Cloud Digital Leader Practice Exam 56 — 20 Questions

Question 1

A large enterprise wants to enforce the principle of least privilege for its cloud resources. The security team needs to audit all IAM policy changes across the organization and ensure that custom roles are used where predefined roles are too permissive. Which three Google Cloud services or features should be combined to achieve this? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IAM Recommender. IAM Recommender (A) is correct because it analyzes actual resource usage and generates least-privilege recommendations, such as suggesting replacements for overly broad predefined roles with narrower custom roles. Cloud Audit Logs (C) is correct because Admin Activity audit logs record all IAM policy changes (SetIamPolicy calls) across the organization, providing the audit trail the security team requires. Organization Policies (D) is correct because constraints like iam.allowedPolicyMemberDomains and iam.disableServiceAccountKeyCreation enforce guardrails at the org/folder/project level, helping restrict permissions and enforce least privilege consistently. Cloud Key Management Service (B) is wrong because it manages encryption keys, not IAM policy auditing or role scoping. Security Command Center (E) is wrong because it focuses on security posture, threat detection, and vulnerability findings rather than auditing IAM policy changes or recommending custom roles.

Answer

Cloud Key Management Service

Answer

Security Command Center

Question 2

A security team needs to detect and respond to threats in real time using network traffic analysis and log correlation. Which THREE services should they use? (Choose 3)

Accepted Answer

Chronicle. Chronicle (B) is correct because it is Google Cloud's security analytics platform that ingests and correlates logs at scale, enabling real-time threat detection through rules and threat intelligence. Cloud IDS (C) is correct because it provides network traffic analysis using Palo Alto Networks technology to detect intrusions, malware, and other threats in real time. Security Command Center (E) is correct because it aggregates findings from multiple sources, including Cloud IDS and other services, to give a centralized view of threats and misconfigurations for response. Cloud KMS (A) is a key management service for encryption keys, not threat detection, and Cloud Armor (D) is a WAF/DDoS protection service that filters traffic but does not perform log correlation or comprehensive threat detection.

Answer

Cloud KMS

Answer

Cloud Armor

Question 3

A company wants to reduce its cloud spending by optimizing storage costs for infrequently accessed data. Which THREE Google Cloud storage classes should they consider? (Choose three.)

Accepted Answer

Archive. The scenario asks for storage classes suited to infrequently accessed data to cut costs, and the three marked options fit that profile. C (Archive) is correct because it is the lowest-cost class for data accessed less than once a year, with a 365-day minimum storage duration, ideal for long-term retention. D (Coldline) is correct because it targets data accessed less than once a quarter, offering low cost with a 90-day minimum storage duration. E (Nearline) is correct because it is designed for data accessed less than once a month, providing lower cost than hotter classes with a 30-day minimum storage duration. A (Standard) is not appropriate because it is the highest-cost class for frequently accessed data, and B (Regional) is not a storage class but a location type that can apply to Standard, Nearline, Coldline, or Archive, so neither reduces cost for infrequent access.

Answer

Standard

Answer

Regional

Question 4

An organization needs to ensure that data stored in Cloud Storage is encrypted at rest using keys that are rotated every 30 days. They also need to audit who accesses the keys and when. Which THREE services should they use? (Choose 3)

Accepted Answer

Cloud Audit Logs. Cloud KMS (E) is correct because it provides Customer-Managed Encryption Keys (CMEK) that can be configured with a 30-day rotation schedule, satisfying the key rotation requirement for data at rest. Cloud Storage (D) is correct because it is the service holding the data and supports CMEK encryption, allowing objects to be encrypted with keys managed in Cloud KMS. Cloud Audit Logs (B) is correct because it records Admin Activity and Data Access audit logs for Cloud KMS, enabling the organization to audit who accessed keys and when. Cloud HSM (A) is not required here since the scenario asks for key rotation and auditing, not hardware-backed key protection, and Cloud HSM is a key protection level rather than a separate auditing or rotation service. Secret Manager (C) is not appropriate because it stores secrets such as API keys and passwords, not encryption keys for Cloud Storage data at rest.

Answer

Cloud HSM

Answer

Secret Manager

Question 5

A company wants to gain visibility into their Google Cloud spending across multiple projects. Which TWO methods allow them to analyze cost data?

Accepted Answer

Set up billing export to BigQuery.. Option B is correct because exporting billing data to BigQuery gives granular, queryable cost and usage data (via the Cloud Billing export, including detailed usage cost and pricing data) that can be analyzed with SQL across multiple projects linked to the billing account. Option D is correct because the Cost Management dashboard (Cloud Billing reports) provides built-in visibility into spend by project, service, SKU, and labels, allowing cost analysis across projects. Option A is incorrect because Premium Support is a support plan and does not itself provide cost analysis tooling. Option C is incorrect because the Pricing Calculator only estimates future costs for planned configurations, not actual historical spending. Option E is incorrect because budget alerts only notify you when spending approaches or exceeds a threshold; they do not provide analytical breakdowns of cost data.

Answer

Upgrade to Premium Support.

Answer

Use the Google Cloud Pricing Calculator.

Answer

Set up budget alerts.

Question 6

A company is adopting a multi-cloud strategy to avoid vendor lock-in and use best-of-breed services. Which TWO statements accurately describe multi-cloud? (Choose 2)

Accepted Answer

It can help avoid vendor lock-in.. Option D is correct because multi-cloud deliberately spreads workloads across more than one provider, so dependence on any single vendor's proprietary services, pricing, and APIs is reduced, directly mitigating vendor lock-in. Option E is correct because the defining characteristic of multi-cloud is the use of two or more distinct public cloud providers (for example AWS plus Azure plus GCP), which is exactly what enables best-of-breed service selection. Option A is incorrect because connecting an on-premises data centre to a single public cloud describes a hybrid cloud, not multi-cloud. Option B is incorrect because multi-cloud does not require an on-premises private cloud; it can consist entirely of public cloud providers. Option C is incorrect because multi-cloud typically increases management complexity, requiring separate tooling, identity, networking, and cost controls per provider rather than reducing it.

Answer

It connects an on-premises data centre to a single public cloud.

Answer

It requires a private cloud on-premises.

Answer

It reduces management complexity.

Question 7

A company is building a real-time analytics pipeline on Google Cloud. They need to ingest streaming data from IoT devices, process it with low latency, and then store the results for real-time querying. Which TWO services should they use? (Choose TWO.)

Accepted Answer

Cloud Pub/Sub. Cloud Pub/Sub (A) is correct because it is Google Cloud's fully managed, globally scalable messaging service designed for ingesting high-volume streaming data from sources such as IoT devices, decoupling producers from consumers with low-latency, at-least-once delivery. Cloud Dataflow (C) is correct because it is a fully managed Apache Beam runner that performs stream and batch processing with low latency, including windowing, aggregations, and exactly-once semantics, making it the right choice to transform the Pub/Sub stream before writing results downstream. Cloud Storage (B) is not appropriate as the primary ingestion or processing layer for real-time streaming, since it is object storage optimized for durable blobs rather than low-latency event streams. Cloud Functions (D) is event-driven and serverless but is intended for lightweight, short-lived functions, not sustained low-latency stream processing pipelines. BigQuery (E) is a powerful analytics warehouse for real-time querying of stored results, but it is a destination/serving layer rather than the ingestion or stream-processing service the scenario requires.

Answer

Cloud Storage

Answer

Cloud Functions

Answer

BigQuery

Question 8

A company runs a critical application on Compute Engine that must always be available, even if an entire zone fails. The application stores state in a Cloud Spanner instance. The operations team wants to test disaster recovery procedures without affecting production. Which TWO actions should they take? (Select two.)

Accepted Answer

Create a Cloud Spanner clone from the production instance for testing. Option D is correct because Cloud Spanner clones create an independent, cost-efficient copy of the production instance (including its databases and data) that can be used for disaster recovery testing without touching production. Option E is correct because restoring a backup to a new Cloud Spanner instance produces a separate instance that is fully isolated from production, so testers can validate recovery procedures safely. Option A is wrong because using a different database on the same production instance still shares the instance's resources and risks impacting production. Option B is wrong because a manual failover of the production Spanner instance would disrupt the live production system, which the team explicitly wants to avoid. Option C is wrong because read-only IAM access to production does not provide an isolated environment for testing disaster recovery procedures.

Answer

Use the same Spanner instance but with a different database

Answer

Perform a manual failover of the production Spanner instance to another region

Answer

Modify IAM roles to grant testers read-only access to production

Question 9

A company wants to deploy a web application that automatically scales based on traffic, and they do not want to manage infrastructure. The application is written in Python and uses a Flask framework. Which TWO Google Cloud services could they use?

Accepted Answer

Cloud Run. Cloud Run (C) is correct because it is a fully managed serverless platform that runs containerized applications, automatically scales out and back to zero based on traffic, and requires no infrastructure management, making it ideal for a Python Flask app packaged in a container. App Engine Standard (E) is also correct because it is a fully managed serverless PaaS that natively supports Python and Flask, automatically scales instances with traffic, and abstracts away all server management. The other options do not fit: Google Kubernetes Engine (A) requires managing cluster infrastructure and nodes, Compute Engine (D) is raw IaaS where the company must manage VMs and scaling itself, and Cloud Functions (B) is designed for event-driven, single-purpose functions rather than hosting a full Flask web application.

Answer

Google Kubernetes Engine

Answer

Cloud Functions

Answer

Compute Engine

Question 10

A company is building a microservices architecture on Google Kubernetes Engine (GKE). They need to expose services externally with HTTPS, distribute traffic across the cluster, and protect against DDoS attacks. Which THREE Google Cloud services should they combine? (Choose THREE)

Accepted Answer

Cloud CDN. Cloud Load Balancing (E) is correct because it provides the external HTTPS load balancer that fronts the GKE services, terminates TLS, and distributes incoming traffic across the cluster's nodes and pods. Cloud Armor (D) is correct because it attaches to the external load balancer's backend service to provide WAF rules and Layer 3/4/7 DDoS protection, including Google Cloud's edge-based network DDoS mitigation. Cloud CDN (C) is correct because it caches content at Google's global edge locations, reducing origin load and absorbing traffic spikes, which complements the load balancer and helps mitigate volumetric attacks. Cloud DNS (A) is not required for this scenario since it only resolves domain names and does not distribute traffic or provide DDoS protection, and VPC firewall rules (B) operate at the network level within the VPC but do not expose services externally over HTTPS or defend against DDoS at the edge.

Answer

Cloud DNS

Answer

VPC firewall rules

Question 11

Which TWO statements are benefits of using a multi-cloud strategy? (Choose 2)

Accepted Answer

Ability to use best-of-breed services from different providers. Option D is correct because a multi-cloud strategy lets an organization select each provider's strongest or most specialized service (for example, AWS Lambda for serverless, Google BigQuery for analytics, or Microsoft Entra ID for identity) rather than being confined to a single vendor's catalog, directly improving capability fit. Option E is correct because distributing workloads across two or more independent providers reduces dependency on any single vendor's proprietary APIs, pricing changes, and outage risk, making it easier to migrate or rebalance workloads and thereby lowering vendor lock-in. The unmarked options do not belong: A is wrong because multi-cloud typically increases the attack surface and identity/network complexity, so it does not inherently reduce overall security risk; B is wrong because managing multiple providers, IAM models, and billing systems usually complicates rather than simplifies operational management; and C is wrong because latency depends on user location, peering, and workload placement, and multi-cloud does not guarantee improved latency for all users.

Answer

Reduced overall security risk

Answer

Simplified operational management

Answer

Improved latency for all users

Question 12

A company runs a high-performance computing (HPC) workload on Compute Engine that requires low-latency, high-throughput scratch storage. The workload is checkpointed every hour. Which TWO storage options should the engineer consider for the scratch storage? (Choose 2)

Accepted Answer

Persistent Disk (SSD). Option B (Persistent Disk SSD) is correct because SSD-backed Persistent Disks deliver the high IOPS and throughput needed for low-latency scratch storage while remaining durable and independent of the VM lifecycle, which suits an HPC workload that checkpoints hourly. Option C (Local SSD) is correct because Local SSDs are physically attached NVMe devices offering the lowest latency and highest throughput per instance, making them ideal for scratch data that is regenerated from checkpoints. Option A (Persistent Disk HDD) is not appropriate because HDD-backed disks have much lower IOPS and higher latency than SSDs. Option D (Filestore) is a managed NFS file service optimized for shared file access rather than the highest-throughput local scratch storage. Option E (Cloud Storage) is an object store accessed over the network, so it cannot provide the low-latency, high-throughput block-level scratch performance required.

Answer

Persistent Disk (HDD)

Answer

Filestore

Answer

Cloud Storage

Question 13

A company is designing a disaster recovery strategy for a critical application. They need to ensure that if an entire Google Cloud region becomes unavailable, the application can still serve traffic from another region with minimal data loss. Which TWO strategies should they implement? (Choose 2.)

Accepted Answer

Deploy the application in multiple regions. Option A is correct because deploying the application in multiple regions ensures that if an entire Google Cloud region becomes unavailable, the application can continue serving traffic from another region, directly addressing the requirement for regional failover. Option B is correct because synchronous replication writes data to the standby database in another region before acknowledging the write, which minimizes data loss (near-zero RPO) as required by the scenario. Option C is incorrect because multiple zones within a single region do not protect against a full regional outage. Option D is incorrect because asynchronous replication can result in some data loss during failover, which conflicts with the minimal data loss requirement. Option E is incorrect because a single load balancer does not provide cross-region redundancy and could itself become a single point of failure.

Answer

Deploy the application in multiple zones within a single region

Answer

Use asynchronous replication for the database

Answer

Use a single load balancer

Question 14

Which TWO statements accurately describe Google Cloud's sustainability commitments? (Choose 2)

Accepted Answer

Google Cloud aims to run on 24/7 carbon-free energy in all its data centers by 2030.. Option C is correct because Google has committed to operating all of its data centers on 24/7 carbon-free energy (CFE) by 2030, meaning every hour of every day will be matched by clean energy sources on the same regional grid. Option D is correct because Google has matched 100% of its global annual electricity consumption with renewable energy purchases since 2017, a commitment that applies across its global operations including Google Cloud. Option A is not accurate as stated because carbon neutrality applies to Google's overall operations through offsets and renewable matching, not to every individual cloud region being inherently carbon-neutral. Option B is incorrect because Google's commitment is to offset its historical carbon emissions cumulatively by 2030, not that it has already offset all historical emissions. Option E is incorrect because Google's data centers are not powered exclusively by on-site solar panels; they rely on a mix of grid electricity and renewable energy purchases such as PPAs.

Answer

All Google Cloud regions are already carbon-neutral.

Answer

Google Cloud offsets all of its historical carbon emissions.

Answer

Google Cloud data centers are powered exclusively by on-site solar panels.

Question 15

A data engineering team needs to process streaming data from IoT devices, perform real-time transformations, and load the results into BigQuery for analysis. Which TWO Google Cloud services should they use?

Accepted Answer

Pub/Sub. Pub/Sub (A) is correct because it is Google Cloud's fully managed, globally scalable messaging service designed to ingest high-volume streaming data from IoT devices, decoupling producers from consumers. Dataflow (D) is correct because it provides a fully managed Apache Beam runner for real-time (streaming) transformations with exactly-once processing, and it has a native BigQueryIO connector for loading results into BigQuery. Together, Pub/Sub ingests the IoT stream and Dataflow transforms it and writes to BigQuery. Cloud Scheduler (B) is only a cron-based job trigger, not a streaming data processor. Dataproc (C) is a managed Hadoop/Spark service better suited to batch processing rather than low-latency streaming pipelines. Cloud Functions (E) is an event-driven serverless compute service for short-lived functions, not a scalable stream-processing framework for continuous IoT transformations.

Answer

Cloud Scheduler

Answer

Dataproc

Answer

Cloud Functions

Question 16

Which TWO statements about encryption in transit in Google Cloud are correct? (Choose 2)

Accepted Answer

Google Cloud uses TLS for all external traffic to its APIs.. Option A is correct because Google Cloud terminates all external traffic to its public APIs using TLS (HTTPS), so clients connecting to services such as the Compute Engine API or Cloud Storage API get transport encryption without any extra configuration. Option B is correct because Google encrypts data in transit between its regions and zones by default at the network layer, independent of customer action, so replication and inter-region traffic is protected automatically. Option C is wrong because users do not need to provision TLS certificates for Google-managed services; Google handles the certificates for its endpoints. Option D is wrong because encryption between Google Cloud and the internet is not automatic for all services — for example, a plain HTTP or unencrypted protocol endpoint is not encrypted unless the user configures TLS. Option E is wrong because encryption in transit is not defined as AES-256; TLS negotiates ciphers such as AES-GCM, and AES-256 is more typically associated with encryption at rest, not a blanket statement for transit.

Answer

Users must configure TLS certificates for all Google Cloud services.

Answer

Data in transit between Google Cloud and the internet is encrypted by default for all services.

Answer

Encryption in transit uses AES-256.

Question 17

A company is building a real-time leaderboard for an online game using Google Cloud. They need a database that can handle millions of updates per second with low latency and serve the current top scores. Which TWO services should they use together? (Choose 2)

Accepted Answer

Cloud Bigtable. Cloud Bigtable (C) is correct because it is a fully managed, horizontally scalable NoSQL database designed for high-throughput, low-latency workloads, making it suitable for ingesting millions of score updates per second and durably storing the leaderboard data. Memorystore for Redis (D) is correct because it provides an in-memory data store with sub-millisecond latency, ideal for serving the current top scores in real time and handling rapid ranking operations. Together, Bigtable handles massive write throughput while Redis serves the hot leaderboard reads. Cloud SQL (A) is not appropriate because it is a relational database that cannot scale to millions of updates per second with low latency. Firestore (B) is not ideal because, while it is a NoSQL document database, it is optimized for mobile/web app synchronization rather than extreme write throughput. BigQuery (E) is not suitable because it is an analytics data warehouse designed for large-scale queries, not real-time transactional updates.

Answer

Cloud SQL

Answer

Firestore

Answer

BigQuery

Question 18

A retail company wants to reduce latency for customers in Europe and Asia by hosting their application closer to users. They also need high availability in case of a regional outage. Which TWO actions should they take?

Accepted Answer

Deploy the application in multiple regions. Option A (Deploy the application in multiple regions) is correct because placing application instances in multiple geographic regions is the only way to actually host the application closer to users in both Europe and Asia, directly reducing latency for each user population. Option D (Configure a global load balancer) is correct because a global load balancer (such as a Google Cloud global external HTTP(S) load balancer with a single anycast IP) routes each user to the nearest healthy regional backend and automatically fails over to another region during a regional outage, satisfying the high-availability requirement. Option B (single region with multiple zones) does not belong because multiple zones protect only against zonal failures within one region, not a full regional outage, and it cannot bring the application closer to both Europe and Asia. Option C (Cloud CDN) does not belong because caching static content reduces latency for cacheable assets but does not by itself provide multi-region application hosting or regional failover for dynamic workloads. Option E (increase machine size in a single zone) does not belong because vertical scaling in one zone neither reduces geographic latency nor provides resilience against a regional outage.

Answer

Use a single region with multiple zones

Answer

Enable Cloud CDN on the application

Answer

Increase machine size in a single zone

Question 19

A company is migrating its on-premises PostgreSQL database to Google Cloud. They need a managed service that is fully compatible with PostgreSQL, offers high availability, and provides automated backups. Which TWO Google Cloud services should they consider?

Accepted Answer

Cloud SQL. Cloud SQL (A) is correct because it is a fully managed relational database service that supports PostgreSQL with full compatibility, offers high availability through regional configurations with automatic failover, and provides automated backups and point-in-time recovery. AlloyDB (C) is also correct because it is a fully managed PostgreSQL-compatible database service designed for high availability with a multi-node architecture and automated backups, while offering enhanced performance for demanding workloads. Memorystore (B) is incorrect because it is a managed in-memory data store for Redis and Memcached, not a PostgreSQL-compatible relational database. Filestore (D) is incorrect because it is a managed network file storage service (NFS) for file-based workloads, not a database service. Cloud Bigtable (E) is incorrect because it is a fully managed NoSQL wide-column database, not PostgreSQL-compatible.

Answer

Memorystore

Answer

Filestore

Answer

Cloud Bigtable

Question 20

A developer wants to build a CI/CD pipeline that automatically builds a Docker container from a GitHub repository, stores the image securely, and deploys it to Cloud Run. Which THREE services should they integrate? (Select 3)

Accepted Answer

Cloud Build. Cloud Build (A) is the correct service to define and execute the CI/CD pipeline that pulls the source from GitHub and runs the docker build steps to produce the container image. Artifact Registry (B) is the secure, recommended place to store and manage the resulting Docker images (replacing the deprecated Container Registry), and Cloud Run can natively pull images from it. Cloud Run (D) is the deployment target where the built image is served as a fully managed serverless container, completing the pipeline. Cloud Storage (C) is not appropriate because it stores objects/blobs rather than container images with registry semantics, and Cloud Source Repositories (E) is a Git hosting service that would duplicate GitHub rather than build or deploy anything.

Answer

Cloud Storage

Answer

Cloud Source Repositories