Cloud Digital Leader Practice Exam 52 — 20 Questions

Question 1

A CISO asks why Google Cloud's security model is described as a 'defense-in-depth' approach. Which explanation best describes this concept in the context of Google Cloud's infrastructure security?

Accepted Answer

Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system. Google Cloud's defense-in-depth model implements security at multiple independent layers: physical security (e.g., tamper-evident cages), hardware attestation (e.g., Titan chips verifying boot integrity), network encryption (e.g., mTLS between all services), hypervisor isolation (e.g., gVisor or KVM-based sandboxing), and application-level IAM (e.g., Cloud IAM policies). This layered approach ensures that if an attacker bypasses one layer, other layers remain intact to protect the system, aligning with the core principle of defense in depth.

Answer

Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data

Answer

Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary

Answer

Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure

Question 2

A startup expects unpredictable Compute Engine usage and wants to minimize costs without manual intervention. Which discount type automatically applies to VM instances that run for more than 25% of a month?

Accepted Answer

Sustained use discounts. Sustained use discounts (SUDs) are automatically applied to Compute Engine instances that run for more than 25% of a month. They provide a discount on the incremental usage beyond that threshold, with the discount increasing the longer the instance runs. No manual action or commitment is required, making them ideal for unpredictable workloads.

Answer

Committed use discounts

Answer

Spot VM discounts

Answer

Preemptible VM discounts

Question 3

A data engineer needs to process a continuous stream of events from a global user base, perform real-time transformations, and write the results to both Cloud Storage and BigQuery. The solution must handle sudden traffic spikes and be fully managed (no server management). Which combination of services should the engineer use?

Accepted Answer

Pub/Sub, Dataflow, Cloud Storage, BigQuery. Pub/Sub ingests the continuous global event stream, Dataflow performs the real-time transformations in a fully managed, autoscaling way, and the pipeline can write results to both Cloud Storage and BigQuery as sinks. This combination meets every requirement: global ingestion, real-time processing, dual output, spike handling via autoscaling, and no server management. Dataflow is the only option that natively supports streaming transformations with exactly-once semantics and writes to multiple sinks.

Answer

Pub/Sub, Cloud Functions, Cloud Storage

Answer

Pub/Sub, Dataflow, Cloud Functions

Answer

Cloud Scheduler, Cloud Functions, BigQuery

Question 4

A retail company experiences sudden traffic spikes during flash sales. Their on-premises infrastructure often runs out of capacity, causing website slowdowns. Which cloud characteristic directly solves this problem?

Accepted Answer

Scalability. Scalability is the cloud characteristic that allows infrastructure to automatically expand or contract in response to demand, which directly addresses the flash-sale traffic spikes that overwhelm fixed on-premises capacity. In cloud environments, horizontal scaling (adding more instances) or vertical scaling (larger instances) can be triggered by metrics like CPU or request rate, so the website absorbs the surge without slowdowns. Pay-as-you-go pricing is a billing model, not a capacity mechanism, so it does not solve the capacity shortfall itself.

Answer

Pay-as-you-go pricing

Answer

Global reach

Answer

Security

Question 5

An organization uses Google Cloud Identity and Access Management (IAM). A new employee is a data engineer who needs to read BigQuery datasets and run queries but should NOT be able to create new datasets, delete tables, or modify IAM policies. Which IAM role should be assigned?

Accepted Answer

`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries). The `roles/bigquery.dataViewer` role grants read access to BigQuery datasets and their contents, while `roles/bigquery.jobUser` allows the user to run query jobs. Together, they satisfy the requirement to read datasets and run queries without permitting dataset creation, table deletion, or IAM policy modification.

Answer

`roles/bigquery.admin`

Answer

`roles/viewer` (project-level Viewer)

Answer

`roles/bigquery.dataEditor`

Question 6

An organisation must store archival data that is accessed less than once a year. They need the lowest storage cost and can tolerate a retrieval time of several hours. Which Cloud Storage class should they use?

Accepted Answer

Archive. Archive is the correct choice because it is Google Cloud's lowest-cost storage class, designed for data accessed less than once a year. It offers the cheapest per-GB storage price and a minimum storage duration of 365 days, with retrieval times typically ranging from milliseconds to hours depending on the access method. The organisation's requirement for the lowest cost and tolerance for several hours of retrieval time aligns perfectly with Archive's cost-performance profile.

Answer

Coldline

Answer

Nearline

Answer

Standard

Question 7

An organization needs to store archival data that must be retained for 10 years and is accessed less than once a year. Which Cloud Storage class offers the lowest storage cost?

Accepted Answer

Archive. Archive is the lowest-cost storage class in Google Cloud Storage, designed for data accessed less than once a year and retained for long periods (minimum 365 days). It offers the cheapest storage price per GB, making it ideal for 10-year archival data with rare access.

Answer

Standard

Answer

Coldline

Answer

Nearline

Question 8

An organization wants to use machine learning to analyze customer feedback but has no ML expertise. They need a service that can train custom models with minimal coding. Which Google Cloud service should they use?

Accepted Answer

AutoML Natural Language. AutoML Natural Language is a Google Cloud service that allows users with limited ML expertise to train custom machine learning models for text classification, sentiment analysis, and entity extraction with minimal coding. It provides a user-friendly interface and requires only labeled data, automating the model selection and training process. This directly addresses the organization's need to analyze customer feedback without ML expertise. Other options either require more expertise (Vertex AI) or are pre-trained APIs not customizable for specific needs (Cloud Vision API, Cloud Natural Language API).

Answer

Cloud Vision API

Answer

Vertex AI

Answer

Cloud Natural Language API

Question 9

An organization wants to allow their finance team to view billing account cost information but prevent them from making any changes to the billing account. Which IAM role should they grant?

Accepted Answer

Billing Account Viewer. The Billing Account Viewer role grants read-only access to billing account cost information, including viewing budgets, costs, and billing account details, without permission to modify the billing account. This matches the requirement to let the finance team view costs while preventing changes. It is the least-privilege role for read-only billing visibility.

Answer

Billing Account Admin

Answer

Project Billing Manager

Answer

Billing Account User

Question 10

An organization wants to use Google Cloud to analyze large-scale genomic data. The data is stored in Cloud Storage in a compressed format. They need to run a custom Python pipeline that preprocesses the data and then uses a GPU-intensive algorithm for alignment. The preprocessing is CPU-bound and takes 30 minutes per sample, while the alignment takes 1 hour per sample on a GPU. They have thousands of samples. Which compute approach is MOST cost-effective?

Accepted Answer

Use preemptible VMs with CPU for preprocessing and preemptible VMs with GPU for alignment, with checkpointing. Preemptible VMs are significantly cheaper (up to 80% discount) than regular VMs, and the workload is fault-tolerant if checkpointing is used. The preprocessing is CPU-bound and the alignment is GPU-bound, so using preemptible CPU VMs for preprocessing and preemptible GPU VMs for alignment minimizes cost. Checkpointing allows the pipeline to resume after a preemption without losing all progress, making this the most cost-effective approach for thousands of samples.

Answer

Use committed use discounts for 1 year on GPU instances

Answer

Use regular VMs with both CPU and GPU on the same instance

Answer

Use sole-tenant nodes for data isolation

Question 11

A company runs a web application on Compute Engine instances behind a managed instance group with autoscaling based on CPU utilization. After a marketing campaign, traffic spikes and the autoscaler adds instances quickly, but the application becomes slow. What is the most likely cause?

Accepted Answer

Autoscaler uses CPU utilization but the application is memory-bound. The autoscaler adds instances based on CPU utilization, but if the application is memory-bound, adding more instances does not alleviate memory pressure. Each new instance still runs the same memory-intensive workload, so CPU may remain low while memory is exhausted, causing slowdowns. The autoscaler fails to address the actual bottleneck, leading to poor performance despite scaling out.

Answer

Instances are in different zones causing inter-zone latency

Answer

Autoscaling cooldown period is too short

Answer

Health check interval is too long

Question 12

What is the primary benefit of using preemptible VMs on Compute Engine?

Accepted Answer

Cost savings for fault-tolerant workloads. Preemptible VMs on Compute Engine are deeply discounted (up to 60-91% off on-demand) but can be terminated by Google at any time with a 30-second warning, making them ideal for fault-tolerant, stateless, or batch workloads that can tolerate interruption. The primary benefit is therefore cost savings for workloads designed to handle preemption. They are not for guaranteed-availability or high-performance use cases.

Answer

Support for live migration

Answer

Higher performance than standard VMs

Answer

Guaranteed availability of resources

Question 13

A development team needs a managed relational database (MySQL or PostgreSQL) for their web application. They want automatic backups, patching, and high availability without managing a database server. Which Google Cloud service provides this?

Accepted Answer

Cloud SQL. Cloud SQL is a fully managed relational database service for MySQL, PostgreSQL, and SQL Server. It handles automated backups, patching, and high availability (via regional failover replicas) without requiring the user to manage the underlying database server, directly matching the team's requirements.

Answer

Compute Engine with a self-managed MySQL installation.

Answer

Cloud Bigtable

Answer

Cloud Storage

Question 14

A financial company wants to run sensitive workloads on Google Cloud while ensuring data never leaves a specific geographic boundary and meets strict compliance requirements. Which THREE Google Cloud services should they combine?

Accepted Answer

Assured Workloads for Government. Assured Workloads for Government (B) is correct because it enforces regulatory and data-residency controls on a folder, restricting where resources and data can be created and applying compliance frameworks such as FedRAMP, ITAR, and data-boundary policies. Cloud HSM with CMEK (D) is correct because Cloud HSM provides FIPS 140-2 Level 3 validated hardware key management, and CMEK lets the company retain control of the encryption keys used for its data at rest, satisfying strict key-custody and compliance requirements. VPC Service Controls (E) is correct because it creates a service perimeter around the project that prevents data exfiltration from managed services like Cloud Storage and BigQuery, which directly supports keeping sensitive data inside a defined geographic and organizational boundary. Cloud VPN (A) is not correct because it only provides encrypted connectivity between on-premises networks and Google Cloud, not data-residency or compliance enforcement. Cloud NAT (C) is not correct because it merely allows outbound internet access for private instances and has no role in data residency or regulatory compliance.

Answer

Cloud VPN

Answer

Cloud NAT

Question 15

A company has a stateful application running on Compute Engine. They want to scale horizontally while preserving state. Which configuration should they use?

Accepted Answer

Managed instance group with stateful configuration.. A managed instance group (MIG) with stateful configuration preserves instance-specific state (such as disks, hostnames, and metadata) across autohealing and rolling updates. This allows the stateful application to scale horizontally while maintaining its persistent data, as each instance retains its unique state even when the group is resized or instances are recreated.

Answer

Use Cloud Run with volumes.

Answer

Unmanaged instance group.

Answer

Managed instance group with autoscaling and no stateful configuration.

Question 16

A company is concerned that employees might accidentally or maliciously upload sensitive personal data (such as credit card numbers or Social Security Numbers) to Cloud Storage buckets. Which Google Cloud product can automatically scan uploaded files and identify sensitive data patterns?

Accepted Answer

Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection. Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to inspect and classify sensitive data within Cloud Storage objects. It uses built-in detectors (infoTypes) to identify patterns like credit card numbers (Luhn check) and Social Security Numbers, and can trigger automated actions such as redaction or logging when sensitive data is found.

Answer

Cloud Armor, which inspects incoming HTTP requests for sensitive data patterns

Answer

Cloud Logging, which records all file upload events to Cloud Storage

Answer

Security Command Center, which audits Cloud Storage bucket permissions

Question 17

A startup is deploying a containerised web application on Google Cloud. They want to minimise operational overhead and only pay for the resources consumed when requests are being processed. The application should automatically scale to zero when idle. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when idle and charges only for request processing time. App Engine is also serverless but requires a runtime environment and does not scale to zero as gracefully. Compute Engine and GKE require provisioning instances even if idle.

Answer

App Engine Standard

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Question 18

A web application's homepage loads user-specific data (shopping cart, recent orders) on every visit. The data changes frequently. An engineer suggests caching this data in a Redis cache between the web tier and the database. What is the primary benefit of this caching layer?

Accepted Answer

Caching reduces database load and improves response times by serving frequently accessed data from fast in-memory storage.. Caching user-specific data like shopping carts and recent orders in Redis reduces the load on the primary database by serving frequently accessed data from fast in-memory storage. This improves response times for the web application, as Redis can deliver data in microseconds compared to the millisecond latency of a typical relational database query. The caching layer acts as a temporary, high-speed buffer that offloads read-heavy traffic from the database, which is especially beneficial for data that changes frequently but is read often.

Answer

Caching encrypts data in transit between the web tier and database.

Answer

Caching permanently stores user data so the database can be deleted.

Answer

Caching automatically synchronizes data between multiple database replicas.

Question 19

A company's IT team is planning its network architecture for a Google Cloud deployment. They want to ensure that their development, staging, and production environments are completely isolated from each other at the network level. What is the most effective way to achieve this isolation in Google Cloud?

Accepted Answer

Deploying each environment (dev, staging, prod) in separate VPC networks — optionally in separate Google Cloud projects — to achieve complete network isolation with no default connectivity between environments. Deploying each environment in separate VPC networks (optionally in separate projects) provides complete network isolation by default. In Google Cloud, VPC networks are isolated entities with no inherent peering or connectivity; traffic between them requires explicit VPC peering or VPN configurations. This ensures that development, staging, and production environments cannot communicate at the network layer unless intentionally connected, meeting the requirement for complete isolation.

Answer

Using separate subnets within the same VPC for each environment, with firewall rules blocking cross-subnet traffic

Answer

Using different IP address ranges for each environment within the same network

Answer

Using Cloud IAM to restrict developers from accessing production resources, which achieves the same isolation as network separation

Question 20

A small startup can now access the same world-class AI, machine learning, and global infrastructure that previously only Fortune 500 companies with billion-dollar IT budgets could afford. Which cloud characteristic enables this competitive equalization?

Accepted Answer

Cloud's pay-per-use model and managed services give any organization access to enterprise-grade capabilities without large upfront capital investment.. The cloud's pay-per-use model eliminates the need for large upfront capital expenditures, while managed services (e.g., AWS RDS, Azure SQL Database, Google Cloud AI Platform) abstract away the operational complexity of maintaining enterprise-grade infrastructure. This allows a small startup to leverage the same AI/ML models, GPU clusters, and global network backbones that Fortune 500 companies use, paying only for what they consume rather than provisioning for peak capacity.

Answer

Cloud providers charge smaller companies lower rates than enterprises.

Answer

Cloud providers assign dedicated infrastructure to small companies so they always have priority access.

Answer

Government regulations require cloud providers to offer equal service levels to all customers.