Cloud Digital Leader Practice Test 8 — 10 Questions

Question 1

A company's security team wants to ensure that only approved corporate devices can access Google Cloud resources, regardless of whether the user has valid credentials. Which Google Cloud security capability enforces device-level access requirements?

Accepted Answer

Access Context Manager, which enforces device-level access requirements as part of context-aware access control policies. Access Context Manager is the correct choice because it allows security teams to define context-aware access policies that include device-level attributes such as device OS type, device ID, and whether the device is managed (e.g., via endpoint verification or third-party EMM). This enforces device-level access requirements even if the user has valid credentials, directly addressing the scenario.

Answer

Cloud Armor, which filters incoming requests based on IP allowlists and denylists

Answer

Identity-Aware Proxy (IAP), which provides application-level authentication but without device checks

Answer

VPC Service Controls, which restrict access to Google APIs based on network perimeter membership

Question 2

A software team deploys microservices using containers and wants Google Cloud to automatically manage the scaling, self-healing, and rollout of their containerized applications. They don't want to provision or manage underlying virtual machines. Which Google Cloud service best meets this need?

Accepted Answer

Google Kubernetes Engine (GKE), which manages containerized applications with automatic scaling, self-healing, and rolling updates. Google Kubernetes Engine (GKE) is the correct choice because it provides a managed Kubernetes environment that automates scaling, self-healing (e.g., automatic pod restarts and node repair), and rollout management (e.g., rolling updates and rollbacks) for containerized applications. This meets the requirement of not provisioning or managing underlying virtual machines, as GKE abstracts the node infrastructure.

Answer

Compute Engine, Google Cloud's virtual machine service

Answer

Cloud Storage, for storing container images and serving them to instances

Answer

Cloud CDN, which distributes containerized applications globally

Question 3

A financial services company is subject to regulations requiring them to demonstrate that their cloud provider's employees cannot access customer data without the customer's explicit approval. Which Google Cloud feature most directly addresses this requirement?

Accepted Answer

Access Transparency and Access Approval, which log and require explicit customer approval for Google personnel access to customer content. Access Transparency and Access Approval directly address the regulatory requirement by providing near real-time logs of Google personnel actions on customer content and requiring explicit customer approval before such access can occur. Access Transparency logs every access attempt by Google employees, while Access Approval allows customers to approve or deny those requests, ensuring no unauthorized access without customer consent.

Answer

Customer-Managed Encryption Keys (CMEK), where the customer controls the encryption key and can revoke access

Answer

Cloud Audit Logs, which record all customer actions within Google Cloud

Answer

VPC Service Controls, which prevent Google employees from accessing resources inside the service perimeter

Question 4

A marketing team wants to create interactive dashboards and reports for business stakeholders using data stored in BigQuery, without writing code. Which Google Cloud product is most appropriate for this self-service business intelligence requirement?

Accepted Answer

Looker Studio, Google's self-service data visualization tool with native BigQuery connectivity and a no-code interface. Looker Studio (formerly Google Data Studio) is the correct choice because it is Google Cloud's self-service business intelligence tool that provides a no-code, drag-and-drop interface for creating interactive dashboards and reports. It has native, built-in connectivity to BigQuery, allowing the marketing team to visualize data without writing any code or SQL queries.

Answer

Cloud Dataflow, Google Cloud's stream and batch data processing service

Answer

BigQuery itself, where the marketing team writes SQL queries to generate reports

Answer

Vertex AI, Google Cloud's unified machine learning platform

Question 5

A logistics company needs to send millions of shipment status updates per day from IoT tracking devices to backend systems for processing and storage. The solution must decouple the tracking devices from the backend and handle traffic spikes without losing messages. Which Google Cloud product best fits this asynchronous messaging requirement?

Accepted Answer

Cloud Pub/Sub, Google's fully managed messaging service that decouples producers from consumers and handles massive message volumes reliably. Cloud Pub/Sub is the correct choice because it is a fully managed, asynchronous messaging service designed to decouple producers (IoT devices) from consumers (backend systems). It can handle millions of messages per second, provides at-least-once delivery, and buffers messages during traffic spikes, ensuring no data loss without requiring the backend to be always available.

Answer

Cloud SQL, to store each tracking update as a row in a relational database as it arrives

Answer

Cloud Storage, to have each device upload a file containing its status update

Answer

Cloud Load Balancing, to distribute incoming tracking requests evenly across backend servers

Question 6

A healthcare provider wants to use AI to analyze unstructured medical records — scanned documents with handwritten notes and printed text — to extract diagnosis codes for billing. Which combination of Google Cloud AI products most directly addresses this document understanding use case?

Accepted Answer

Document AI and Vision API, which together handle OCR, layout understanding, and information extraction from scanned documents with handwritten and printed text. Option B is correct because Document AI is purpose-built for extracting structured information (like diagnosis codes) from unstructured documents, including both handwritten and printed text, using OCR and layout understanding. The Vision API complements this by providing advanced OCR capabilities for scanned images, together forming a direct solution for the healthcare provider's document understanding use case.

Answer

BigQuery ML and Looker Studio, to analyze and visualize the extracted diagnosis codes

Answer

Vertex AI Pipelines and Cloud Dataflow, to orchestrate machine learning training jobs on document data

Answer

Cloud Translation API and Natural Language API, to translate and analyze the text content of medical records

Question 7

A company has employees who use personal (unmanaged) devices to access corporate applications. The security team wants to prevent sensitive Google Workspace documents from being downloaded to personal devices. Which Google control most directly addresses this data loss prevention requirement for device-based scenarios?

Accepted Answer

Google Workspace context-aware access and endpoint management controls that restrict actions (such as downloads) for users accessing from unmanaged personal devices. Option B is correct because Google Workspace context-aware access combined with endpoint management allows administrators to create access level policies that restrict specific actions—such as downloading, printing, or copying—based on device trust signals. When a user accesses Google Workspace from an unmanaged personal device, the policy can block the download of sensitive documents directly, addressing the data loss prevention requirement at the action level rather than just the access level.

Answer

Cloud Armor, by blocking requests from IP addresses associated with personal devices

Answer

Enabling two-factor authentication for all users, which prevents unauthorized access

Answer

Encrypting all Google Drive files so they cannot be read on personal devices

Question 8

A company's security policy requires that all cloud-to-cloud communication between services must be encrypted in transit. An auditor asks how Google Cloud handles encryption for network traffic between Google services within its network. What is Google's default approach to encryption in transit within its infrastructure?

Accepted Answer

Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required. Google Cloud encrypts all network traffic between its data centers and internal services by default, using application-layer (e.g., gRPC with TLS) and link-layer encryption (e.g., MACsec or similar). This is a foundational security measure that requires no customer configuration, ensuring data is protected in transit even within Google's own infrastructure.

Answer

Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication

Answer

Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance

Answer

Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network

Question 9

A CTO explains to her board that moving to cloud reduces the company's 'total cost of ownership' compared to running an on-premises data center. Which cost category is most commonly underestimated in on-premises TCO calculations?

Accepted Answer

IT staff labor costs for ongoing maintenance, patching, hardware replacement, and operations, which are frequently underestimated in on-premises TCO. Option B is correct because on-premises TCO calculations frequently underestimate the labor costs associated with ongoing IT staff tasks such as applying security patches, performing hardware replacements, managing firmware updates, and handling day-to-day operations. These operational expenses (OpEx) accumulate over the lifecycle of the data center and often exceed the initial capital expenditure (CapEx) for hardware, making them a critical but overlooked component in total cost of ownership comparisons with cloud providers like AWS, Azure, or GCP.

Answer

Hardware acquisition costs, which are typically overestimated in on-premises environments

Answer

Software licensing costs, which are always higher on-premises than in the cloud

Answer

Internet bandwidth costs, which are negligible on-premises

Question 10

A company is evaluating whether to adopt a multi-cloud strategy (using two or more cloud providers for different workloads). An engineer lists the following arguments: (1) resilience against a single cloud provider outage, (2) negotiating leverage on pricing, (3) using best-of-breed services from each provider. A cloud architect cautions that multi-cloud also introduces significant challenges. What is the most significant operational challenge of a multi-cloud approach?

Accepted Answer

Significantly increased operational complexity: teams need expertise in multiple providers' tools, security models, and APIs, while governance, monitoring, and cost management must span inconsistent environments. Option B is correct because multi-cloud environments inherently increase operational complexity. Teams must master distinct APIs, security models (e.g., IAM policies differ between AWS and GCP), monitoring tools (e.g., CloudWatch vs. Cloud Monitoring), and cost management consoles. Governance and compliance must be enforced consistently across heterogeneous platforms, which often requires custom tooling or third-party solutions, making day-to-day operations significantly more challenging than a single-cloud approach.

Answer

Multi-cloud requires purchasing separate hardware for each cloud provider's environment

Answer

Cloud providers refuse to allow customers to use competing providers simultaneously

Answer

Multi-cloud makes it impossible to use any managed services because applications must be portable across providers