Cloud Digital Leader Practice Exam 55 — 20 Questions

Question 1

A startup is building a mobile app backend that requires a scalable NoSQL database with real-time synchronisation across devices. The database should support offline access and automatic conflict resolution. Which Google Cloud database service meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Firestore. Firestore is Google Cloud's serverless document NoSQL database with built-in real-time listeners, offline persistence on mobile/web SDKs, and automatic conflict resolution via last-write-wins semantics. These features map directly to the mobile backend requirements of real-time sync, offline access, and conflict handling without custom code. Cloud Spanner, Cloud SQL, and Bigtable do not provide native mobile SDKs with offline sync.

Answer

Cloud Spanner

Answer

Cloud SQL

Answer

Cloud Bigtable

Question 2

An engineer is designing a resource hierarchy for a multinational company with multiple business units. The company uses Google Workspace. What is the first step in creating the resource hierarchy?

Accepted Answer

Link the Google Workspace account to the organization node. The first step in creating a Google Cloud resource hierarchy for a company using Google Workspace is to link the Google Workspace (or Cloud Identity) account to the organization node, which establishes the Organization resource at the root of the hierarchy. Without this link, there is no organization node to contain folders and projects, so all subsequent hierarchy steps depend on it. Once the organization node exists, folders and projects can be created beneath it.

Answer

Create a project for each business unit

Answer

Create a folder for each business unit

Answer

Enable the Cloud Resource Manager API

Question 3

A company needs to organize their GCP resources into a hierarchy that reflects their departments: Engineering, Marketing, and Finance. Each department has multiple projects. They also want to apply common policies to all departments except Finance, which has special compliance requirements. Which TWO steps should they take?

Accepted Answer

Apply organization policies at the organization node and override them for the Finance folder using tags.. Option E is correct because GCP resource hierarchy uses folders to model organizational structure such as departments, so creating a folder for Engineering, Marketing, and Finance lets each department contain its multiple projects and inherit policies from above. Option B is correct because organization policies are inherited down the hierarchy, so applying common policies at the organization node enforces them across all departments, while tags on the Finance folder allow a conditional override to satisfy its special compliance requirements. Option A is not appropriate because labels are for metadata, billing, and filtering, not for building a policy-inheritance hierarchy. Option C is wrong because setting separate IAM policies per project does not create the required departmental hierarchy or centralized policy inheritance. Option D is wrong because a single project per department cannot hold multiple projects and does not reflect the folder-based hierarchy needed for policy inheritance.

Answer

Use labels to differentiate departments instead of folders.

Answer

Apply separate IAM policies for each project within a folder.

Answer

Create a project for each department and place resources in it.

Question 4

A company wants to modernize its legacy monolithic application by adopting microservices on Google Cloud. They need to ensure high availability and manage service-to-service communication. Which THREE Google Cloud services should they use? (Choose THREE.)

Accepted Answer

Cloud Service Mesh (or Istio). Cloud Service Mesh (or Istio) (A) is correct because it provides the service-to-service communication layer for microservices, delivering traffic management, mutual TLS, observability, and policy enforcement across services. Google Kubernetes Engine (GKE) (B) is correct because it is the managed Kubernetes platform used to deploy, orchestrate, and scale the containerized microservices with high availability across zones and regions. Cloud Load Balancing (D) is correct because it distributes traffic to the microservices and provides global, highly available entry points with health checks and failover. Cloud Storage (C) is not a compute or service-mesh platform for running microservices; it is object storage. Cloud Functions (E) is a serverless functions platform suited to event-driven, single-purpose workloads rather than hosting and managing a full microservices architecture.

Answer

Cloud Storage

Answer

Cloud Functions

Question 5

A company wants to store archival data that is accessed less than once a year and needs the lowest storage cost. Which TWO Cloud Storage classes are most cost-effective for this use case?

Accepted Answer

Archive. Coldline (E) and Archive (D) are the two lowest-cost Cloud Storage classes and are explicitly designed for data accessed less than once a year, making them the most cost-effective choices for this archival scenario. Coldline is intended for data accessed at most once per quarter and offers very low storage pricing with a 90-day minimum storage duration, while Archive is the cheapest class for data accessed less than once a year, with a 365-day minimum storage duration. Both classes charge higher retrieval and early-deletion fees, which is acceptable here because the data is rarely read. Regional (A) and Standard (C) are hot-access classes with the highest storage prices, so they are not cost-effective for archival data. Nearline (B) is cheaper than Standard but is optimized for data accessed about once a month, so it costs more than Coldline and Archive for this less-than-annual access pattern.

Answer

Regional

Answer

Nearline

Answer

Standard

Question 6

A developer is troubleshooting why a Compute Engine instance cannot start in a specific region. The error indicates a quota limit. Which TWO steps should the developer take?

Accepted Answer

Check the current quota for the resource in that region via the Quotas page in Cloud Console.. Option A is correct because the Quotas page in Cloud Console (IAM & Admin > Quotas) shows the current usage and limit for each resource per region, letting the developer confirm which quota is exhausted before acting. Option E is correct because when a quota is genuinely too low for the workload, the developer must submit a quota increase request for that specific resource and region, which is then reviewed and approved by Google Cloud support. Together these steps diagnose the exact quota and resolve it through the proper channel. Option B is not appropriate because deleting resources is a destructive action and quota is not 'freed automatically' in a way that guarantees the instance can start; the developer should first identify the quota. Option C is wrong because changing the billing account does not alter regional resource quotas. Option D is wrong because switching to a smaller machine type is a workaround that may not address the actual quota (e.g., if the quota is for CPUs, in-use IP addresses, or persistent disk), and it does not resolve the underlying quota limit.

Answer

Delete unused resources in the same region to free up quota automatically.

Answer

Change the project to a different billing account.

Answer

Use a different machine type that uses fewer vCPUs.

Question 7

A company is migrating its on-premises data warehouse to Google Cloud. The data warehouse contains structured relational data (sales transactions, customer records) and is queried using standard SQL. The company wants to separate compute and storage costs and automatically scale compute resources up and down based on query load. Which Google Cloud service is most appropriate?

Accepted Answer

BigQuery. BigQuery is a serverless data warehouse that separates compute and storage, scales automatically, and supports standard SQL. Cloud SQL is for OLTP, not data warehousing. Spanner is globally distributed OLTP. Dataproc is for Hadoop/Spark workloads, not directly for SQL warehousing.

Answer

Cloud SQL

Answer

Dataproc

Answer

Cloud Spanner

Question 8

An organization has multiple projects with many underutilized Compute Engine instances. They want to identify idle instances and generate recommendations for downsizing or deleting them. The finance team wants to see cost savings estimates. Which tool should they use?

Accepted Answer

Active Assist. Active Assist is Google Cloud's portfolio of intelligent recommendations, including the VM rightsizing recommender and idle VM recommender, which analyze usage metrics and suggest downsizing or deleting underutilized instances with estimated cost savings. It surfaces these directly in the console and via API, matching the finance team's need for savings estimates.

Answer

Google Cloud Pricing Calculator

Answer

Billing export to BigQuery

Answer

Cost Management dashboard

Question 9

A company wants to receive a 15-minute response time for Priority 1 production issues and have a dedicated Technical Account Manager. Which support plan should they purchase?

Accepted Answer

Premium. Google Cloud Premium support provides a 15-minute response time for Priority 1 issues and includes a dedicated Technical Account Manager (TAM). This plan is designed for enterprises with mission-critical workloads that require rapid response and personalized support. Enhanced support offers a 1-hour response for P1 and no dedicated TAM.

Answer

Enhanced

Answer

Basic

Answer

Standard

Question 10

A multinational corporation must store and process data subject to GDPR. They need to ensure that personal data of EU residents remains within the EU. Which Google Cloud feature should they use?

Accepted Answer

Organization policies with location restrictions. Organization policies with location restrictions in Google Cloud allow administrators to define constraints on where resources can be created and where data can be stored, ensuring that data remains within specific geographic regions like the EU. This directly addresses GDPR's data residency requirements by preventing resource creation outside allowed locations. It is the primary mechanism for enforcing location-based compliance at the organization, folder, or project level.

Answer

Cloud Audit Logs

Answer

Cloud KMS

Answer

VPC Service Controls

Question 11

A startup wants to run a Node.js web application with zero server management and automatic scaling. They expect unpredictable traffic and want to minimise costs. Which Google Cloud service should they choose?

Accepted Answer

App Engine Standard Environment. App Engine Standard Environment is a fully managed, serverless platform that automatically scales instances up and down (including to zero) based on traffic, requires no server management, and bills only for resources consumed — ideal for unpredictable traffic and cost minimisation. It supports Node.js runtimes and is purpose-built for exactly this use case.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine Flexible Environment

Question 12

A company has a multi-regional deployment of a web application on Compute Engine. They want to improve latency for users worldwide and reduce load on the origin servers. They also need to protect against SQL injection and cross-site scripting attacks. Which TWO Google Cloud services should they implement?

Accepted Answer

Cloud Armor. Cloud Armor (B) is correct because it is Google Cloud's edge security service that provides WAF capabilities, including preconfigured rules to block SQL injection (e.g., sqli-v33-stable) and cross-site scripting (e.g., xss-v33-stable) attacks against HTTP(S) load-balanced backends. Cloud CDN (D) is correct because caching content at Google's globally distributed edge points of presence reduces latency for worldwide users and offloads requests from the Compute Engine origin servers. Cloud DNS (A) only provides authoritative DNS resolution and does not cache HTTP content or inspect application-layer attacks. Cloud NAT (C) provides outbound internet connectivity for private instances and offers no latency or WAF benefits. Cloud Load Balancing (E) distributes traffic but does not itself cache content or provide WAF protection, so it does not satisfy both requirements.

Answer

Cloud DNS

Answer

Cloud NAT

Answer

Cloud Load Balancing

Question 13

A company needs to estimate the monthly cost of running a set of Compute Engine instances, including network egress and Cloud Storage usage, before deploying the architecture. Which tool should they use?

Accepted Answer

Google Cloud Pricing Calculator. The Google Cloud Pricing Calculator is a web-based estimation tool that lets you model Compute Engine instances, Cloud Storage, and network egress charges before any resources are provisioned. It produces a shareable, itemized monthly cost estimate based on SKU-level pricing, which is exactly what pre-deployment planning requires. It is the only option designed for forward-looking cost estimation rather than monitoring actual spend.

Answer

Active Assist recommendations

Answer

Budget alerts

Answer

Cost Management dashboard

Question 14

A company is planning their resource hierarchy in Google Cloud. They need to separate environments (prod, non-prod) and teams (engineering, data science). They also need to apply common policies to all prod projects. Which TWO resources should they use?

Accepted Answer

Folders. Folders (B) are the correct resource for modeling the hierarchy: you can nest folders under the organization to represent environments (prod, non-prod) and teams (engineering, data science), and IAM policies and Organization Policies inherit down through the folder tree to all contained projects. Organization policies (C) are the mechanism to apply common constraints (e.g., restrict VM external IPs, allowed locations) that inherit to every project under the prod folder, satisfying the requirement to enforce common policies across all prod projects. Billing accounts (A) only link projects to a payment method and do not model environment/team separation or policy inheritance. Labels (D) are metadata for filtering, reporting, and billing attribution, not a policy or hierarchy boundary. Projects (E) are the leaf resources that hold workloads; they cannot themselves group other projects or enforce inherited common policies across a set.

Answer

Billing accounts

Answer

Labels

Answer

Projects

Question 15

A company wants to implement a zero-trust security model for accessing internal applications. Which TWO Google Cloud services should they use together? (Choose 2)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) is correct because it enforces zero-trust access to internal applications by verifying a user's identity and context (via Google identity and IAM) before allowing requests to reach the app, rather than relying on network location. BeyondCorp Enterprise is correct because it provides the zero-trust access framework—context-aware access policies, device trust, and continuous authorization—that works with IAP to protect internal apps without a VPN. Together, BeyondCorp Enterprise supplies the policy/context engine and IAP enforces those policies at the application layer, which is exactly the zero-trust pattern for internal app access. Cloud Identity is not the right pairing here because it is primarily an identity and device management service (IdP/endpoint management), not the access-enforcement or context-aware policy layer for internal apps. Cloud Armor is a WAF/DDoS protection service for external HTTP(S) load balancers, and Cloud VPN provides network-level connectivity, both of which rely on perimeter/network trust rather than zero-trust application access.

Answer

Cloud Identity

Answer

Cloud Armor

Answer

Cloud VPN

Question 16

A company is planning a cloud architecture and needs to decide between a monolithic application design and a microservices architecture. What is the most significant operational trade-off between these two approaches in a cloud environment?

Accepted Answer

Microservices enable independent deployment and scaling per component but introduce distributed systems complexity (network overhead, distributed tracing, service discovery, consistency challenges); monoliths are simpler to operate but scale and deploy as a unit. The most significant operational trade-off is that microservices enable independent deployment and scaling per component but introduce distributed systems complexity such as network overhead, distributed tracing, service discovery, and consistency challenges. Monoliths are simpler to operate but must be scaled and deployed as a single unit. This accurately captures the core operational difference in cloud environments.

Answer

Monoliths can only run on-premises, while microservices were designed specifically for cloud environments

Answer

Microservices are always cheaper to operate in the cloud because each service uses fewer resources than a monolith

Answer

Monolithic applications cannot be scaled horizontally in cloud environments

Question 17

A company's monolithic application is difficult to update because any change requires testing and redeploying the entire application, causing multi-hour downtime during updates. The team is considering a microservices architecture. What is the primary benefit of microservices in this context?

Accepted Answer

Each service can be updated and deployed independently, enabling teams to release changes faster with lower risk and without full-application downtime.. The core benefit of microservices is independent deployability: each service has its own lifecycle, so a change to one service can be built, tested, and deployed without redeploying the entire application. This reduces blast radius, enables faster release cadence, and eliminates the full-application downtime described in the scenario.

Answer

Microservices always cost less than monolithic applications to run.

Answer

Microservices eliminate the need for testing because each service is small enough to be bug-free.

Answer

Microservices allow applications to run on any hardware without modification.

Question 18

Which TWO of the following are NIST-defined characteristics of cloud computing?

Accepted Answer

Resource pooling. Option B, resource pooling, is correct because NIST SP 800-145 lists resource pooling as one of the five essential characteristics of cloud computing, describing how provider resources are pooled to serve multiple consumers using a multi-tenant model with dynamically assigned and reassigned physical and virtual resources. Option E, measured service, is also correct because NIST defines measured service as the characteristic whereby cloud systems automatically control and optimize resource use via metering capabilities appropriate to the service type, providing transparency to both provider and consumer. The other options are not among NIST's five essential characteristics: high availability (A) is a common cloud benefit but not a NIST-defined essential characteristic, pay-as-you-go pricing (C) is a billing model rather than one of the five characteristics, and virtualization (D) is an enabling technology frequently used in cloud implementations but is not itself listed as a NIST essential characteristic.

Answer

High availability

Answer

Pay-as-you-go pricing

Answer

Virtualization

Question 19

A healthcare organization must store patient health records (PHI) in the cloud and comply with HIPAA. They need to ensure data is encrypted at rest by default, maintain access logs, and restrict access to authorized personnel. Which THREE Google Cloud features or services should they use?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (A) are correct because they record Admin Activity, Data Access, System Event, and Policy Denied audit logs for Google Cloud services, providing the access logging and monitoring evidence HIPAA requires for PHI. Identity and Access Management (B) is correct because IAM lets the organization enforce least-privilege access via roles, policies, and conditions so that only authorized personnel can reach the PHI resources. Cloud Key Management Service (E) is correct because Cloud KMS manages the encryption keys used for data at rest, including customer-managed encryption keys (CMEK) and key rotation, satisfying the requirement for default encryption at rest under organizational control. VPC Flow Logs (C) is not correct because it captures network-level IP traffic metadata for subnets, not the resource access audit trail needed for PHI compliance. Cloud NAT (D) is not correct because it only provides outbound internet connectivity for private instances and has no role in encryption, access control, or audit logging.

Answer

VPC Flow Logs

Answer

Cloud NAT

Question 20

A company has a multi-project GCP environment with a single billing account. They want to receive alerts when any project's spending exceeds its allocated budget, and they want to analyze cost trends by project and service. Which THREE services should they use together?

Accepted Answer

Labels on resources. Option B (Labels on resources) is correct because labels are the mechanism that lets you attribute and group costs by project and service dimensions in billing data, enabling the per-project and per-service cost-trend analysis the company requires. Option D (Cloud Billing budgets) is correct because budgets defined on the billing account or scoped to projects trigger alert notifications when actual or forecasted spend exceeds the allocated threshold, directly satisfying the requirement to be alerted when any project's spending exceeds its budget. Option E (Billing export to BigQuery) is correct because exporting detailed billing data to BigQuery provides the granular, queryable dataset needed to analyze cost trends by project and service over time. Option A (Committed use discounts) is not correct because CUDs are a pricing/discount mechanism to reduce compute costs, not an alerting or cost-analysis service. Option C (Active Assist idle resource recommendations) is not correct because it only surfaces optimization suggestions for idle or underutilized resources and does not provide budget alerts or billing trend analysis.

Answer

Committed use discounts

Answer

Active Assist idle resource recommendations