Cloud Digital Leader Practice Exam 56 — 20 Questions

Question 1

A company uses Cloud Spanner for a global application. They need to ensure high availability and disaster recovery across regions. Which TWO actions should they take? (Choose 2)

Accepted Answer

Schedule regular backups using Cloud Spanner backup feature. Cloud Spanner's built-in backup feature allows you to create consistent backups of your database without impacting performance, and these backups can be restored to a different region for disaster recovery. This provides a reliable way to recover from regional failures or data corruption, ensuring high availability and DR across regions.

Answer

Deploy the database in a single region with backups

Answer

Configure read replicas in a different region

Answer

Use Cloud Memorystore to cache database queries

Question 2

A retail company uses Google Cloud to run an online store. They have a security requirement that all API calls to Cloud Storage must come from the company's on-premises network only. Which Google Cloud security feature should they implement?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define perimeters that restrict access to Google Cloud services from specified VPC networks or IP ranges. Cloud Armor is for DDoS and WAF. IAM conditions are for attribute-based access control within a policy. Identity-Aware Proxy protects web applications, not storage APIs.

Answer

IAM conditions with source IP constraint

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Question 3

A platform engineering team is designing a self-service cloud environment for development teams. They want developers to be able to provision approved cloud resources quickly without waiting for central IT approval for every request, while still ensuring compliance with security and cost policies. Which architectural approach best balances developer agility with governance?

Accepted Answer

Provide a self-service catalog of pre-approved, policy-compliant infrastructure templates with automated provisioning, budget alerts, and org policy guardrails — enabling developer agility while enforcing compliance automatically. It uses a self-service catalog with pre-approved, policy-compliant templates (e.g., Deployment Manager or Terraform configurations) combined with Organization Policy Service guardrails and automated budget alerts. This approach allows developers to provision resources on demand while enforcing security and cost policies automatically, balancing agility with governance without manual bottlenecks.

Answer

Require all resource provisioning requests to be submitted as tickets to the central IT team for manual review and approval before any resources are created

Answer

Give all developers Owner access to all Google Cloud projects so they can provision any resources without delays

Answer

Allow developers to provision resources freely in a shared sandbox project only, keeping production entirely controlled by central IT

Question 4

A company uses Google Cloud and has a compliance requirement to store certain data only within the European Union and ensure it cannot be accessed from outside the EU, even by Google operations personnel. Which Google Cloud offering specifically addresses this level of data sovereignty?

Accepted Answer

Sovereign Controls offerings (e.g., T-Systems Sovereign Cloud) or Assured Workloads with data residency and personnel access controls.. Sovereign Controls offerings (such as T-Systems Sovereign Cloud) and Assured Workloads with data residency and personnel access controls are specifically designed to meet strict data sovereignty requirements. These solutions ensure that data remains within the EU and that Google operations personnel cannot access it, addressing both geographic storage and access restrictions mandated by compliance frameworks like GDPR.

Answer

Selecting EU regions for all resources in the Cloud Console.

Answer

VPC Service Controls — they prevent data from leaving the VPC boundary.

Answer

Cloud Armor — it blocks requests originating from outside the EU.

Question 5

A CISO asks why Google Cloud's security model is described as a 'defense-in-depth' approach. Which explanation best describes this concept in the context of Google Cloud's infrastructure security?

Accepted Answer

Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system. Google Cloud's defense-in-depth model implements security at multiple independent layers: physical security (e.g., tamper-evident cages), hardware attestation (e.g., Titan chips verifying boot integrity), network encryption (e.g., mTLS between all services), hypervisor isolation (e.g., gVisor or KVM-based sandboxing), and application-level IAM (e.g., Cloud IAM policies). This layered approach ensures that if an attacker bypasses one layer, other layers remain intact to protect the system, aligning with the core principle of defense in depth.

Answer

Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data

Answer

Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary

Answer

Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure

Question 6

An organization uses Google Cloud Identity and Access Management (IAM). A new employee is a data engineer who needs to read BigQuery datasets and run queries but should NOT be able to create new datasets, delete tables, or modify IAM policies. Which IAM role should be assigned?

Accepted Answer

`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries). The `roles/bigquery.dataViewer` role grants read access to BigQuery datasets and their contents, while `roles/bigquery.jobUser` allows the user to run query jobs. Together, they satisfy the requirement to read datasets and run queries without permitting dataset creation, table deletion, or IAM policy modification.

Answer

`roles/bigquery.admin`

Answer

`roles/viewer` (project-level Viewer)

Answer

`roles/bigquery.dataEditor`

Question 7

A company runs a web application on Compute Engine instances behind a managed instance group with autoscaling based on CPU utilization. After a marketing campaign, traffic spikes and the autoscaler adds instances quickly, but the application becomes slow. What is the most likely cause?

Accepted Answer

Autoscaler uses CPU utilization but the application is memory-bound. The autoscaler adds instances based on CPU utilization, but if the application is memory-bound, adding more instances does not alleviate memory pressure. Each new instance still runs the same memory-intensive workload, so CPU may remain low while memory is exhausted, causing slowdowns. The autoscaler fails to address the actual bottleneck, leading to poor performance despite scaling out.

Answer

Instances are in different zones causing inter-zone latency

Answer

Autoscaling cooldown period is too short

Answer

Health check interval is too long

Question 8

A development team needs a managed relational database (MySQL or PostgreSQL) for their web application. They want automatic backups, patching, and high availability without managing a database server. Which Google Cloud service provides this?

Accepted Answer

Cloud SQL. Cloud SQL is a fully managed relational database service for MySQL, PostgreSQL, and SQL Server. It handles automated backups, patching, and high availability (via regional failover replicas) without requiring the user to manage the underlying database server, directly matching the team's requirements.

Answer

Compute Engine with a self-managed MySQL installation.

Answer

Cloud Bigtable

Answer

Cloud Storage

Question 9

A company has a stateful application running on Compute Engine. They want to scale horizontally while preserving state. Which configuration should they use?

Accepted Answer

Managed instance group with stateful configuration.. A managed instance group (MIG) with stateful configuration preserves instance-specific state (such as disks, hostnames, and metadata) across autohealing and rolling updates. This allows the stateful application to scale horizontally while maintaining its persistent data, as each instance retains its unique state even when the group is resized or instances are recreated.

Answer

Use Cloud Run with volumes.

Answer

Unmanaged instance group.

Answer

Managed instance group with autoscaling and no stateful configuration.

Question 10

A company is concerned that employees might accidentally or maliciously upload sensitive personal data (such as credit card numbers or Social Security Numbers) to Cloud Storage buckets. Which Google Cloud product can automatically scan uploaded files and identify sensitive data patterns?

Accepted Answer

Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection. Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to inspect and classify sensitive data within Cloud Storage objects. It uses built-in detectors (infoTypes) to identify patterns like credit card numbers (Luhn check) and Social Security Numbers, and can trigger automated actions such as redaction or logging when sensitive data is found.

Answer

Cloud Armor, which inspects incoming HTTP requests for sensitive data patterns

Answer

Cloud Logging, which records all file upload events to Cloud Storage

Answer

Security Command Center, which audits Cloud Storage bucket permissions

Question 11

A startup is deploying a containerised web application on Google Cloud. They want to minimise operational overhead and only pay for the resources consumed when requests are being processed. The application should automatically scale to zero when idle. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when idle and charges only for request processing time. App Engine is also serverless but requires a runtime environment and does not scale to zero as gracefully. Compute Engine and GKE require provisioning instances even if idle.

Answer

App Engine Standard

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Question 12

A web application's homepage loads user-specific data (shopping cart, recent orders) on every visit. The data changes frequently. An engineer suggests caching this data in a Redis cache between the web tier and the database. What is the primary benefit of this caching layer?

Accepted Answer

Caching reduces database load and improves response times by serving frequently accessed data from fast in-memory storage.. Caching user-specific data like shopping carts and recent orders in Redis reduces the load on the primary database by serving frequently accessed data from fast in-memory storage. This improves response times for the web application, as Redis can deliver data in microseconds compared to the millisecond latency of a typical relational database query. The caching layer acts as a temporary, high-speed buffer that offloads read-heavy traffic from the database, which is especially beneficial for data that changes frequently but is read often.

Answer

Caching encrypts data in transit between the web tier and database.

Answer

Caching permanently stores user data so the database can be deleted.

Answer

Caching automatically synchronizes data between multiple database replicas.

Question 13

A company's IT team is planning its network architecture for a Google Cloud deployment. They want to ensure that their development, staging, and production environments are completely isolated from each other at the network level. What is the most effective way to achieve this isolation in Google Cloud?

Accepted Answer

Deploying each environment (dev, staging, prod) in separate VPC networks — optionally in separate Google Cloud projects — to achieve complete network isolation with no default connectivity between environments. Deploying each environment in separate VPC networks (optionally in separate projects) provides complete network isolation by default. In Google Cloud, VPC networks are isolated entities with no inherent peering or connectivity; traffic between them requires explicit VPC peering or VPN configurations. This ensures that development, staging, and production environments cannot communicate at the network layer unless intentionally connected, meeting the requirement for complete isolation.

Answer

Using separate subnets within the same VPC for each environment, with firewall rules blocking cross-subnet traffic

Answer

Using different IP address ranges for each environment within the same network

Answer

Using Cloud IAM to restrict developers from accessing production resources, which achieves the same isolation as network separation

Question 14

A company's compliance team asks what evidence they can provide to regulators to demonstrate that Google Cloud services meet industry security standards. Which type of documentation most directly provides this evidence?

Accepted Answer

Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager, which provide independent verification of security controls. Compliance reports and audit certifications from independent third parties (SOC 2 Type II reports, ISO 27001 certificates, PCI DSS attestation) are the most credible evidence for regulators. These documents represent independent auditors certifying that specific controls were in place and operating effectively during the audit period. Google Cloud makes these reports available to customers through the Compliance Reports Manager.

Answer

Google Cloud's marketing materials and product documentation describing security features

Answer

The company's own internal security policies that reference using Google Cloud

Answer

A Google Cloud support ticket confirming that the company's account is in good standing

Question 15

A small startup can now access the same world-class AI, machine learning, and global infrastructure that previously only Fortune 500 companies with billion-dollar IT budgets could afford. Which cloud characteristic enables this competitive equalization?

Accepted Answer

Cloud's pay-per-use model and managed services give any organization access to enterprise-grade capabilities without large upfront capital investment.. The cloud's pay-per-use model eliminates the need for large upfront capital expenditures, while managed services (e.g., AWS RDS, Azure SQL Database, Google Cloud AI Platform) abstract away the operational complexity of maintaining enterprise-grade infrastructure. This allows a small startup to leverage the same AI/ML models, GPU clusters, and global network backbones that Fortune 500 companies use, paying only for what they consume rather than provisioning for peak capacity.

Answer

Cloud providers charge smaller companies lower rates than enterprises.

Answer

Cloud providers assign dedicated infrastructure to small companies so they always have priority access.

Answer

Government regulations require cloud providers to offer equal service levels to all customers.

Question 16

What does 'high availability' mean in the context of cloud services, and how is it typically measured?

Accepted Answer

High availability means a system is operational for a very high percentage of time, typically measured as a percentage (e.g., 99.9% uptime).. High availability (HA) refers to a system's ability to remain operational and accessible for an exceptionally high proportion of time, minimizing downtime. It is typically quantified as a percentage of uptime over a defined period, such as 99.9% ('three nines'), which corresponds to approximately 8.76 hours of downtime per year. This metric is fundamental in cloud service level agreements (SLAs) to guarantee service continuity.

Answer

High availability means a system is fast — it responds to requests in under 100 milliseconds.

Answer

High availability means a system stores data in multiple geographic locations for disaster recovery.

Answer

High availability requires manual intervention to restart failed services within 30 minutes.

Question 17

A consumer goods company uses cloud-based demand sensing — analyzing real-time sales signals, social media trends, and weather data to adjust production runs dynamically. This has reduced stockouts by 35% and overstock waste by 28%. Which aspect of digital transformation does this most directly exemplify?

Accepted Answer

Operational transformation through real-time data integration and machine learning that enables continuous, signal-driven production decisions. The scenario describes a shift from static, forecast-based production to dynamic, signal-driven decisions using real-time data integration (sales signals, social media, weather) and machine learning. This directly exemplifies operational transformation, a core pillar of digital transformation where cloud-based analytics and AI enable continuous optimization of core business processes like manufacturing.

Answer

Cost reduction through infrastructure consolidation and server decommissioning

Answer

Business continuity improvement through data backup and disaster recovery in the cloud

Answer

Employee productivity improvement through providing staff with cloud-based collaboration tools

Question 18

A developer needs to grant a service account the minimum permissions required to publish messages to a Pub/Sub topic. Which IAM role should they assign?

Accepted Answer

roles/pubsub.publisher. The `roles/pubsub.publisher` role grants the minimum permissions required to publish messages to a Pub/Sub topic. This role includes the `pubsub.topics.publish` permission, which allows a service account to send messages to a specific topic without granting any other unnecessary permissions like subscribing or managing the topic.

Answer

roles/editor

Answer

roles/pubsub.subscriber

Answer

roles/pubsub.admin

Question 19

A company migrated a microservices application to Google Kubernetes Engine (GKE). They set up an internal HTTP(S) load balancer to route traffic to the services. However, some pods are not receiving traffic. What is the most likely cause?

Accepted Answer

The pods have failing readiness probes that are preventing them from being added to the load balancer's backend endpoints.. Readiness probes determine whether a pod is ready to serve traffic. If they fail, the pod is removed from the endpoint list, causing no traffic. Firewall rules for internal load balancers are typically auto-configured.

Answer

The service type is NodePort instead of LoadBalancer.

Answer

The cluster does not have enough nodes to schedule the pods.

Answer

The firewall rules are not allowing traffic from the load balancer to the nodes.

Question 20

A startup wants to run a containerized web application that scales to zero when not in use, and only pay for the time the container is processing requests. Which Google Cloud compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a fully managed serverless compute platform that automatically scales your containerized application to zero when there are no incoming requests. You are billed only for the resources consumed during request processing, measured in 100-millisecond increments, which aligns perfectly with the requirement to pay only for active processing time.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard Environment

Answer

Compute Engine with autoscaling