Cloud Digital Leader Practice Exam 53 — 20 Questions

Question 1

A consumer goods company uses cloud-based demand sensing — analyzing real-time sales signals, social media trends, and weather data to adjust production runs dynamically. This has reduced stockouts by 35% and overstock waste by 28%. Which aspect of digital transformation does this most directly exemplify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Operational transformation through real-time data integration and machine learning that enables continuous, signal-driven production decisions. The scenario describes a shift from static, forecast-based production to dynamic, signal-driven decisions using real-time data integration (sales signals, social media, weather) and machine learning. This directly exemplifies operational transformation, a core pillar of digital transformation where cloud-based analytics and AI enable continuous optimization of core business processes like manufacturing.

Answer

Cost reduction through infrastructure consolidation and server decommissioning

Answer

Business continuity improvement through data backup and disaster recovery in the cloud

Answer

Employee productivity improvement through providing staff with cloud-based collaboration tools

Question 2

A developer needs to grant a service account the minimum permissions required to publish messages to a Pub/Sub topic. Which IAM role should they assign?

Accepted Answer

roles/pubsub.publisher. The `roles/pubsub.publisher` role grants the minimum permissions required to publish messages to a Pub/Sub topic. This role includes the `pubsub.topics.publish` permission, which allows a service account to send messages to a specific topic without granting any other unnecessary permissions like subscribing or managing the topic.

Answer

roles/editor

Answer

roles/pubsub.subscriber

Answer

roles/pubsub.admin

Question 3

A company migrated a microservices application to Google Kubernetes Engine (GKE). They set up an internal HTTP(S) load balancer to route traffic to the services. However, some pods are not receiving traffic. What is the most likely cause?

Accepted Answer

The pods have failing readiness probes that are preventing them from being added to the load balancer's backend endpoints.. GKE internal HTTP(S) load balancers use network endpoint groups (NEGs) that only include pod IPs whose readiness probes are passing. If a pod's readiness probe fails, the pod is removed from the backend endpoints and receives no traffic, even though it is Running. This is the most common cause of 'some pods not receiving traffic' in GKE.

Answer

The service type is NodePort instead of LoadBalancer.

Answer

The cluster does not have enough nodes to schedule the pods.

Answer

The firewall rules are not allowing traffic from the load balancer to the nodes.

Question 4

A startup wants to run a containerized web application that scales to zero when not in use, and only pay for the time the container is processing requests. Which Google Cloud compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a fully managed serverless compute platform that automatically scales your containerized application to zero when there are no incoming requests. You are billed only for the resources consumed during request processing, measured in 100-millisecond increments, which aligns perfectly with the requirement to pay only for active processing time.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard Environment

Answer

Compute Engine with autoscaling

Question 5

A global e-commerce company is moving its user-facing application to Google Cloud to improve performance for customers worldwide. They need low-latency content delivery and fast DNS resolution. Which TWO Google Cloud services should they use? (Choose 2)

Accepted Answer

Cloud CDN. Cloud CDN (A) is correct because it caches the application's static and dynamic content at Google's globally distributed edge points of presence, serving users from the location closest to them and thereby reducing latency for worldwide customers. Cloud DNS (B) is correct because it is Google's highly available, low-latency authoritative DNS service running on the same global anycast network, which delivers fast DNS resolution for the user-facing domain. Cloud Interconnect (C) is not correct here because it provides dedicated private connectivity between an on-premises network and Google Cloud, not edge content delivery or public DNS resolution. Cloud Armor (D) is a WAF/DDoS protection service for filtering malicious traffic, which addresses security rather than latency. Cloud Load Balancing (E) distributes traffic across backends and can complement CDN, but it is not the service that provides edge caching or fast DNS resolution as requested.

Answer

Cloud Interconnect

Answer

Cloud Armor

Answer

Cloud Load Balancing

Question 6

A company uses Google Workspace for email, documents, and meetings. They want to leverage an AI assistant that can help draft emails, create slides, and summarise meeting notes. Which product provides this functionality?

Accepted Answer

Gemini for Workspace. Gemini for Workspace is an AI assistant integrated into Google Workspace applications like Gmail, Docs, Slides, and Meet. It can help draft emails, create slides, and summarise meeting notes, directly leveraging the context of the user's Workspace data.

Answer

Vertex AI

Answer

Cloud Natural Language

Answer

Dialogflow

Question 7

An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?

Accepted Answer

VPC Service Controls with an access level that includes the IP range. VPC Service Controls with an access level that includes the specified IP range is the correct way to enforce that API calls to a Cloud Storage bucket originate only from a limited set of IP addresses. Access levels in VPC Service Controls define conditions such as IP ranges, and when attached to a service perimeter, they restrict access to the protected service (Cloud Storage) based on those conditions. This provides centralized, identity- and context-aware enforcement at the API level.

Answer

Cloud Armor security policy

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Question 8

A CTO explains to her board that moving to cloud reduces the company's 'total cost of ownership' compared to running an on-premises data center. Which cost category is most commonly underestimated in on-premises TCO calculations?

Accepted Answer

IT staff labor costs for ongoing maintenance, patching, hardware replacement, and operations, which are frequently underestimated in on-premises TCO. On-premises TCO calculations frequently underestimate the labor costs associated with ongoing IT staff tasks such as applying security patches, performing hardware replacements, managing firmware updates, and handling day-to-day operations. These operational expenses (OpEx) accumulate over the lifecycle of the data center and often exceed the initial capital expenditure (CapEx) for hardware, making them a critical but overlooked component in total cost of ownership comparisons with cloud providers like AWS, Azure, or GCP.

Answer

Hardware acquisition costs, which are typically overestimated in on-premises environments

Answer

Software licensing costs, which are always higher on-premises than in the cloud

Answer

Internet bandwidth costs, which are negligible on-premises

Question 9

A company currently uses Hadoop and Spark for batch data processing on a large on-premises cluster. They want to migrate these workloads to Google Cloud with minimal rewriting of existing Spark and Hadoop jobs. Which Google Cloud service is the best fit?

Accepted Answer

Cloud Dataproc — managed Apache Spark and Hadoop with minimal code changes.. Cloud Dataproc is a managed service for running Apache Spark and Hadoop clusters on Google Cloud. It supports the same open-source versions of Spark and Hadoop that the company currently uses, allowing them to migrate their existing batch processing workloads with minimal code changes. This makes it the best fit for the stated requirement of minimal rewriting.

Answer

Cloud Dataflow — it runs all Spark and Hadoop jobs natively.

Answer

BigQuery — it runs Spark SQL queries via BigQuery Spark stored procedures.

Answer

Google Kubernetes Engine — deploy Spark clusters on Kubernetes.

Question 10

A company wants to know: if Google Cloud experiences a data breach that exposes customer data, what are Google's notification obligations under standard Cloud service terms?

Accepted Answer

Google will notify affected customers of personal data breaches without undue delay per its Data Processing Addendum, enabling customers to meet their own regulatory notification obligations.. Google Cloud's standard Data Processing Addendum (DPA) contractually obligates Google to notify affected customers of personal data breaches without undue delay after confirmation. This enables customers to fulfill their own regulatory notification requirements under laws like GDPR or CCPA, as the customer remains the data controller responsible for end-user notifications.

Answer

Google has no obligation to notify customers of data breaches — customers must discover breaches themselves.

Answer

Google will notify all media outlets immediately upon breach detection to maximize transparency.

Answer

Breach notification is only available to customers with Premium support tier.

Question 11

A traditional brick-and-mortar bookstore chain wants to use cloud technology to compete with online retailers. The store manager proposes putting all store inventory data in the cloud. The digital transformation advisor says this is only the first step. What does the advisor mean?

Accepted Answer

Storing data in the cloud is infrastructure migration; transformation means using that data and cloud capabilities to create new customer experiences, personalized recommendations, omnichannel shopping, and demand prediction. Digital transformation goes beyond mere infrastructure migration (like moving data to the cloud). True transformation leverages cloud-native capabilities—such as serverless compute, AI/ML services, and real-time analytics—to reimagine business processes. In this scenario, storing inventory data in the cloud is just the first step; the bookstore must use that data to build personalized recommendation engines, omnichannel inventory visibility, and demand forecasting models, which fundamentally change how the business operates and competes.

Answer

The company also needs to migrate its email to a cloud-based provider before transformation is complete

Answer

The company must also migrate its accounting software to the cloud before claiming digital transformation

Answer

Cloud storage alone cannot store inventory data; additional specialized database services are required

Question 12

A company's operations team needs visibility into network traffic patterns, latency between services, and potential network bottlenecks across their Google Cloud deployment. Which Google Cloud product provides network performance monitoring, connectivity testing, and traffic analysis?

Accepted Answer

Network Intelligence Center, which provides network topology visualization, connectivity testing, firewall analysis, and performance monitoring. The Network Intelligence Center is the correct choice because it is a Google Cloud-native product specifically designed to provide network performance monitoring (latency, packet loss, throughput), connectivity testing (Connectivity Tests), and traffic analysis (Flow Tracer, Firewall Insights). It offers a unified dashboard for visualizing network topology, analyzing firewall rules, and diagnosing connectivity issues across VPCs, hybrid clouds, and on-premises environments, directly addressing the need for visibility into traffic patterns and bottlenecks.

Answer

Cloud Armor, which provides DDoS protection and traffic filtering

Answer

Cloud DNS, which translates domain names to IP addresses

Answer

Cloud VPN, which creates encrypted tunnels between cloud and on-premises networks

Question 13

A developer wants to run her application code without managing any servers, operating systems, or runtime environments. She wants to focus entirely on writing business logic. Which cloud service model best fits this requirement?

Accepted Answer

Serverless / Functions as a Service (FaaS), where the developer writes and deploys code functions and the provider manages all underlying infrastructure automatically. Serverless/FaaS (Option C) is the correct choice because it abstracts away all server, OS, and runtime management, allowing the developer to deploy individual functions that execute in response to events. The cloud provider automatically scales and manages the underlying infrastructure, so the developer writes only business logic without provisioning or patching anything.

Answer

Infrastructure as a Service (IaaS), where the developer provisions virtual machines and installs the runtime

Answer

Platform as a Service (PaaS), where the developer deploys code to a managed platform that handles the OS and runtime

Answer

Software as a Service (SaaS), where the developer uses a fully managed application built by the cloud provider

Question 14

A company wants to ensure that sensitive data (credit card numbers, SSNs) stored in BigQuery is automatically identified and protected. They also want ongoing scanning to detect if any new data violates their data governance policies. Which Google Cloud service provides these capabilities?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.. Cloud DLP with BigQuery inspection jobs is the correct choice because it provides both automated identification of sensitive data (such as credit card numbers and SSNs) within BigQuery tables and ongoing scanning capabilities via scheduled inspection jobs. Cloud DLP uses built-in infoType detectors to match patterns like credit card numbers (Luhn check) and SSNs, and can trigger actions or alerts when new data violates governance policies.

Answer

Security Command Center — it scans BigQuery for sensitive data automatically.

Answer

Cloud Monitoring custom dashboards with SQL queries that search for PII patterns.

Answer

Cloud Audit Logs — they record all BigQuery queries and can identify when sensitive columns are accessed.

Question 15

A healthcare provider wants to use AI to analyze unstructured medical records — scanned documents with handwritten notes and printed text — to extract diagnosis codes for billing. Which combination of Google Cloud AI products most directly addresses this document understanding use case?

Accepted Answer

Document AI and Vision API, which together handle OCR, layout understanding, and information extraction from scanned documents with handwritten and printed text. Document AI is purpose-built for extracting structured information (like diagnosis codes) from unstructured documents, including both handwritten and printed text, using OCR and layout understanding. The Vision API complements this by providing advanced OCR capabilities for scanned images, together forming a direct solution for the healthcare provider's document understanding use case.

Answer

BigQuery ML and Looker Studio, to analyze and visualize the extracted diagnosis codes

Answer

Vertex AI Pipelines and Cloud Dataflow, to orchestrate machine learning training jobs on document data

Answer

Cloud Translation API and Natural Language API, to translate and analyze the text content of medical records

Question 16

A company is considering migrating its on-premises workloads to Google Cloud. Which TWO are common business drivers for cloud adoption? (Choose TWO.)

Accepted Answer

Cost optimization by converting CapEx to OpEx. Option A is correct because migrating to Google Cloud shifts IT spending from large upfront capital expenditures (CapEx) on hardware and data centers to pay-as-you-go operational expenditures (OpEx), which is a well-established financial driver for cloud adoption. Option C is correct because cloud providers like Google Cloud offer on-demand, self-service resource provisioning through services such as Compute Engine and Cloud Storage, enabling organizations to deploy and iterate faster and thereby accelerate time to market. Option B is incorrect because no cloud provider guarantees 100% uptime for all services; SLAs typically offer credits for failing to meet targets like 99.9% or 99.99%, not absolute uptime. Option D is incorrect because avoiding vendor lock-in is not a guaranteed outcome of cloud adoption and often requires deliberate multi-cloud or portable architectures; it is a concern to manage rather than a common driver. Option E is incorrect because cloud adoption does not eliminate security risks; it changes the shared responsibility model, and customers remain responsible for securing their workloads, identities, and data.

Answer

Guaranteed 100% uptime for all services

Answer

Ability to avoid any vendor lock-in

Answer

Elimination of all security risks

Question 17

A company is planning to migrate a legacy monolithic Linux application to Google Cloud. They want to minimize changes initially but have the flexibility to modernize later. Which three approaches should they consider?

Accepted Answer

Use Cloud Run for stateless containers. Option A is correct because Cloud Run runs stateless containers, so the legacy Linux application can be packaged into a container with minimal code changes and then modernized incrementally later. Option C is correct because Migrate for Anthos converts existing VM-based workloads into containers running on GKE, allowing a lift-and-shift migration with a path to modernization. Option E is correct because rehosting on Compute Engine with a custom image is the classic lift-and-shift approach, requiring almost no application changes while preserving future modernization options. Option B is not marked correct because App Engine Flexible requires replatforming the application to fit its runtime and deployment model, which is more change than the scenario wants initially. Option D is not marked correct because refactoring to microservices on GKE is a major architectural change, not a minimal-change migration.

Answer

Replatform to App Engine Flexible Environment

Answer

Refactor to microservices on GKE

Question 18

Which THREE of the following are compute services offered by Google Cloud? (Choose exactly 3.)

Accepted Answer

Compute Engine. Compute Engine (A) is correct because it is Google Cloud's Infrastructure-as-a-Service offering that provides configurable virtual machine instances running on Google's infrastructure. Cloud Functions (B) is correct because it is Google Cloud's serverless, event-driven Functions-as-a-Service platform that executes code in response to events without provisioning servers. App Engine (D) is correct because it is Google Cloud's fully managed Platform-as-a-Service for deploying web applications and APIs, abstracting away infrastructure management. Cloud Storage (C) is incorrect because it is an object storage service, not a compute service, and Cloud SQL (E) is incorrect because it is a fully managed relational database service rather than a compute platform.

Answer

Cloud Storage

Answer

Cloud SQL

Question 19

Which TWO of the following are common use cases for deploying workloads to the cloud? (Choose 2)

Accepted Answer

Running a global SaaS application for customers worldwide. Option D is correct because a global SaaS application benefits from the cloud's elastic, on-demand compute and storage and its worldwide regions and edge locations, which let providers scale to customers across geographies with low latency and pay only for consumed resources. Option E is correct because cloud object storage (e.g., Amazon S3, Azure Blob) and managed backup services make data backup and disaster recovery a canonical cloud use case, offering durable, geographically redundant copies and rapid restore without owning secondary data-center hardware. Option A does not belong because microsecond-latency high-frequency trading demands specialized co-location and dedicated low-latency networking that shared public-cloud infrastructure typically cannot guarantee. Option B does not belong because air-gapped, classified workloads require physical isolation with no internet connectivity, which contradicts the cloud's network-accessible, multi-tenant model. Option C does not belong because a legacy mainframe application needing dedicated hardware is a workload that generally stays on-premises or on dedicated hosted infrastructure rather than standard cloud deployment.

Answer

High-frequency trading requiring microsecond latency

Answer

Air-gapped, classified workloads with no internet connection

Answer

Running a legacy mainframe application that requires dedicated hardware

Question 20

A company is designing a disaster recovery plan for its critical application running on Google Kubernetes Engine (GKE) in us-central1. The application uses Cloud SQL (MySQL) as its database. Which TWO actions should the company take to achieve a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 1 hour in the event of a regional outage? (Choose two.)

Accepted Answer

Configure Cloud SQL for cross-region replication using a read replica in a different region.. Option C is correct because Cloud SQL cross-region replication maintains a continuously updated read replica in a different region, so in a regional outage the replica can be promoted with only seconds to minutes of data loss, satisfying the RPO of under 5 minutes. Option D is correct because deploying a GKE cluster in a second region and using Multi-cluster Ingress provides a pre-provisioned, load-balanced failover target so the application can be served from the surviving region within the 1-hour RTO. Option A is incorrect because 4-hour automated backups cannot meet an RPO of less than 5 minutes, since up to 4 hours of data could be lost. Option B is incorrect because a regional registry in the same region would itself be unavailable during a regional outage and does not address database recovery or RPO/RTO. Option E is incorrect because Cloud CDN only caches static content and does nothing to recover the GKE workload or Cloud SQL database during a regional failure.

Answer

Use Cloud SQL's automated backups with a backup schedule every 4 hours.

Answer

Store container images in a regional registry in the same region.

Answer

Use Cloud CDN to cache static content.