Cloud Digital Leader Practice Exam 51 — 20 Questions

Question 1

A company wants to ensure that their confidential data stored in BigQuery cannot be shared outside the company's Google Cloud organization. Which Google Cloud security capability prevents data from being shared with external Google accounts (outside the organization)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Domain Restricted Sharing' organization policy constraint, which prevents IAM policies from granting access to users outside specified trusted domains. The 'Domain Restricted Sharing' organization policy constraint (constraints/iam.allowedPolicyMemberDomains) explicitly prevents IAM policies from granting access to principals outside of specified trusted domains. This directly blocks sharing BigQuery data with external Google accounts by enforcing that all IAM members belong to the allowed domains, such as the company's own Google Workspace domain.

Answer

Enabling BigQuery data encryption with CMEK to prevent external parties from decrypting shared data

Answer

BigQuery row-level security policies that restrict rows based on user email domain

Answer

Disabling external IP addresses on all Google Cloud resources to prevent data from leaving the organization's network

Question 2

A company needs to run a legacy application that requires full control over the operating system, including custom kernel modules. They want to minimize management overhead for the underlying hardware. Which cloud service model should they use?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where the customer manages the OS and above, while the cloud provider manages the hardware and hypervisor.

Answer

PaaS

Answer

FaaS

Answer

SaaS

Question 3

A solutions architect is explaining why using managed cloud database services (like Cloud SQL or Cloud Spanner) is preferable to running a database on a self-managed virtual machine in most cases. What is the primary operational advantage of managed database services over self-managed databases on VMs?

Accepted Answer

Managed database services automate operational tasks like backups, patching, HA failover, and scaling — freeing engineering teams to focus on application development rather than database administration. Managed database services like Cloud SQL and Cloud Spanner abstract away the operational overhead of database administration. They automate critical tasks such as automated backups, patch management, high-availability failover, and horizontal scaling, which allows engineering teams to focus on application logic rather than managing database servers, replication, or storage.

Answer

Managed databases are always significantly cheaper than self-managed databases on VMs

Answer

Managed databases guarantee better query performance than self-managed databases for all workload types

Answer

Managed databases provide stronger data encryption than self-managed databases on VMs

Question 4

A company runs batch analytics jobs every night using Apache Spark on a cluster. The jobs require 100 vCPUs and run for 3 hours. The cluster must be created, run, and then shut down automatically to minimise cost. Which service should they use?

Accepted Answer

Cloud Dataproc. Cloud Dataproc is a managed Spark/Hadoop service that supports job-scoped clusters: you define a cluster configuration, submit a job, and the cluster is automatically deleted after completion. Compute Engine requires manual management. Dataflow is for Beam, not Spark. GKE is generic Kubernetes, not optimised for Spark batch jobs.

Answer

Cloud Dataflow

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine with managed instance groups

Question 5

A company wants to replace its VPN-based remote access with a solution that grants access based on user identity, device security status, and context (e.g., location, IP). Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise provides zero-trust remote access without a VPN, using identity and context-aware access policies.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 6

An online retailer stores product images in a Cloud Storage bucket. Current access patterns: images uploaded once and read frequently for 30 days, then accessed rarely after 90 days, and must be retained for 7 years for compliance. Which storage class transition strategy minimizes cost while meeting requirements?

Accepted Answer

Upload to Standard, lifecycle rule to Nearline at 30 days, then to Archive at 90 days. Start in Standard for frequent reads, then transition to Nearline after 30 days (lower cost for infrequent access), then to Archive after 90 days for long-term retention at lowest cost.

Answer

Upload to Nearline, lifecycle rule to Archive at 30 days

Answer

Upload to Standard, lifecycle rule to Nearline at 30 days, then to Coldline at 90 days

Answer

Upload to Standard, lifecycle rule to Coldline at 30 days, then to Archive at 90 days

Question 7

A developer wants to deploy a containerized web application that automatically scales to zero when not in use, and they want to minimize operational overhead. Which compute service should they use?

Accepted Answer

Cloud Run. Cloud Run is a serverless compute platform that executes containers in a fully managed environment, automatically scaling from zero to thousands of requests per second. It is ideal for containerized stateless applications that need to scale down to zero. Google Kubernetes Engine (GKE) does not scale to zero, Compute Engine requires VM management, and App Engine Flexible does not support custom containers that scale to zero as seamlessly.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine Flexible Environment

Question 8

A company needs to encrypt data at rest using keys that they manage, but they want to reduce operational overhead by having Google Cloud host the key management infrastructure. Which TWO options achieve this? (Choose 2)

Accepted Answer

Cloud HSM. CMEK uses Cloud KMS to manage keys, which Google hosts. CSEK requires the customer to supply and manage keys outside Google. Google-managed keys are not customer-managed. Cloud HSM is a hardware security module that can be used with CMEK. Secret Manager is for secrets, not encryption keys.

Answer

Secret Manager

Answer

Google-managed encryption keys

Answer

Customer-supplied encryption keys (CSEK)

Question 9

An organization stores sensitive data in BigQuery. They need to restrict access to specific columns based on user role, while allowing analysis at the dataset level. Which feature should they use?

Accepted Answer

Column-level access control using authorized views or taxonomy policies. BigQuery column-level access control, implemented through authorized views or taxonomy policies (via Data Catalog), allows restricting access to specific columns while preserving dataset-level analysis permissions. Authorized views use SQL logic to expose only permitted columns, and taxonomy policies apply fine-grained access controls at the column level without requiring separate datasets.

Answer

BigQuery row-level security

Answer

IAM roles at the dataset level with fine-grained permissions

Answer

Cloud Data Loss Prevention (DLP) to mask data

Question 10

A company uses Cloud CDN to deliver static content. They notice that some content is being served stale despite a TTL of 1 hour. What should they check to ensure content is always fresh?

Accepted Answer

Verify that the origin server sets appropriate Cache-Control headers (e.g., max-age=3600).. Cloud CDN relies on the Cache-Control: max-age directive from the origin server to determine how long content should be considered fresh. If the origin does not set max-age=3600 (or a comparable value), Cloud CDN may serve stale content even if the CDN TTL is configured to 1 hour, as the CDN respects the origin's cache headers by default. Ensuring the origin sets appropriate Cache-Control headers guarantees that Cloud CDN caches content for the intended duration.

Answer

Enable cache invalidation for all objects daily.

Answer

Increase the TTL in the CDN configuration to 24 hours.

Answer

Use Cloud Storage as the origin and set caching to 'public'.

Question 11

An organization's digital transformation initiative is failing to deliver expected outcomes despite significant cloud technology investment. A review reveals that business units operate in silos, processes remain unchanged, and employees resist new ways of working. Which factor is most likely the root cause of the failure?

Accepted Answer

Insufficient change management, cultural resistance, and siloed operations are preventing the organization from realizing technology benefits. The failure stems from organizational and cultural factors—siloed operations, unchanged processes, and employee resistance—which are classic symptoms of inadequate change management. Cloud technology alone cannot drive transformation; it must be paired with process reengineering and cultural adoption. The GCDL framework emphasizes that digital transformation is as much about people and processes as it is about technology.

Answer

The organization chose the wrong cloud provider for its technical workloads

Answer

The cloud services selected are not technically advanced enough to deliver transformation outcomes

Answer

The organization is spending too much on cloud services, leaving insufficient budget for transformation

Question 12

A company is building a real-time analytics pipeline on Google Cloud. They need to ingest streaming data from IoT devices, process it with low latency, and then store the results for real-time querying. Which TWO services should they use? (Choose TWO.)

Accepted Answer

Cloud Pub/Sub. Pub/Sub ingests streaming data reliably, and Dataflow processes it with low latency. Other options are not suitable for real-time streaming analytics.

Answer

Cloud Storage

Answer

Cloud Functions

Answer

BigQuery

Question 13

A company wants to reduce costs for their Compute Engine workloads. They have predictable baseline usage and are willing to commit to a 1-year term. They also want to automatically get discounts for instances running more than 25% of a month. Which THREE options should they use? (Select THREE)

Accepted Answer

Apply CUDs at the project or folder level.. Committed use discounts are for predictable workloads with 1 or 3 year terms. Sustained use discounts automatically apply to instances running >25% of a month. Committed use discounts can be applied at the project or folder level. Preemptible VMs are not suitable for predictable workloads. Billing export does not reduce costs. Budgets do not provide discounts.

Answer

Use preemptible VMs for all workloads.

Answer

Set up billing export to BigQuery.

Question 14

A company runs a critical application on Compute Engine that must always be available, even if an entire zone fails. The application stores state in a Cloud Spanner instance. The operations team wants to test disaster recovery procedures without affecting production. Which TWO actions should they take? (Select two.)

Accepted Answer

Create a Cloud Spanner clone from the production instance for testing. To test DR without impacting production, you can create a clone of the production Spanner instance (which creates a point-in-time copy) and perform testing on the clone. Alternatively, you can set up a separate test environment with its own Spanner instance. Restoring a backup to a new instance is also valid. However, the question asks for TWO actions. Modifying production IAM roles could affect access; failing over a regional Spanner instance would cause downtime.

Answer

Use the same Spanner instance but with a different database

Answer

Perform a manual failover of the production Spanner instance to another region

Answer

Modify IAM roles to grant testers read-only access to production

Question 15

A startup wants to launch a social media app globally. They have no existing IT infrastructure and very limited capital. The app will experience unpredictable traffic patterns, with usage expected to rapidly grow after viral campaigns. They need low latency for users across North America, Europe, and Asia. The development team is small and wants to focus on coding rather than operations. They also need to store user-generated content like images and videos. The CTO is evaluating whether to build on-premises or use cloud services. Which approach best meets their needs?

Accepted Answer

Build the app on Compute Engine with managed instance groups, use Cloud CDN for global low-latency delivery, and Cloud Storage for user content.. It leverages Google Cloud's fully managed services to meet the startup's needs: Compute Engine with managed instance groups provides auto-scaling for unpredictable traffic, Cloud CDN ensures low-latency global content delivery, and Cloud Storage offers scalable, durable storage for user-generated content. This serverless-like approach minimizes operational overhead, allowing the small team to focus on coding.

Answer

Deploy a single large virtual machine in one region and rely on a CDN to serve content globally.

Answer

Purchase and configure servers in a single colocation facility, and use a content delivery network (CDN) for static assets.

Answer

Use a hybrid cloud model: keep a small on-premises server for core features and burst to the cloud for extra capacity.

Question 16

A company wants to deploy a web application that automatically scales based on traffic, and they do not want to manage infrastructure. The application is written in Python and uses a Flask framework. Which TWO Google Cloud services could they use?

Accepted Answer

Cloud Run. App Engine Standard supports Python and Flask, automatically scaling to zero. Cloud Run can run containerized Flask applications, scaling to zero based on requests. Compute Engine requires VM management. Cloud Functions is for small snippets, not full web apps. GKE requires cluster management.

Answer

Google Kubernetes Engine

Answer

Cloud Functions

Answer

Compute Engine

Question 17

Drag and drop the steps to enable and use Cloud Audit Logs for a project into the correct order.

Accepted Answer

Navigate to the Audit Logs page, select the services and log types, save the configuration, then view the logs.. First navigate to audit logs, then select services and log types, save, and finally view the logs.

Answer

Select the services and log types, navigate to the Audit Logs page, save the configuration, then view the logs.

Answer

Navigate to the Audit Logs page, save the configuration, select the services and log types, then view the logs.

Answer

Navigate to the Audit Logs page, select the services and log types, view the logs, then save the configuration.

Question 18

A company wants to add location-based features to their mobile app: showing nearby stores, calculating driving routes, and embedding interactive maps. Which Google Cloud platform provides these mapping and location services?

Accepted Answer

Google Maps Platform. Google Maps Platform is the correct choice because it provides the specific APIs needed for location-based features: Places API for nearby stores, Directions API for driving routes, and Maps SDK for embedding interactive maps. Cloud Spanner, IoT Core, and BigQuery Geo Viz are not designed to deliver these front-end mapping and routing services.

Answer

Cloud Spanner — it stores geolocation data with ACID transactions.

Answer

Cloud IoT Core — it tracks device locations in real time.

Answer

BigQuery Geo Viz — it visualizes geographic data on a map.

Question 19

A developer accidentally commits an application's Google Cloud service account key to a public GitHub repository. The key is valid and grants access to production resources. What is the correct immediate response?

Accepted Answer

Immediately revoke/delete the exposed service account key in Google Cloud IAM, review Cloud Audit Logs for unauthorized access, and generate a new key distributed through secure channels. The immediate priority is to invalidate the exposed credential to prevent unauthorized access to production resources. Revoking the key in Google Cloud IAM ensures it can no longer be used for authentication, while reviewing Cloud Audit Logs helps identify any potential misuse. Generating a new key and distributing it securely restores access for legitimate applications.

Answer

Delete the commit from GitHub history using git rebase; the key is safe once removed from the repository

Answer

Change the service account's permissions to read-only to limit the damage from potential misuse

Answer

Send an internal email informing the security team and wait for their guidance before taking any action

Question 20

A security team wants to find misconfigurations and vulnerabilities across their Google Cloud environment, including VMs, storage, and IAM. Which service provides a unified view of these findings?

Accepted Answer

Security Command Center. Security Command Center provides a centralized view of vulnerabilities and misconfigurations. Cloud Audit Logs are for auditing actions. Cloud IDS is for network threats. Assured Workloads is for compliance.

Answer

Cloud IDS

Answer

Assured Workloads

Answer

Cloud Audit Logs