Cloud Digital Leader Practice Exam 54 — 20 Questions

Question 1

Which TWO of the following are key benefits of using a cloud provider like Google Cloud? (Choose exactly 2.)

Accepted Answer

Access to a global network infrastructure. Option A is correct because Google Cloud operates a global network of regions, zones, and edge points of presence, so customers can deploy workloads close to users and leverage Google's private backbone for reliable, high-performance connectivity. Option E is correct because cloud providers aggregate massive demand across many tenants, achieving economies of scale in hardware, power, cooling, and operations that translate into lower per-unit costs passed on to customers. Option B is not fully correct because the cloud provider secures the physical data center, but customers still retain responsibility for physical security of their own devices, offices, and access controls under the shared responsibility model. Option C is not guaranteed because reduced internet latency depends on architecture, region selection, and last-mile connectivity, not merely on using a cloud provider. Option D is not strictly correct because while capital hardware costs are largely shifted to operational expenses, customers may still incur hardware costs for on-premises equipment, client devices, or dedicated hardware such as TPUs.

Answer

Complete removal of physical security responsibilities

Answer

Reduced internet latency

Answer

Elimination of hardware costs

Question 2

A gaming company runs a real-time multiplayer game server on Google Kubernetes Engine. They want to optimize costs while ensuring low latency for players across different regions. Which three strategies should they implement? (Choose THREE.)

Accepted Answer

Use committed use discounts (CUDs) for sustained resource usage.. Option A is correct because committed use discounts (CUDs) provide significant discounts (up to 57% for 3-year commitments) on sustained GKE compute usage, which is ideal for a real-time game server that runs continuously and predictably. Option C is correct because node auto-provisioning dynamically creates node pools based on pending pod resource requests, avoiding over-provisioning and reducing costs while still meeting the latency needs of game server pods. Option D is correct because deploying GKE clusters in multiple regions and using Multi Cluster Ingress (MCI) places players on the nearest healthy cluster, minimizing latency across regions while also improving availability. Option B is not appropriate because spot VMs can be preempted at any time, which would abruptly terminate real-time game sessions and harm player experience. Option E is likewise incorrect because preemptible VMs are short-lived (max 24 hours) and can be reclaimed with only 30 seconds' notice, making them unsuitable for latency-sensitive, stateful multiplayer game servers.

Answer

Use spot VMs with a node taint and toleration for game server pods.

Answer

Use preemptible VMs for game server pods.

Question 3

A business is considering moving to Google Cloud to accelerate innovation. Which THREE factors contribute to faster innovation in the cloud?

Accepted Answer

Access to advanced technologies like AI. Option A is correct because Google Cloud provides immediate access to advanced technologies such as AI, machine learning, and data analytics services (e.g., Vertex AI, BigQuery ML), letting teams build innovative solutions without building these capabilities from scratch. Option B is correct because Google Cloud's global infrastructure lets organizations run experiments and scale them worldwide quickly, so successful innovations can reach users in many regions without lengthy capacity planning. Option D is correct because managed services (e.g., Cloud Run, GKE, Cloud SQL) enable rapid prototyping by removing undifferentiated infrastructure work, shortening the time from idea to working prototype. Option C is incorrect because longer procurement cycles slow innovation by delaying access to resources, the opposite of what cloud accelerates. Option E is incorrect because dedicated physical servers represent a traditional, capital-intensive model that reduces agility and elasticity rather than speeding innovation.

Answer

Longer procurement cycles

Answer

Dedicated physical servers

Question 4

An e-commerce platform uses Compute Engine instances in a managed instance group behind a Cloud Load Balancer. During a flash sale, the load balancer reports increased error rates. The operations team suspects the instances are overwhelmed. Which two steps should they take to troubleshoot the issue? (Choose TWO.)

Accepted Answer

Check the CPU utilization of the instance group in Cloud Monitoring.. Option D is correct because checking CPU utilization of the instance group in Cloud Monitoring directly tests the hypothesis that the instances are overwhelmed; sustained high CPU across the MIG is the key signal of saturation and helps confirm whether the error rate spike is caused by insufficient compute capacity. Option E is correct because reviewing the load balancer logs in Cloud Logging exposes the actual HTTP error codes and messages (for example 502/503 responses or backend timeouts), which distinguishes backend overload from other causes such as misconfigured health checks or client errors. Option A is not appropriate because switching to a Network Load Balancer is a design change, not a troubleshooting step, and it would not diagnose why the current load balancer is reporting errors. Option B is not appropriate because blindly increasing the size of the instance group without investigation may mask the symptom, waste resources, and leave the root cause unidentified. Option C is not appropriate because enabling HTTP health checks is a configuration change rather than a diagnostic action, and health checks alone would not reveal the cause of the elevated error rates.

Answer

Switch to a Network Load Balancer for higher throughput.

Answer

Increase the size of the instance group without investigation.

Answer

Enable HTTP health checks on the load balancer.

Question 5

Which TWO features are part of Cloud Data Loss Prevention (Cloud DLP)?

Accepted Answer

Classification of sensitive data such as credit card numbers. Cloud DLP is Google Cloud's service for discovering, classifying, and protecting sensitive data, so option A is correct: it inspects content and metadata to detect and classify sensitive data types such as credit card numbers, using built-in infoType detectors (for example CREDIT_CARD_NUMBER). Option B is also correct because Cloud DLP provides de-identification transformations including masking, tokenization (crypto-based tokenization via CryptoKey), and encryption (format-preserving encryption, deterministic encryption, and pseudonymization) to protect detected sensitive values. Option C is not part of Cloud DLP; network vulnerability scanning is handled by Security Command Center/Web Security Scanner, not DLP. Option D is not part of Cloud DLP; malware scanning of uploaded files is performed by services such as Cloud Storage malware scanning or third-party tools, not DLP. Option E is not part of Cloud DLP; IAM policies are created and managed through IAM, not through Cloud DLP.

Answer

Network vulnerability scanning

Answer

Removal of malware from uploaded files

Answer

Creation of IAM policies

Question 6

Which TWO of the following are best practices for securing a Google Cloud environment? (Choose two.)

Accepted Answer

Grant minimal permissions to users and services using IAM roles.. Option B is correct because the principle of least privilege is a core Google Cloud security best practice: IAM roles should be scoped so users and service accounts receive only the permissions required for their tasks, reducing the blast radius of compromised credentials. Option E is correct because enabling VPC Flow Logs on all subnets provides network telemetry for auditing, anomaly detection, and incident response, which is a recommended detective control in Google Cloud. Option A is not a best practice because reusing one SSH key across all Compute Engine instances means a single key compromise grants access to every VM; keys should be unique per user/instance and managed via OS Login or metadata. Option C is not recommended because exporting long-lived service account keys for on-premises use creates high-risk credentials that can be leaked; workload identity federation or short-lived tokens should be used instead. Option D is not among the best practices here because Google recommends avoiding service account keys altogether and, when unavoidable, rotating them regularly rather than treating a fixed monthly rotation as the primary control.

Answer

Use the same SSH key for all Compute Engine instances.

Answer

Export service account keys and use them in on-premises applications for authentication.

Answer

Rotate service account keys every month.

Question 7

A data analyst runs a query on Google BigQuery. Which TWO statements correctly describe how cloud technology is transforming business in this scenario?

Accepted Answer

The ability to analyze petabytes of data without provisioning servers. Option C is correct because BigQuery is a fully managed, serverless data warehouse, so the analyst can run SQL over petabyte-scale datasets without provisioning or managing any infrastructure. Option E is correct because BigQuery's on-demand pricing charges per bytes processed (or via flat-rate/editions capacity), eliminating the capital and operational costs of building and maintaining an on-premises warehouse. Option A is not necessarily true: BigQuery is an analytical warehouse queried on demand, not a real-time streaming delivery engine, so results are not inherently delivered as data is ingested. Option B is incorrect because BigQuery runs on Google's managed compute infrastructure and does not require the customer to provision dedicated GPU clusters for standard SQL queries. Option D is a true statement about Google Cloud encryption (AES-256 at rest, TLS in transit), but it describes a security property rather than how cloud technology is transforming business in this scenario, so it is not one of the two marked answers.

Answer

The results are delivered in real-time as data is ingested

Answer

The query required dedicated GPU clusters

Answer

The cloud provider automatically encrypts data at rest and in transit

Question 8

A DevOps engineer notices that a Cloud Function is timing out after 9 minutes. The function performs a long-running data transformation. They need to increase the timeout. What is the maximum timeout they can set for a Cloud Function (1st gen)?

Accepted Answer

9 minutes. For Google Cloud Functions (1st gen), the maximum configurable timeout is 9 minutes (540 seconds). The question states the function is already timing out at 9 minutes, which is the ceiling — the engineer cannot increase it further in 1st gen. To exceed 9 minutes, they must migrate to Cloud Functions 2nd gen (which supports up to 60 minutes) or use Cloud Run.

Answer

15 minutes

Answer

30 minutes

Answer

60 minutes

Question 9

A DevOps engineer wants to automatically delete a Cloud Storage object after 30 days from creation. The object is stored in a bucket with the 'Standard' storage class. Which approach should the engineer use?

Accepted Answer

Add a lifecycle rule to delete objects after 30 days. A lifecycle rule in Cloud Storage allows automatic deletion of objects after a specified age, such as 30 days from creation. This is the standard method to manage object lifecycle and reduce storage costs. The rule can be applied to a bucket and will delete objects matching the criteria.

Answer

Set a retention policy on the bucket with a 30-day retention period

Answer

Change the storage class to 'Archive' which automatically deletes after 30 days

Answer

Enable object versioning and set a noncurrent time deletion of 30 days

Question 10

What is the primary purpose of a folder in the Google Cloud resource hierarchy?

Accepted Answer

To group projects and apply policies. Folders in the Google Cloud resource hierarchy sit between the organization node and projects, letting you group related projects and attach IAM policies and organization policies that are inherited by everything beneath them. This makes folders the primary tool for delegated administration and policy scoping across project boundaries.

Answer

To manage user identities

Answer

To define network topologies

Answer

To store billing information

Question 11

An e-commerce company experiences unpredictable traffic spikes. They need to ensure their web application automatically scales out during high demand and scales in when demand drops, paying only for resources used. Which cloud benefit best describes this?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to automatically scale out during demand spikes and scale in when demand drops, so the company pays only for what it uses. This matches the e-commerce scenario of unpredictable traffic. It is a core benefit of cloud computing.

Answer

Economies of scale

Answer

Broad network access

Answer

Reliability

Question 12

Which Google Cloud tool allows customers to measure the gross carbon emissions associated with their Google Cloud usage?

Accepted Answer

Carbon Footprint dashboard in the Google Cloud Console. The Carbon Footprint dashboard in the Google Cloud Console is the built-in tool that reports gross carbon emissions attributable to a customer's Google Cloud project usage, broken down by service, region, and month. It uses the same billing data that powers cost reports and applies Google's regional grid carbon intensity factors to estimate emissions.

Answer

Google Cloud's Sustainability API

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Question 13

A company wants to migrate its on-premises Oracle database to Google Cloud. They need PostgreSQL compatibility with high performance for transaction processing and built-in support for AI-driven optimisations. Which database service should they choose?

Accepted Answer

AlloyDB. AlloyDB is Google Cloud's fully managed PostgreSQL-compatible database designed for high-performance transactional workloads, with built-in AI-driven optimizations such as adaptive indexing and automatic query tuning. It offers superior performance compared to standard Cloud SQL for PostgreSQL while maintaining full PostgreSQL compatibility.

Answer

Cloud Spanner

Answer

Bigtable

Answer

Cloud SQL for PostgreSQL

Question 14

Which tool would you use to estimate the monthly cost of running a set of Compute Engine virtual machines before deploying them?

Accepted Answer

Google Cloud Pricing Calculator. The Google Cloud Pricing Calculator is a web-based tool that allows you to estimate the cost of Google Cloud services, including Compute Engine VMs, before deploying them. It lets you configure VM types, regions, usage hours, and other parameters to get a detailed monthly cost estimate.

Answer

Cost Management dashboard

Answer

Active Assist

Answer

Billing export

Question 15

A company uses folders to separate environments (dev, test, prod) and teams (eng, data, security). An engineer needs to apply a policy that disables the use of 'g1-small' machine types only in the 'dev' folder under the 'eng' folder. The organization node has no existing constraints. What is the most specific way to apply this policy?

Accepted Answer

Apply the policy at the 'dev' folder.. Organization policies are hierarchical and inherit downward, so applying the constraint at the 'dev' folder scopes it precisely to that folder and its projects without affecting sibling folders or the parent 'eng' folder. This is the most specific node that matches the requirement of restricting only the 'dev' environment.

Answer

Apply the policy at the organization node.

Answer

Apply the policy at each project individually.

Answer

Apply the policy at the 'eng' folder.

Question 16

An engineer needs to store database passwords and API keys securely. The secrets must be encrypted at rest with a customer-managed key and automatically rotated every 90 days. Which service should they use?

Accepted Answer

Cloud Secret Manager. Cloud Secret Manager is purpose-built for storing, accessing, and rotating secrets such as database passwords and API keys, and it supports customer-managed encryption keys (CMEK) plus automatic rotation schedules. It provides versioning, audit logging, and fine-grained IAM access, which are exactly the requirements stated. Cloud KMS, by contrast, manages encryption keys themselves rather than the secrets they protect.

Answer

Cloud KMS

Answer

Datastore

Answer

Cloud Storage with encryption

Question 17

A media company needs to store and serve video files globally with high availability and low latency. They also need to process these videos using transcoding. Which THREE Google Cloud services should they use? (Choose 3)

Accepted Answer

Cloud Storage. Cloud Storage [CORRECT] is the right choice for storing the video files because it provides a highly durable, globally accessible object store with multi-regional and dual-region bucket options that support high availability for media assets. Cloud CDN [CORRECT] is correct because it caches content at Google's global edge points of presence, reducing latency when serving video files to users worldwide. Transcoder API [CORRECT] is correct because it is the managed service specifically designed to transcode video files into different formats and resolutions for playback on various devices. Compute Engine is not the best fit here because managing your own VMs for storage and transcoding adds operational overhead compared to the managed Cloud Storage and Transcoder API services. BigQuery is an analytics data warehouse and does not store or serve video files or perform transcoding, so it does not belong in this solution.

Answer

Compute Engine

Answer

BigQuery

Question 18

A retail company experiences sudden traffic spikes during flash sales. Their on-premises infrastructure often runs out of capacity, causing downtime. They are migrating to Google Cloud and need to automatically handle traffic spikes without manual intervention. Which approach should they take?

Accepted Answer

Create a managed instance group with autoscaling. A managed instance group (MIG) with autoscaling automatically adjusts the number of VM instances based on load, which directly addresses traffic spikes without manual intervention. This is the standard Google Cloud solution for horizontal scaling of compute resources.

Answer

Manually add VMs when traffic increases

Answer

Use a GPU-accelerated VM for compute

Answer

Use a single large VM and rely on Cloud Load Balancing

Question 19

A security team needs to detect and alert on suspicious outbound network traffic from their GCP environment, such as data exfiltration attempts. They require a managed service that analyzes traffic for threats. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS is Google Cloud's managed network intrusion detection service that inspects traffic (via packet mirroring) for threats such as malware, command-and-control, and data exfiltration, and generates alerts. It is purpose-built for detecting suspicious network activity in a GCP environment without deploying third-party appliances.

Answer

Cloud Armor

Answer

Security Command Center

Answer

Chronicle

Question 20

A developer needs to run a small piece of Python code that processes a message from Pub/Sub and stores the result in Firestore. The code runs infrequently (a few hundred times per day) and takes less than a second to execute. Which compute service is most cost-effective and simple to manage?

Accepted Answer

Cloud Functions. Cloud Functions is the most cost-effective and simple option for infrequent, short-running event-driven code. It automatically scales to zero when not in use, so you only pay for actual execution time and resources consumed. It integrates natively with Pub/Sub and Firestore, requiring minimal configuration.

Answer

Cloud Run

Answer

Compute Engine with preemptible VM

Answer

App Engine Standard Environment