Cloud Digital Leader Fundamental Cloud Concepts Practice Test 2 — 15 Questions

Question 1

A company wants to comply with GDPR and needs to ensure that personal data stored in Cloud Storage is encrypted at rest using customer-managed keys (CMEK). They also want to control access at the bucket level using IAM conditions. Which THREE steps should they take? (Choose 3)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a key ring and encryption key in Cloud KMS. To use CMEK, you need to create a key ring and key in Cloud KMS, then configure the bucket to use that key. IAM conditions can be used to restrict access based on attributes. Also, you need to grant the Cloud Storage service account the Encrypter/Decrypter role.

Answer

Use gsutil iam to set bucket-level IAM conditions

Answer

Enable Data Loss Prevention (DLP) API

Question 2

A company wants to ensure its application remains available even if an entire data center fails. They plan to deploy the application across multiple zones within a single region. Which Google Cloud feature enables this?

Accepted Answer

Zone-level deployment. Deploying across multiple zones within a region provides high availability because zones are isolated from each other; if one zone fails, the application continues in other zones. This is a regional deployment (or multi-zone deployment), not a zone-level deployment. A zone-level deployment would place resources in a single zone and would not survive a zone failure. The provided options do not include a correct answer.

Answer

Multi-region deployment

Answer

Cloud CDN

Answer

Global load balancing

Question 3

An organization is migrating a sensitive application to Google Cloud and must comply with SOC 2 requirements. Which THREE actions should they take to meet their security responsibilities under the shared responsibility model? (Choose 3.)

Accepted Answer

Apply security patches to the guest OS and applications. Under the shared responsibility model, the customer is responsible for managing access, securing data, and maintaining the guest OS and applications. For SOC 2 compliance, implementing IAM roles, encryption with customer-managed keys, and applying security patches are essential actions. While network segmentation via VPC firewalls is also a customer responsibility, these three are the most directly required by SOC 2 for data protection and access control.

Answer

Ensure that Google's data centers are guarded 24/7

Answer

Implement network segmentation using VPC firewalls

Question 4

A company is designing a disaster recovery (DR) strategy. Their primary site is in the us-central1 region. They need to minimize data loss (low RPO) and restore quickly (low RTO) for a critical database. Which TWO approaches should they consider?

Accepted Answer

Use active-active setup across two regions with synchronous replication. Both active-active with synchronous replication and a warm standby replica in a secondary region can achieve low RPO and low RTO. Active-active continuously replicates data synchronously across regions, so both sites are up-to-date and can serve traffic immediately (low RTO, near-zero RPO). A warm standby replica maintains a continuously replicated copy in another region; it can be promoted quickly (low RTO) and losses are limited to replication lag (low RPO). Scheduled backups and multi-homing/global load balancing do not address database replication or quick restore.

Answer

Use multi-homing to route traffic to multiple regions

Answer

Take periodic snapshots and restore in another region

Answer

Configure a global load balancer with failover

Question 5

Which cloud computing characteristic is defined by the NIST as the ability for a consumer to provision computing capabilities automatically without requiring human interaction with each service provider?

Accepted Answer

On-demand self-service. On-demand self-service allows users to provision resources automatically, without needing manual approval or interaction with Google Cloud staff.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity

Question 6

A startup is deploying a containerised web application on Google Cloud. They want to minimise operational overhead and only pay for the resources consumed when requests are being processed. The application should automatically scale to zero when idle. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when idle and charges only for request processing time. App Engine is also serverless but requires a runtime environment and does not scale to zero as gracefully. Compute Engine and GKE require provisioning instances even if idle.

Answer

App Engine Standard

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Question 7

A financial services company must store and process sensitive customer data that is subject to GDPR and PCI DSS. They need to ensure that data is encrypted at rest and in transit, and that encryption keys are managed by a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which Google Cloud service should they use for key management?

Accepted Answer

Cloud Hardware Security Module (Cloud HSM). Cloud HSM provides dedicated HSM hardware, FIPS 140-2 Level 3 certification, and allows customers to manage their own keys. Cloud KMS is software-based and only offers Level 1 validation. Cloud EKM uses external key management but the question asks for a Google-managed HSM option. Secret Manager is for storing secrets, not key management with HSM.

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Secret Manager

Answer

Cloud Key Management Service (Cloud KMS)

Question 8

A global e-commerce platform runs on Compute Engine instances in multiple regions. Users report high latency when accessing the website from South America. The company wants to improve performance by delivering static content (images, CSS, JS) from the nearest edge location. Which Google Cloud service should they implement?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge network (Points of Presence) to cache static content closer to users, reducing latency. Cloud Load Balancing distributes traffic but doesn't cache content. Cloud Armor provides security. Cloud DNS resolves domain names.

Answer

Cloud DNS

Answer

Cloud Load Balancing

Answer

Cloud Armor

Question 9

According to the shared responsibility model, which of the following is the customer responsible for?

Accepted Answer

Data encryption and access control (IAM). Customers are responsible for securing their data, applications, and identity (IAM). Google is responsible for physical infrastructure, networks, and hypervisor security.

Answer

Physical security of data centers

Answer

Network infrastructure security

Answer

Hypervisor security

Question 10

A company wants to run a batch job that processes large files (up to 100 TB each) using a custom Linux executable. The job runs once a month and takes about 12 hours. They want to minimise cost. Which compute option should they choose?

Accepted Answer

Compute Engine with preemptible VMs. Compute Engine Preemptible VMs offer deep discounts (up to 60-90% off) and are suitable for fault-tolerant batch jobs. Preemptible VMs can be terminated at any time, but since the job can be restarted, it's cost-effective. Persistent disks are required for data. Cloud Run has a timeout limit of 60 minutes. GKE with Spot VMs is also an option but adds overhead. Standard Compute Engine is more expensive.

Answer

Compute Engine with standard VMs

Answer

Cloud Run

Answer

App Engine Flexible Environment

Question 11

A company is migrating its on-premises data warehouse to Google Cloud. The data warehouse contains structured relational data (sales transactions, customer records) and is queried using standard SQL. The company wants to separate compute and storage costs and automatically scale compute resources up and down based on query load. Which Google Cloud service is most appropriate?

Accepted Answer

BigQuery. BigQuery is a serverless data warehouse that separates compute and storage, scales automatically, and supports standard SQL. Cloud SQL is for OLTP, not data warehousing. Spanner is globally distributed OLTP. Dataproc is for Hadoop/Spark workloads, not directly for SQL warehousing.

Answer

Cloud SQL

Answer

Dataproc

Answer

Cloud Spanner

Question 12

What is a key benefit of using a Platform as a Service (PaaS) offering like App Engine compared to Infrastructure as a Service (IaaS) like Compute Engine?

Accepted Answer

No need to manage the underlying OS or runtime environment. PaaS abstracts away the underlying OS and runtime, so developers only manage their code. IaaS requires managing OS, patches, and middleware. PaaS also typically includes built-in scaling and load balancing.

Answer

Lower cost for always-on workloads

Answer

Full control over the operating system and hardware

Answer

Ability to install custom software on the server

Question 13

A company has deployed a web application on Compute Engine in us-central1-a. Users in Europe report high latency. The company wants to reduce latency by serving traffic from a location closer to European users. However, they currently use a zonal managed instance group. What is the MOST cost-effective and operationally simple approach to reduce latency for European users?

Accepted Answer

Change the managed instance group to regional, and use an HTTP(S) load balancer with the backend in europe-west1. A regional managed instance group across multiple zones in a European region (e.g., europe-west1) with a global load balancer will route users to the nearest backend, reducing latency. Recreating in a different zone in the same region doesn't help. Moving to Cloud Run might help but requires containerising the app. Using a single zone in Europe is not as resilient.

Answer

Create a new zonal instance group in europe-west1-a and use a round-robin DNS

Answer

Keep the instance group in us-central1 but enable Cloud CDN

Answer

Move the application to Cloud Run and deploy in europe-west1

Question 14

Which TWO of the following are NIST-defined characteristics of cloud computing?

Accepted Answer

Resource pooling. The NIST definition includes: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Virtualization is an enabling technology but not a characteristic. High availability is a benefit but not a NIST characteristic.

Answer

High availability

Answer

Pay-as-you-go pricing

Answer

Virtualization

Question 15

A company with a global user base wants to deploy a web application on Google Cloud that is highly available and resilient to zone failures. The application runs on Compute Engine and uses a stateful backend (e.g., a database). Which THREE design elements should they implement?

Accepted Answer

Use a managed database service with automatic failover across zones (e.g., Cloud SQL High Availability). To survive zone failures, deploy across multiple zones, use a regional load balancer to distribute traffic, and use a managed database service like Cloud SQL with high availability (which replicates across zones). A single zone cannot survive failure. Cloud CDN is for static content, not for zone failure resilience. Preemptible VMs are not suitable for stateful applications.

Answer

Use a single zone to keep data consistent

Answer

Use preemptible VMs to reduce costs