Cloud Digital Leader Practice Exam 55 — 20 Questions

Question 1

A data analytics company uses BigQuery for large-scale queries. They notice that some queries are very expensive due to scanning large amounts of data. They want to reduce costs without changing query logic. Which feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Partitioning and clustering tables. Partitioning and clustering tables in BigQuery physically organize data into smaller, manageable segments based on specified columns (e.g., date or timestamp). This allows queries to use partition pruning and clustering-based block pruning to scan only the relevant data, drastically reducing the amount of data processed and thus lowering costs without altering the query logic.

Answer

Query caching

Answer

Authorized views

Answer

Flat-rate pricing with reservations

Question 2

A company's employees use Google Workspace for email, documents, and collaboration. The IT team wants to require all employees to use a physical security key (like a YubiKey) as their second authentication factor when signing in — eliminating phishing-vulnerable SMS and authenticator app codes. Which Google Workspace security capability supports this requirement?

Accepted Answer

Google Workspace 2-Step Verification policy configured to require hardware security keys (FIDO2/WebAuthn) for all employees, making it impossible to sign in without a physical key. Google Workspace's 2-Step Verification policy allows administrators to enforce the use of hardware security keys (FIDO2/WebAuthn) as the sole second factor. This policy can be configured to require a physical security key for all employees, effectively blocking sign-ins that use SMS or authenticator app codes, which are vulnerable to phishing. The policy directly meets the IT team's requirement to eliminate phishing-vulnerable authentication methods.

Answer

Google Workspace Advanced Protection Program, which enforces hardware security key requirements for high-risk users

Answer

Google Cloud Identity-Aware Proxy, which enforces hardware key authentication for all Google Workspace apps

Answer

Cloud Armor, which blocks sign-in attempts that don't come from corporate IP addresses, eliminating the need for 2FA

Question 3

A project manager wants a cost-effective way to run batch processing jobs that run for a few hours each night. The jobs are fault-tolerant and can be interrupted. Which Compute Engine option is most suitable?

Accepted Answer

Preemptible VMs. Preemptible VMs are Compute Engine instances that last up to 24 hours and can be terminated at any time by Google Cloud, making them ideal for fault-tolerant, interruptible batch jobs that run for a few hours each night. They offer up to 80% cost savings compared to regular VMs, which aligns perfectly with the project manager's requirement for a cost-effective solution.

Answer

N2 high-CPU VMs

Answer

Regular VMs with committed use discounts

Answer

Sole-tenant nodes

Question 4

A company runs workloads across Google Cloud and on-premises environments. They want a single management plane to deploy and manage containerized applications consistently across both environments using the same tooling and policies. Which Google Cloud product provides this unified hybrid/multi-cloud management?

Accepted Answer

Anthos — Google's hybrid and multi-cloud application management platform.. Anthos is Google Cloud's hybrid and multi-cloud application management platform that provides a single control plane for deploying and managing containerized applications consistently across on-premises and cloud environments. It uses GKE on-prem and Anthos Config Management to enforce uniform policies, service mesh, and CI/CD pipelines, enabling the unified management described in the scenario.

Answer

Cloud Interconnect — it connects on-premises to Google Cloud.

Answer

Google Distributed Cloud — runs Google Cloud services inside the customer's data center.

Answer

Cloud Deployment Manager — deploys resources via infrastructure-as-code templates.

Question 5

A software team is using Google Cloud and wants to understand the difference between 'scaling up' (vertical scaling) and 'scaling out' (horizontal scaling) for their web application. Which description correctly distinguishes these two approaches?

Accepted Answer

Vertical scaling (scaling up) increases the resources of an individual server (more CPU, RAM), while horizontal scaling (scaling out) adds more servers to distribute load — horizontal scaling is generally preferred in cloud environments for its flexibility and lack of a ceiling. Ly distinguishes vertical scaling (scaling up) as increasing the resources (CPU, RAM) of an existing server, and horizontal scaling (scaling out) as adding more servers to distribute the load. In cloud environments like Google Cloud, horizontal scaling is generally preferred because it offers near-infinite scalability, better fault tolerance, and no single point of failure, unlike vertical scaling which has a hardware ceiling and can cause downtime during upgrades.

Answer

Scaling up adds more servers to handle increased load; scaling out makes each server more powerful by adding CPU and RAM

Answer

Both scaling up and scaling out describe the same approach — adding more cloud resources to handle increased demand

Answer

Scaling up is only possible in cloud environments; on-premises systems can only scale out

Question 6

An organization's Chief Digital Officer is building a case for cloud investment by framing it in terms of 'cloud as a strategic asset rather than a cost center.' Which argument most strongly supports this framing?

Accepted Answer

Cloud enables new revenue streams, faster product launches, data-driven competitive differentiation, and innovation capabilities that directly drive business growth — making cloud investment as strategic as R&D or customer acquisition. It directly aligns with the framing of 'cloud as a strategic asset' by highlighting how cloud computing enables new revenue streams, faster product launches, data-driven differentiation, and innovation — all of which drive business growth. This contrasts with viewing cloud purely as a cost center, as it emphasizes competitive advantage and long-term value creation, similar to R&D or customer acquisition investments.

Answer

Cloud reduces data center costs, making IT a more efficient cost center rather than a business liability

Answer

Cloud is always less expensive than on-premises, so it should be viewed as a cost-savings program rather than a strategic investment

Answer

Cloud providers assume liability for all security breaches, making cloud a risk-reduction tool rather than a strategic enabler

Question 7

A company's cloud costs have grown faster than its business. The FinOps team is implementing cloud cost governance. Which practice most effectively ensures that individual teams are accountable for their cloud spending?

Accepted Answer

Implementing consistent resource labeling and chargeback reporting so each team's cloud spending is visible and attributed to them. Implementing consistent resource labeling and chargeback reporting directly enables cost attribution to individual teams. In Google Cloud, labels are key-value pairs attached to resources, and when combined with billing export to BigQuery, they allow granular cost breakdowns per team. This creates clear accountability by making each team's spending visible and chargeable back to their budget, which is the core principle of cloud cost governance.

Answer

Requiring all teams to use only the cheapest available cloud service options regardless of technical requirements

Answer

Consolidating all cloud accounts under a single centralized IT team that controls all cloud resource creation

Answer

Disabling all non-production environments to eliminate spending outside of production

Question 8

A company uses Google Cloud across 5 teams, 20 projects, and 3 regions. They want to enforce a standard that all resources include specific labels (e.g., `team`, `environment`, `cost-center`) for cost attribution and governance. What is the most scalable way to enforce this labeling standard?

Accepted Answer

Enforce labeling through IaC templates with required label variables in CI/CD pipelines, and use Cloud Asset Inventory to audit compliance.. It combines Infrastructure as Code (IaC) templates with required label variables in CI/CD pipelines to enforce labeling at resource creation time, and uses Cloud Asset Inventory to audit and detect non-compliant resources. This approach is scalable across 5 teams, 20 projects, and 3 regions because it automates enforcement and provides continuous compliance monitoring without manual intervention.

Answer

Send monthly reminders to all teams via email to add labels to their resources.

Answer

Manually add labels to all existing and new resources through the Cloud Console.

Answer

Grant only project owners permission to create resources, and rely on them to enforce labeling.

Question 9

Which TWO statements about Cloud Identity-Aware Proxy (IAP) are correct?

Accepted Answer

IAP can be used to protect access to Compute Engine VMs via SSH and RDP without a VPN. Cloud IAP enables identity-based access to Compute Engine instances via SSH and RDP without requiring a VPN or bastion host. IAP uses the user's identity and request context to create a secure tunnel, forwarding traffic to the instance over HTTPS and verifying the user's credentials before allowing the connection.

Answer

IAP encrypts data at rest by default

Answer

IAP only works with Google Cloud applications

Answer

IAP requires using a third-party identity provider

Question 10

A large hospital network wants to move patient records to the cloud and enable doctors to access records from any device. The Chief Medical Officer is supportive, but the legal department raises data privacy concerns, and the IT department fears job losses. Which aspect of digital transformation does this scenario highlight?

Accepted Answer

Digital transformation requires aligning technology with people and culture — managing stakeholder concerns and change resistance is often harder than the technical migration.. Digital transformation is not solely about technology adoption; it critically involves managing the human and cultural aspects of change. In this scenario, the legal department's privacy concerns and the IT department's fear of job losses represent stakeholder resistance that must be addressed through communication, retraining, and policy alignment. Successful cloud migration in healthcare requires balancing technical migration with change management to ensure adoption and compliance.

Answer

The primary challenge is selecting the correct cloud database for patient records.

Answer

The hospital should delay cloud adoption until quantum computing makes it more secure.

Answer

The legal department's concerns prove that healthcare organizations cannot use public cloud.

Question 11

Which term describes a physical or conceptual object (like a factory machine, building, or supply chain) that is represented as a digital model in the cloud, allowing simulation and analysis without touching the physical object?

Accepted Answer

Digital twin — a real-time digital model of a physical object or system updated by sensor data.. A digital twin is a virtual representation of a physical object or system—such as a factory machine, building, or supply chain—that is continuously updated with real-time sensor data. This model lives in the cloud, enabling simulation, monitoring, and analysis without needing to interact with the physical asset. The key differentiator is the bidirectional data flow between the physical and digital worlds, which allows predictive maintenance and optimization.

Answer

Virtual machine — a software-based simulation of a computer.

Answer

Container — a lightweight application packaging format.

Answer

Microservice — a small, independently deployable application component.

Question 12

What is 'infrastructure as code' (IaC), and what problem does it solve compared to manually configuring cloud resources through a web console?

Accepted Answer

IaC defines infrastructure in version-controlled code files, enabling reproducible, automated, and consistent environment provisioning versus error-prone manual console configuration.. Infrastructure as Code (IaC) is the practice of managing and provisioning cloud resources through machine-readable definition files (e.g., YAML, JSON, HCL) rather than through manual processes like clicking in a web console. The core problem it solves is eliminating the error-prone, inconsistent, and non-reproducible nature of manual configuration by enabling version-controlled, automated, and repeatable deployments. Tools like Terraform, AWS CloudFormation, and Azure Resource Manager (ARM) templates are common IaC implementations that enforce desired state configuration and drift detection.

Answer

IaC is a programming language specifically for writing cloud applications.

Answer

IaC is a tool that automatically discovers and documents existing cloud infrastructure.

Answer

IaC requires writing custom Python scripts for every cloud resource type.

Question 13

A cloud architect is reviewing logs from a production incident. She wants to search all log entries across multiple Google Cloud projects for error messages containing a specific string. Which Google Cloud product enables centralized log searching and analysis across an entire organization?

Accepted Answer

Cloud Logging, which centralizes logs from all Google Cloud services and projects and supports powerful filtering and search queries across an organization. Cloud Logging (formerly Stackdriver Logging) is the Google Cloud service designed to ingest, store, and analyze log data from all Google Cloud services and projects. It supports centralized log aggregation across an entire organization via aggregated sinks and the Logs Explorer, enabling powerful filtering and search queries (e.g., using the `textPayload` or `jsonPayload` fields) to find specific error strings across multiple projects without needing to export data elsewhere.

Answer

Cloud Monitoring, which provides metric dashboards and alerting

Answer

BigQuery, by exporting logs to a dataset and running SQL queries to find matching error entries

Answer

Cloud Trace, which provides distributed request tracing for latency analysis

Question 14

A company is evaluating whether to adopt a multi-cloud strategy (using two or more cloud providers for different workloads). An engineer lists the following arguments: (1) resilience against a single cloud provider outage, (2) negotiating leverage on pricing, (3) using best-of-breed services from each provider. A cloud architect cautions that multi-cloud also introduces significant challenges. What is the most significant operational challenge of a multi-cloud approach?

Accepted Answer

Significantly increased operational complexity: teams need expertise in multiple providers' tools, security models, and APIs, while governance, monitoring, and cost management must span inconsistent environments. Multi-cloud environments inherently increase operational complexity. Teams must master distinct APIs, security models (e.g., IAM policies differ between AWS and GCP), monitoring tools (e.g., CloudWatch vs. Cloud Monitoring), and cost management consoles. Governance and compliance must be enforced consistently across heterogeneous platforms, which often requires custom tooling or third-party solutions, making day-to-day operations significantly more challenging than a single-cloud approach.

Answer

Multi-cloud requires purchasing separate hardware for each cloud provider's environment

Answer

Cloud providers refuse to allow customers to use competing providers simultaneously

Answer

Multi-cloud makes it impossible to use any managed services because applications must be portable across providers

Question 15

A company runs a multi-tenant SaaS application on Google Cloud where each customer's data must be strictly isolated from other customers'. A security architect is evaluating approaches: (A) logical isolation using application-level tenant IDs in a shared database, (B) IAM-based separation using separate service accounts per tenant, or (C) infrastructure-level isolation with separate Google Cloud projects per tenant. Which approach provides the strongest isolation guarantee?

Accepted Answer

Separate Google Cloud projects per tenant, which provides the strongest isolation: separate IAM boundaries, separate resource namespaces, separate audit logs, and no shared database instances with other tenants. Separate Google Cloud projects provide the strongest isolation guarantee by creating independent IAM boundaries, resource namespaces, audit logs, and network configurations. This approach ensures that no shared database instances or other resources exist between tenants, eliminating any risk of cross-tenant data leakage through application bugs or misconfigurations. In contrast, logical isolation (A) relies on application-level tenant IDs which can be bypassed by software vulnerabilities, and IAM-based separation (C) still shares the underlying project infrastructure, including the same database and network.

Answer

Logical isolation using application-level tenant IDs, because it is the most cost-efficient and sufficient for regulated workloads

Answer

IAM-based separation using separate service accounts per tenant within a shared project, because IAM provides cryptographically enforced access control

Answer

All three approaches provide equivalent isolation because Google Cloud's hypervisor ensures complete tenant separation at the hardware level

Question 16

A company's analytics team wants to enable business users to create their own reports and dashboards from a governed set of BigQuery data, without writing SQL. At the same time, the data engineering team must maintain centralized control over how key metrics (like 'revenue' or 'active users') are defined. Which Google Cloud product architecture best meets both requirements?

Accepted Answer

Looker with LookML semantic layer: data engineers centrally govern metric definitions in LookML, business users create self-service reports through Looker's interface using those governed definitions — no SQL required. Looker with LookML provides a semantic layer where data engineers centrally define governed metric definitions (e.g., 'revenue' as SUM(price * quantity) with specific filters). Business users can then create self-service reports and dashboards via Looker's drag-and-drop interface without writing SQL, ensuring consistency and control over key metrics.

Answer

Looker Studio connected directly to BigQuery, allowing each business user to create their own metric definitions

Answer

Sharing BigQuery query templates with business users and training them to modify them for their reports

Answer

Building a custom web application that wraps BigQuery APIs and presents data to business users

Question 17

A company is building a microservices architecture on Google Kubernetes Engine (GKE). They need to expose services externally with HTTPS, distribute traffic across the cluster, and protect against DDoS attacks. Which THREE Google Cloud services should they combine? (Choose THREE)

Accepted Answer

Cloud CDN. Cloud Load Balancing distributes external traffic, Cloud Armor provides DDoS and WAF protection, and Cloud CDN caches content and absorbs some DDoS. Cloud DNS resolves names but is not for traffic distribution. VPC firewall rules operate at network layer, not application.

Answer

Cloud DNS

Answer

VPC firewall rules

Question 18

Refer to the exhibit. A team deployed this Cloud Run service. During a load test, the service receives high traffic, but the number of container instances never exceeds 10. What is the most likely cause?

Accepted Answer

The maxScale annotation limits the maximum number of instances to 10.. The `maxScale` annotation in Cloud Run directly caps the maximum number of container instances that can be created. When the service receives high traffic but never exceeds 10 instances, it indicates that the `maxScale` annotation is set to 10, preventing further scaling even if demand increases. This is the most direct and likely cause among the options.

Answer

The minScale of 2 forces at least two instances, but not the max.

Answer

The containerConcurrency of 80 limits the number of concurrent requests per instance.

Answer

The CPU limit of 1 vCPU is too low to handle the traffic.

Question 19

A power utility company collects electricity meter readings from 10 million smart meters every 15 minutes — generating billions of rows of time-series data per year. They need to query this data to detect anomalies and patterns. Which Google Cloud database is optimized for this massive-scale time-series IoT data?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, making it ideal for ingesting and querying high-throughput time-series data from millions of IoT devices. It supports sub-10ms latency on queries, automatic sharding, and seamless integration with Google Cloud's data analytics ecosystem (e.g., BigQuery, Dataflow), which is critical for detecting anomalies and patterns across billions of rows of meter readings.

Answer

Cloud SQL (PostgreSQL)

Answer

Firestore

Answer

Cloud Storage (CSV files)

Question 20

An organization wants to ensure that all projects in the organization have a specific IAM policy applied, such as restricting the use of certain machine series. They also need to enforce this policy on new projects automatically. Where should they set this policy?

Accepted Answer

At the organization node. Organization policies applied at the organization node are inherited by all projects under it, ensuring uniform enforcement across the entire hierarchy.

Answer

At the project level for each project

Answer

Using tags on individual resources

Answer

At the folder level for each environment