Cloud Digital Leader Practice Exam 54 — 20 Questions

Question 1

A multinational corporation needs to deploy a global web application that serves users from multiple continents. They want to minimize latency for end users by serving content from the nearest location. Which combination of Google Cloud services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Load Balancing (global) with Cloud CDN. Cloud CDN uses Google's globally distributed edge caches to deliver content close to users, reducing latency. A load balancer with global routing distributes traffic across regional backends and directs users to the nearest healthy backend.

Answer

Compute Engine with regional load balancers

Answer

Cloud Run with Cloud NAT

Answer

Cloud DNS with Traffic Director

Question 2

A financial services firm must store customer transaction logs for 7 years to comply with regulatory requirements. The data must be immutable after writing, and access should be restricted to authorized auditors only. Which storage solution and configuration should they use?

Accepted Answer

Cloud Storage with a retention policy set to 7 years. Cloud Storage with a retention policy (e.g., using Bucket Lock) makes objects immutable for a fixed period. Lifecycle management deletes objects, object versioning maintains versions, and object holds prevent deletion but allow overwrites.

Answer

Cloud Storage with object versioning enabled

Answer

Cloud Storage with object lifecycle management to delete objects after 7 years

Answer

Cloud Storage with object holds placed on each object

Question 3

What is the primary benefit of using preemptible VMs on Compute Engine?

Accepted Answer

Cost savings for fault-tolerant workloads. Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. They are ideal for fault-tolerant, batch workloads.

Answer

Support for live migration

Answer

Higher performance than standard VMs

Answer

Guaranteed availability of resources

Question 4

A company uses Google Workspace for email, documents, and meetings. They want to leverage an AI assistant that can help draft emails, create slides, and summarise meeting notes. Which product provides this functionality?

Accepted Answer

Gemini for Workspace. Duet AI (now Gemini for Workspace) provides AI-powered assistance across Gmail, Docs, Slides, Meet, and more.

Answer

Vertex AI

Answer

Cloud Natural Language

Answer

Dialogflow

Question 5

An organization wants to use Google Cloud to analyze large-scale genomic data. The data is stored in Cloud Storage in a compressed format. They need to run a custom Python pipeline that preprocesses the data and then uses a GPU-intensive algorithm for alignment. The preprocessing is CPU-bound and takes 30 minutes per sample, while the alignment takes 1 hour per sample on a GPU. They have thousands of samples. Which compute approach is MOST cost-effective?

Accepted Answer

Use preemptible VMs with CPU for preprocessing and preemptible VMs with GPU for alignment, with checkpointing. Using preemptible VMs for both steps can significantly reduce costs, especially for large batches. However, GPU preemptible pricing is also lower. The workload is batch and fault-tolerant if checkpointing is implemented. Committed use discounts require 1-year commitment; sole-tenant nodes are for isolation; independent scaling of CPU and GPU is not directly available without separate instance groups.

Answer

Use committed use discounts for 1 year on GPU instances

Answer

Use regular VMs with both CPU and GPU on the same instance

Answer

Use sole-tenant nodes for data isolation

Question 6

A global e-commerce company wants to build a product recommendation engine that suggests items to customers based on their real-time browsing behavior and purchase history. They want a pre-built solution that doesn't require building an ML recommendation model from scratch. Which Google Cloud product is purpose-built for retail recommendations?

Accepted Answer

Recommendations AI (Vertex AI Search for Retail). Recommendations AI (now part of Vertex AI Search for Retail) is Google Cloud's purpose-built, pre-built solution for retail product recommendations. It uses deep learning models trained on retail-specific data (e.g., clickstream, purchase history) to generate personalized suggestions without requiring the user to build or train an ML model from scratch.

Answer

BigQuery ML — build a collaborative filtering model using SQL.

Answer

Cloud SQL — query purchase history to find commonly bought-together products.

Answer

Cloud Dataflow — stream user clickstream data to build recommendations in real time.

Question 7

An organization wants to allow their finance team to view billing account cost information but prevent them from making any changes to the billing account. Which IAM role should they grant?

Accepted Answer

Billing Account Viewer. Billing Viewer role provides read-only access to billing account information.

Answer

Billing Account Admin

Answer

Project Billing Manager

Answer

Billing Account User

Question 8

A company runs batch processing jobs on scheduled intervals. They want to minimise costs by using short-lived compute capacity that can be interrupted but offers significant discounts. Which type of Compute Engine VM should they use?

Accepted Answer

Preemptible VMs. Preemptible VMs (and Spot VMs) offer up to 60-91% discount but can be terminated at any time, making them ideal for batch jobs that can tolerate interruptions.

Answer

E2 high-memory VMs

Answer

Sole-tenant nodes

Answer

Confidential VMs

Question 9

A data team has an IAM policy on a BigQuery dataset as shown. Alice needs to run a query that joins across multiple datasets. She receives a permission error. What is the most likely cause?

Accepted Answer

Alice lacks the jobUser role to run queries. The BigQuery `jobUser` role is required to run query jobs, including those that join across datasets. The IAM policy shown only grants dataset-level permissions (like `dataViewer` or `dataOwner`), but Alice lacks the `jobUser` role at the project level, which is necessary to submit a query job. Without this role, she receives a permission error even if she has read access to the datasets.

Answer

The policy denies all users except Bob

Answer

Alice does not have permission to read the dataset

Answer

Bob’s dataOwner role prevents others from querying

Question 10

A company is moving its financial reporting application to Google Cloud. The CFO asks: 'If Google Cloud experiences a data breach and our financial data is exposed, who is financially liable?' How should the cloud architect answer this question?

Accepted Answer

Liability depends on where the breach originated: Google is responsible for failures in its infrastructure security; the customer is responsible for breaches resulting from misconfiguration, application vulnerabilities, or inadequate access controls in areas under their responsibility. The Google Cloud Shared Responsibility Model explicitly delineates liability: Google is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor, network controls), while the customer is responsible for security in the cloud (e.g., IAM policies, application code, data encryption). In a breach, liability is determined by where the failure occurred—if Google’s infrastructure (e.g., GKE node isolation) fails, Google bears liability; if the customer misconfigures a Cloud Storage bucket or leaves a Compute Engine firewall open, the customer bears liability. This aligns with the CFO’s question about financial liability, which is not absolute but contingent on the breach’s origin.

Answer

Google Cloud bears full financial liability for all data breaches involving customer data on its platform

Answer

The customer bears all liability for any breach because they chose to use cloud services

Answer

No party is liable because data breaches in cloud are force majeure events similar to natural disasters

Question 11

A non-profit organization with limited IT staff wants to use cloud to improve its fundraising and donor management without hiring technology specialists. Which type of cloud service model is most appropriate for this organization's need?

Accepted Answer

Software as a Service (SaaS), where a fully managed donor management application is subscribed to and used without any infrastructure management. Software as a Service (SaaS) is the most appropriate model because it provides a fully managed, ready-to-use donor management application over the internet. The organization's limited IT staff can simply subscribe and use the software without provisioning servers, installing applications, or managing infrastructure, directly addressing the need to avoid hiring technology specialists.

Answer

Infrastructure as a Service (IaaS), where the organization provisions VMs and installs donor management software

Answer

Platform as a Service (PaaS), where the organization deploys custom-built donor management code

Answer

Private cloud, where the organization builds its own cloud infrastructure for complete data control

Question 12

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Answer

BigQuery

Answer

Cloud Spanner

Answer

Firestore

Question 13

A company wants to store archival data that must be retained for 10 years. The data is accessed less than once a year. Which Cloud Storage class is the most cost-effective?

Accepted Answer

Archive Storage. Archive Storage is the most cost-effective option for data that must be retained for 10 years and is accessed less than once a year. This class offers the lowest storage cost among Google Cloud Storage classes, specifically designed for long-term preservation of data that is rarely accessed, with a minimum storage duration of 365 days and higher retrieval costs that are acceptable given the infrequent access pattern.

Answer

Standard Storage

Answer

Nearline Storage

Answer

Coldline Storage

Question 14

A company wants to connect its on-premises data center to Google Cloud with a reliable, lower-latency connection that doesn't traverse the public internet, but doesn't need the bandwidth of a full Dedicated Interconnect. Which Google Cloud connectivity product is most appropriate?

Accepted Answer

Partner Interconnect, which provides private connectivity through a service provider partner's network — supporting lower bandwidth tiers without requiring a direct physical fiber connection. Partner Interconnect is the correct choice because it provides private connectivity between an on-premises data center and Google Cloud via a service provider partner's network, offering lower bandwidth tiers (e.g., 50 Mbps to 10 Gbps) without requiring a direct physical fiber connection. This meets the requirements for a reliable, lower-latency connection that avoids the public internet, while Dedicated Interconnect would be overkill for bandwidth needs below 10 Gbps.

Answer

Cloud VPN, which creates an encrypted IPsec tunnel over the public internet

Answer

Dedicated Interconnect, which requires provisioning a 10 Gbps or 100 Gbps dedicated physical fiber connection

Answer

Cloud CDN, which caches content at edge locations close to the on-premises data center

Question 15

A security team wants to ensure that only container images built by their approved CI/CD pipeline can run in their GKE cluster. Images built outside the approved process — even by internal engineers — should be blocked. Which Google Cloud security feature enforces this?

Accepted Answer

Binary Authorization — requiring cryptographic attestations for container images before they can be deployed to GKE.. Binary Authorization is the correct answer because it enforces deployment-time policy by requiring that container images have a valid cryptographic attestation (e.g., from a trusted CI/CD pipeline) before they can be scheduled on GKE. This ensures that only images built and signed by the approved process are allowed to run, blocking all others regardless of who built them.

Answer

Cloud Armor — it blocks unauthorized container images at the load balancer.

Answer

Cloud IAM — restricting `container.pods.create` permission to only the CI/CD service account.

Answer

Artifact Registry vulnerability scanning — blocking images with CVEs from being deployed.

Question 16

Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?

Accepted Answer

No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.. Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).

Answer

Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.

Answer

Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.

Answer

Customers must purchase the Security Command Center Premium tier to enable data encryption.

Question 17

A company uses Cloud SQL and wants to encrypt data at rest with a key that they manage and rotate themselves. They also want to ensure that the encryption happens automatically before data is written to disk. Which configuration should they choose?

Accepted Answer

Use a Customer-Managed Encryption Key (CMEK) from Cloud KMS. Cloud SQL supports CMEK (Customer-Managed Encryption Keys) via Cloud KMS. The key is created in Cloud KMS and specified when creating the Cloud SQL instance. The data is automatically encrypted with the key at rest. CSEK is deprecated and not supported by Cloud SQL. Google-managed keys do not allow customer control. Secret Manager is for secrets.

Answer

Enable default Google-managed encryption

Answer

Store the encryption key in Secret Manager and configure Cloud SQL to use it

Answer

Use a Customer-Supplied Encryption Key (CSEK)

Question 18

According to the NIST definition of cloud computing, which characteristic allows users to unilaterally provision computing resources such as server time and network storage without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. NIST's five essential characteristics of cloud computing are: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. 'On-demand self-service' specifically describes the ability for users to provision capabilities automatically without provider interaction — using a web console or API to spin up VMs, databases, or storage instantly, without calling a salesperson or waiting for manual provisioning.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 19

A startup's website becomes unexpectedly popular and traffic spikes 50x within minutes. The application is hosted on Google Cloud. Which Google Cloud product automatically increases the number of application instances in response to this traffic spike without manual intervention?

Accepted Answer

Managed Instance Groups with autoscaling (for VMs) or Cloud Run (for containers), which automatically provision additional instances based on traffic load without manual intervention. Managed Instance Groups (MIGs) with autoscaling and Cloud Run both automatically adjust the number of running instances or container replicas based on real-time metrics like CPU utilization, request rate, or latency. When traffic spikes 50x, the autoscaler detects the increased load and provisions new VMs or container instances without any manual intervention, ensuring the application remains responsive. This is the only option that provides automatic, infrastructure-level scaling in response to load.

Answer

Cloud Monitoring, which detects the traffic spike and sends an alert to the operations team to manually scale up

Answer

Cloud Load Balancing, which distributes traffic evenly across existing instances to handle the spike

Answer

Cloud Billing, which automatically increases the spending limit when traffic spikes occur

Question 20

You are monitoring Compute Engine instances with Cloud Monitoring. You notice that autoscaling is not triggering even though CPU utilization is above 80% for several minutes. The managed instance group has autoscaling based on CPU utilization with a target of 0.8. What is the most likely cause?

Accepted Answer

The maximum number of instances is already reached.. The most likely cause is that the managed instance group has already reached its configured maximum number of instances. When the maximum instance count is hit, the autoscaler cannot add more instances even if CPU utilization exceeds the target of 0.8 (80%). This is a common boundary condition in autoscaling logic where the scaling policy is overridden by the hard limit.

Answer

The autoscaler is disabled.

Answer

The minimum number of instances is set too high.

Answer

The cool-down period is too long.