires dedicated physical hardware separate from other customers to ensure isolation.

Question 11

A company uses Google Cloud across 5 teams, 20 projects, and 3 regions. They want to enforce a standard that all resources include specific labels (e.g., `team`, `environment`, `cost-center`) for cost attribution and governance. What is the most scalable way to enforce this labeling standard?

Accepted Answer

Enforce labeling through IaC templates with required label variables in CI/CD pipelines, and use Cloud Asset Inventory to audit compliance.. Option B is correct because it combines Infrastructure as Code (IaC) templates with required label variables in CI/CD pipelines to enforce labeling at resource creation time, and uses Cloud Asset Inventory to audit and detect non-compliant resources. This approach is scalable across 5 teams, 20 projects, and 3 regions because it automates enforcement and provides continuous compliance monitoring without manual intervention.

Answer

Send monthly reminders to all teams via email to add labels to their resources.

Answer

Manually add labels to all existing and new resources through the Cloud Console.

Answer

Grant only project owners permission to create resources, and rely on them to enforce labeling.

Question 12

What does 'durability' mean for cloud storage services, and how is it different from 'availability'?

Accepted Answer

Durability measures the probability data won't be lost; availability measures the percentage of time data can be accessed — a service can be temporarily unavailable while data remains durable.. Durability measures the probability that stored data will not be lost or corrupted over time, typically expressed as a percentage (e.g., 99.999999999% for Amazon S3). Availability measures the percentage of time a service is operational and accessible, often defined in SLAs (e.g., 99.99% uptime). A service can be temporarily unavailable (e.g., due to maintenance) while the data remains intact and durable, so they are distinct concepts.

Answer

Durability and availability are the same thing — both measure how often data can be accessed.

Answer

Durability refers to network speed; availability refers to storage capacity.

Answer

High availability automatically guarantees high durability, so both terms describe the same SLA.

Question 13

A team uses multiple cloud services and wants to deploy all resources — VPCs, Cloud SQL databases, GKE clusters, and IAM roles — using a declarative, open-source infrastructure-as-code tool that works across multiple cloud providers. Which tool integrates natively with Google Cloud for this purpose?

Accepted Answer

Terraform. Terraform is the correct choice because it is a declarative, open-source infrastructure-as-code tool that supports multiple cloud providers, including Google Cloud, through its provider plugin architecture. It allows you to manage VPCs, Cloud SQL databases, GKE clusters, and IAM roles using HashiCorp Configuration Language (HCL) and integrates natively with Google Cloud via the google provider.

Answer

Cloud Deployment Manager — Google's native IaC service.

Answer

Cloud Build — it builds and deploys application code.

Answer

Ansible — it automates server configuration management.

Question 14

A company wants to allow a third-party security firm to conduct a penetration test against their Google Cloud environment to identify vulnerabilities. What is Google Cloud's policy on penetration testing?

Accepted Answer

Customers are authorized to penetration test their own GCP resources without prior Google approval, within the Acceptable Use Policy.. Google Cloud's policy explicitly authorizes customers to conduct penetration testing on their own GCP resources without prior approval from Google, as long as the testing complies with the Acceptable Use Policy. This is because Google treats the customer's environment as their own responsibility, and the shared responsibility model places security testing under the customer's control. Option B correctly reflects this policy, which is documented in Google Cloud's security testing guidelines.

Answer

Customers must submit a formal request to Google and wait for written approval before any penetration testing.

Answer

Penetration testing is illegal in cloud environments and customers should use vulnerability scanners instead.

Answer

Google automatically performs penetration testing on all customer resources monthly and shares the report.

Question 15

A company hosts a web application that receives requests from users globally. To handle failures, they run three identical copies of their application behind a load balancer. When one copy fails, the load balancer automatically stops sending traffic to it. What load balancing feature enables this?

Accepted Answer

Health checks — the load balancer probes backend instances and removes unhealthy ones from the serving pool.. Health checks are the load balancing feature that proactively monitors the status of backend instances by sending periodic probes (e.g., HTTP GET requests, TCP SYN packets) to a configured endpoint. If a health check fails (e.g., non-2xx response, timeout, or connection refused), the load balancer automatically marks that instance as unhealthy and stops routing new traffic to it, ensuring high availability and fault tolerance.

Answer

Round-robin distribution — traffic cycles evenly across all instances regardless of health.

Answer

SSL termination — decrypting HTTPS traffic before forwarding to backends.

Answer

Session affinity — routing the same user to the same backend instance.

Question 16

An SRE team has a monthly error budget of 43 minutes (99.9% SLO). In the first week of the month, a deployment causes a 50-minute outage. What should the SRE team do for the remainder of the month, and why?

Accepted Answer

Freeze feature deployments for the rest of the month, focus on reliability improvements, and investigate the deployment process that caused the outage.. The team has already consumed more than the entire monthly error budget (50 minutes used vs. 43 minutes allowed). To avoid violating the 99.9% SLO for the rest of the month, they must freeze feature deployments and focus on reliability improvements. This is a core SRE practice: when the error budget is exhausted, the team shifts from feature velocity to stability, investigating the root cause and hardening the deployment process.

Answer

Immediately deploy a hotfix to restore features that were rolled back during the outage.

Answer

Negotiate with stakeholders to increase the SLO to 99.5% to get more error budget.

Answer

Continue deploying features normally — the outage was a one-time event and won't happen again.

Question 17

Which Google Cloud feature provides reports on how Google processes government requests for customer data and how often Google challenges overly broad requests?

Accepted Answer

Google's Transparency Report — publishing data about government requests and legal compliance.. Google's Transparency Report is the correct answer because it specifically publishes data on government requests for user data, including how Google processes these requests and how often it challenges overly broad or legally questionable demands. This report is designed to provide public visibility into government actions, not to log individual API calls or access events.

Answer

Cloud Audit Logs — they record all API calls including government data requests.

Answer

Security Command Center — it alerts when government agencies access customer data.

Answer

Access Transparency logs — they record every time any external entity accesses customer data.

Question 18

A company's engineering organization wants to share operational knowledge across teams using a 'golden path' — a recommended, pre-configured set of tools, services, and templates that makes the easy path also the correct path. Which Google Cloud concept supports this practice?

Accepted Answer

Use Terraform blueprints, organization policies, and Cloud Foundation Toolkit to create pre-configured landing zones that enforce standards automatically.. Option B is correct because the Cloud Foundation Toolkit (CFT) provides Terraform blueprints and pre-configured landing zones that enforce organizational policies and standards automatically. This aligns directly with the 'golden path' concept by making the easy path (using the blueprints) also the correct path (enforcing compliance and best practices through organization policies and automated deployments).

Answer

Create a shared Google Slides presentation documenting best practices for teams to reference.

Answer

Grant all teams Organization Admin access so they can configure resources however they prefer.

Answer

Hire a dedicated cloud architect to review every new project's design before it starts.

Question 19

An organization is planning to adopt cloud services but needs to understand which party is responsible for physical security of the data center. Under the shared responsibility model, who is responsible for physical data center security in a public cloud deployment?

Accepted Answer

The cloud provider, who is entirely responsible for all physical security of data center facilities and hardware. In the cloud shared responsibility model, physical security of data centers — including building access controls, perimeter security, surveillance, and hardware security — is always the sole responsibility of the cloud provider. Customers never have physical access to cloud provider data centers and bear no responsibility for physical security. This is one of the fundamental security benefits of using a public cloud.

Answer

The customer, because they own the data stored in the data center

Answer

A shared responsibility: the cloud provider secures the building exterior while the customer secures the server racks

Answer

A third-party security company contracted by both the customer and the cloud provider

Question 20

A data analyst at a media company needs to run complex SQL queries on petabytes of user engagement data to produce weekly reports. The dataset is stored in Google Cloud. Which Google Cloud product is purpose-built for this type of large-scale analytical SQL workload?

Accepted Answer

BigQuery, Google Cloud's serverless data warehouse for petabyte-scale analytical SQL. BigQuery is Google Cloud's serverless, highly scalable data warehouse specifically designed for petabyte-scale analytical SQL queries. It separates compute from storage and uses a columnar storage format and a distributed query engine to execute complex SQL on massive datasets without provisioning infrastructure, making it the ideal choice for the described workload.

Answer

Cloud SQL, Google Cloud's managed relational database service

Answer

Cloud Bigtable, Google's NoSQL wide-column database

Answer

Firestore, Google Cloud's serverless NoSQL document database