Cloud Digital Leader Practice Test 6 — 10 Questions

Question 1

A company wants to use pre-trained Google AI models to add vision capabilities to their application — specifically to detect objects in images and extract text from scanned documents — without training their own models. Which Google Cloud APIs provide these capabilities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Vision API for object detection and OCR; Cloud Document AI for structured document extraction.. Cloud Vision API provides pre-trained models for object detection and OCR (Optical Character Recognition) to extract text from images, while Cloud Document AI specializes in extracting structured data (e.g., fields, tables) from scanned documents. Both services require no custom training, aligning with the company's requirement to use pre-trained Google AI models.

Answer

BigQuery ML for both use cases — it trains vision models on image data stored in BigQuery.

Answer

Vertex AI AutoML Vision — train a custom model on your own images.

Answer

Cloud Natural Language API for text extraction from images.

Question 2

An enterprise wants employees to access internal web applications securely from any location (including remote work from home) without using a VPN. Employees should only access apps they're authorized for, based on their identity and device context. Which Google Cloud service enables this zero-trust access model?

Accepted Answer

Cloud Identity-Aware Proxy (IAP). Cloud Identity-Aware Proxy (IAP) is the correct service because it enforces zero-trust access by verifying a user's identity and device context before granting access to internal web applications, without requiring a VPN. It uses Google's BeyondCorp model to authenticate and authorize each request based on identity and context, allowing secure access from any location.

Answer

Cloud VPN with split tunneling for internal application access.

Answer

Cloud Armor IP allowlist to restrict access to corporate office IP ranges.

Answer

Cloud Load Balancing with SSL termination.

Question 3

A company's security team wants to control which resources on the internet can communicate with their virtual machines in Google Cloud. Which fundamental cloud networking concept provides this control?

Accepted Answer

VPC firewall rules that control inbound and outbound network traffic to VMs based on IP ranges, protocols, and ports. VPC firewall rules are the fundamental cloud networking construct that controls network traffic to and from virtual machine instances in Google Cloud. These rules operate at the network layer, filtering traffic based on source/destination IP ranges, protocols (e.g., TCP, UDP, ICMP), and port numbers, thereby governing which internet resources can communicate with the VMs.

Answer

Cloud IAM policies that grant or deny permissions for external systems to access VM resources

Answer

Cloud Storage bucket policies that restrict access to VM storage volumes

Answer

DNS records that determine which internet addresses can resolve the VM's hostname

Question 4

Which IAM component determines what actions a user is allowed to perform on a resource?

Accepted Answer

Authorization. Authorization is the process of determining what actions a user can perform; IAM roles and permissions define this.

Answer

Audit Logging

Answer

Authentication

Answer

Encryption

Question 5

A company wants to send transactional emails (receipts, password resets) and marketing emails at scale from their application. Which approach is recommended when using Google Cloud?

Accepted Answer

Integrate a third-party email delivery service (e.g., SendGrid, Mailgun) with the GCP application.. Google Cloud does not provide a native transactional email service, so integrating a dedicated third-party email delivery service like SendGrid or Mailgun is the recommended approach. These services handle deliverability, reputation management, and compliance with email standards (e.g., SPF, DKIM, DMARC), which are critical for high-volume transactional and marketing emails. Using GCP's native services like Cloud Functions or App Engine to send emails directly would rely on SMTP relays that often have strict sending limits and poor deliverability.

Answer

Use Gmail to manually send all transactional emails.

Answer

Use BigQuery to store and send emails directly to customers.

Answer

Deploy an SMTP server on Compute Engine and send emails directly from GCP IP addresses.

Question 6

A company's risk management team wants to understand Google Cloud's approach to supply chain security — specifically, how Google ensures that the hardware and firmware running in its data centers have not been tampered with. Which Google security initiative addresses hardware supply chain integrity?

Accepted Answer

Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance. Google's Titan security chip is a dedicated hardware root of trust that cryptographically verifies the boot firmware integrity and machine identity at every startup. This ensures that only Google-signed firmware runs on servers, preventing tampering during manufacturing, shipping, or deployment. Titan provides a hardware-anchored attestation chain that validates the entire supply chain from chip fabrication to rack installation.

Answer

Google uses third-party antivirus software to scan all hardware components for tampering before installation

Answer

Google relies on hardware manufacturers' security certifications to ensure supply chain integrity

Answer

Google encrypts all hardware components with AES-256 to prevent tampering

Question 7

A business user asks what makes cloud storage different from simply buying a larger external hard drive for the office. Which characteristic most clearly differentiates cloud storage from local storage devices?

Accepted Answer

Cloud storage is accessible from anywhere via the internet, scales elastically without hardware purchases, and provides built-in redundancy across multiple physical locations. Cloud storage is fundamentally different from local storage because it provides internet-based accessibility, elastic scalability without requiring hardware procurement, and built-in redundancy across geographically distributed data centers. These characteristics enable on-demand resource provisioning and high availability, which a single external hard drive cannot offer. The correct answer, B, captures these core differentiators that align with the NIST definition of cloud computing.

Answer

Cloud storage is faster than local storage for all types of data access

Answer

Cloud storage cannot be used for backup, while external hard drives are purpose-built for backup

Answer

Cloud storage requires specialized hardware on the customer's side to access data

Question 8

A company exports all their Google Cloud logs to Cloud Storage for long-term retention required by their compliance policy (7-year log retention). Which Cloud Logging feature enables routing logs to Cloud Storage?

Accepted Answer

Configure a Cloud Logging sink (log router) that routes logs to a Cloud Storage bucket.. Cloud Logging uses sinks (log routers) to export logs to supported destinations, including Cloud Storage. A sink defines a filter and a destination; when configured, it routes matching log entries to the specified Cloud Storage bucket for long-term retention. This is the only native mechanism for continuous, automated log export without custom scripting.

Answer

Cloud Logging automatically archives all logs to Cloud Storage with no configuration needed.

Answer

Enable log streaming in Cloud Storage settings to receive logs from Cloud Logging.

Answer

Use the Cloud Logging API to periodically download logs and upload them to Cloud Storage.

Question 9

A product manager wants to understand what 'latency' means for her company's cloud-hosted e-commerce application. Her developer explains that latency is critical for user experience. Which definition of latency is most accurate in this context?

Accepted Answer

Latency is the time elapsed between a user action (click, page load) and receiving the server's response — directly affecting how fast and responsive the application feels. Latency in the context of a cloud-hosted e-commerce application specifically measures the round-trip time from a user action (such as a click or page load) to the receipt of the server's response. This directly impacts perceived responsiveness and user experience, as higher latency leads to noticeable delays in interactions like adding items to a cart or checking out.

Answer

Latency is the total amount of data that can be transferred per second between the user and the application

Answer

Latency is the percentage of time the application is available versus unavailable

Answer

Latency is the number of requests the server can handle simultaneously before performance degrades

Question 10

A cloud team wants to understand their current Google Cloud resource inventory — specifically, which VMs are running in each region, their machine types, and whether they have public IP addresses. Which approach most efficiently provides this across all projects?

Accepted Answer

Use Cloud Asset Inventory to run a single org-wide query that returns all VM instances, their regions, machine types, and network configurations across all projects. Cloud Asset Inventory provides a single, unified API to query resources across all projects in an organization. By using the `gcloud asset search-all-resources` command with the `--asset-types=compute.googleapis.com/Instance` filter, you can retrieve all VM instances along with their regions, machine types, and network configurations (including public IP addresses) in one operation, without needing to access each project individually.

Answer

Log into each Google Cloud project individually through the Console and manually record VM details in a spreadsheet

Answer

Check the Cloud Billing reports, which list all resources that have incurred charges by resource type

Answer

Enable VPC flow logs in each project to capture VM network activity