Cloud Digital Leader Fundamental Cloud Concepts Practice Test 4 — 15 Questions

Question 1

A company is migrating a legacy monolithic application to Google Cloud. The application has variable traffic and requires a relational database. They want to minimize operational overhead. Which TWO Google Cloud services should they choose? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Run. Cloud Run (A) is correct because it is a fully managed serverless compute platform that automatically scales containerized workloads up and down based on traffic, which directly addresses the variable traffic requirement while minimizing operational overhead since Google manages the underlying infrastructure. Cloud SQL (B) is correct because it is a fully managed relational database service supporting MySQL, PostgreSQL, and SQL Server, satisfying the relational database requirement without the operational burden of self-managing database instances. Together, Cloud Run and Cloud SQL form a low-overhead, autoscaling stack suited to a migrated monolithic application with fluctuating demand. Compute Engine (C) is not ideal because it provides raw VMs that the customer must patch, scale, and manage, increasing operational overhead. Google Kubernetes Engine (D) is not chosen because managing clusters adds operational complexity compared to serverless Cloud Run. BigQuery (E) is a serverless analytics data warehouse, not a relational OLTP database, so it does not fit the transactional relational requirement.

Answer

Compute Engine

Answer

Google Kubernetes Engine

Answer

BigQuery

Question 2

A company is deploying a microservices architecture on Google Cloud and wants to ensure secure communication between services. Which THREE measures should they implement? (Choose THREE.)

Accepted Answer

Configure firewall rules to allow only necessary traffic. Using service mesh (e.g., Anthos Service Mesh) enables mTLS between services. Configuring firewall rules restricts network traffic. Enabling VPC Flow Logs helps monitor and audit traffic.

Answer

Assign public IP addresses to all services

Answer

Use the same service account for all services

Question 3

A startup needs to migrate an on-premises web application to the cloud with minimal operational overhead. The application runs on a custom runtime that is difficult to containerize. The team wants to focus only on code, not infrastructure management. Which Google Cloud service is MOST appropriate?

Accepted Answer

App Engine. App Engine is a fully managed platform-as-a-service that lets teams deploy code without managing servers, and it supports custom runtimes via flexible environment. For a startup wanting minimal operational overhead and a custom runtime that is hard to containerize, App Engine's flexible environment is the most appropriate fit. It handles scaling, patching, and infrastructure while letting the team focus on code.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Run

Question 4

Which characteristic of cloud computing allows a user to provision virtual machines without needing to interact with Google Cloud support or create a ticket?

Accepted Answer

On-demand self-service. On-demand self-service means users can provision resources automatically without human interaction. The other options are also NIST characteristics but do not specifically address provisioning without manual intervention.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 5

An organization needs to store confidential healthcare data in Google Cloud. Which compliance certification ensures that Google Cloud infrastructure meets the required security controls for protected health information (PHI)?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the U.S. regulation that governs the protection of protected health information (PHI). Google Cloud offers a HIPAA Business Associate Agreement (BAA) and compliance certification for its infrastructure, ensuring the required security controls for storing PHI are met. This is the specific compliance framework for healthcare data.

Answer

ISO 27001

Answer

SOC 2

Answer

PCI DSS

Question 6

A global e-commerce company wants to serve its website from Google Cloud with low latency to users worldwide. The website consists of static content (images, CSS) and dynamic content served by a backend application. Which combination of services should they use?

Accepted Answer

Cloud Storage with Cloud CDN for static content, and Compute Engine instances behind Cloud Load Balancing for dynamic content. Serving a global website with both static and dynamic content is best done by offloading static assets to Cloud Storage fronted by Cloud CDN for edge caching, while running the dynamic backend on Compute Engine instances behind Cloud Load Balancing for global anycast routing and health-checked distribution. This combination minimizes latency and scales each tier independently.

Answer

Compute Engine with Cloud Armor

Answer

Cloud Functions for all content

Answer

Cloud Storage only

Question 7

A developer needs to deploy a containerized microservice that scales to zero when not in use and automatically scales up on incoming traffic. The microservice uses a custom container image that listens on port 8080. Which Google Cloud compute service is BEST suited for this requirement?

Accepted Answer

Cloud Run. Cloud Run is a managed compute platform that runs stateless containers, automatically scales (including to zero), and charges only for resources used during request processing. It fits the requirement perfectly. GKE requires managing a cluster and doesn't scale to zero by default; App Engine standard environment has a sandbox that may not support custom containers; Cloud Functions is limited to specific runtimes.

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) with Horizontal Pod Autoscaler

Answer

App Engine standard environment

Question 8

A financial services company is required to keep all data within a specific geographic region for regulatory compliance. They plan to deploy a globally distributed application using Cloud Spanner. How should they configure Cloud Spanner to meet this compliance requirement?

Accepted Answer

Use a single-region configuration in the required region. Cloud Spanner allows you to choose specific regions for your instance, and replicas are placed only within that region. Multi-region configurations span multiple geographic areas and would violate the data residency requirement. Therefore, a single-region configuration is required.

Answer

Use a multi-region configuration with a write region in the required region

Answer

Use a multi-region configuration but restrict access to only one region

Answer

Use a dual-region configuration

Question 9

An organization wants to use Google Cloud to analyze large-scale genomic data. The data is stored in Cloud Storage in a compressed format. They need to run a custom Python pipeline that preprocesses the data and then uses a GPU-intensive algorithm for alignment. The preprocessing is CPU-bound and takes 30 minutes per sample, while the alignment takes 1 hour per sample on a GPU. They have thousands of samples. Which compute approach is MOST cost-effective?

Accepted Answer

Use preemptible VMs with CPU for preprocessing and preemptible VMs with GPU for alignment, with checkpointing. Preemptible VMs are significantly cheaper (up to 80% discount) than regular VMs, and the workload is fault-tolerant if checkpointing is used. The preprocessing is CPU-bound and the alignment is GPU-bound, so using preemptible CPU VMs for preprocessing and preemptible GPU VMs for alignment minimizes cost. Checkpointing allows the pipeline to resume after a preemption without losing all progress, making this the most cost-effective approach for thousands of samples.

Answer

Use committed use discounts for 1 year on GPU instances

Answer

Use regular VMs with both CPU and GPU on the same instance

Answer

Use sole-tenant nodes for data isolation

Question 10

A company is migrating a legacy monolithic application to Google Cloud. The application has variable traffic and requires a relational database. They want to minimize operational overhead. Which TWO Google Cloud services should they choose? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rehost the application on Compute Engine using a custom image of the current OS. Lift and shift (rehosting) moves the application as-is to the cloud, often by creating a custom image to run on Compute Engine. This minimizes changes. Refactoring (rearchitecting) involves code changes; re-platforming modifies the OS/platform; rebuilding is a full rewrite.

Answer

Rebuild the application from scratch on Cloud Run

Answer

Re-platform the application to a supported OS version

Answer

Refactor the application into microservices and deploy on GKE

Question 11

A data engineer needs to run a one-time complex data transformation job on a large dataset (10 TB) stored in Cloud Storage. The job will take approximately 8 hours and is not fault-tolerant. The engineer wants the cheapest possible compute option that can reliably complete the job. What should they use?

Accepted Answer

Standard VMs (on-demand) and delete them after the job. Preemptible VMs can be terminated at any time, so they are not reliable for a non-fault-tolerant job. Standard VMs are reliable and can be stopped after the job to save costs. Committed use discounts require long-term commitment. Dataflow is a fully managed service but may have a minimum cost; however, the question asks for the cheapest compute option, and standard VMs (with proper sizing) can be cheaper than Dataflow for a one-time job.

Answer

Preemptible VMs

Answer

Committed use discount VMs for 1 year

Answer

Dataflow with preemptible workers

Question 12

A company runs a critical application on Compute Engine that must always be available, even if an entire zone fails. The application stores state in a Cloud Spanner instance. The operations team wants to test disaster recovery procedures without affecting production. Which TWO actions should they take? (Select two.)

Accepted Answer

Create a Cloud Spanner clone from the production instance for testing. Option D is correct because Cloud Spanner clones create an independent, cost-efficient copy of the production instance (including its databases and data) that can be used for disaster recovery testing without touching production. Option E is correct because restoring a backup to a new Cloud Spanner instance produces a separate instance that is fully isolated from production, so testers can validate recovery procedures safely. Option A is wrong because using a different database on the same production instance still shares the instance's resources and risks impacting production. Option B is wrong because a manual failover of the production Spanner instance would disrupt the live production system, which the team explicitly wants to avoid. Option C is wrong because read-only IAM access to production does not provide an isolated environment for testing disaster recovery procedures.

Answer

Use the same Spanner instance but with a different database

Answer

Perform a manual failover of the production Spanner instance to another region

Answer

Modify IAM roles to grant testers read-only access to production

Question 13

A startup wants to run a containerized web application on Google Cloud without managing the underlying servers or Kubernetes clusters. They expect traffic to vary significantly, and they want to only pay for the resources consumed during request processing. Which Google Cloud compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that runs containers in response to events or HTTP requests, scales to zero, and charges only for resources used during request processing. It abstracts away all infrastructure management.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard

Question 14

A company wants to ensure that their customer data stored in BigQuery is encrypted at rest using customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud Key Management Service (Cloud KMS) allows customers to create, manage, and use encryption keys, including CMEK for BigQuery and other GCP services.

Answer

Cloud HSM

Answer

Identity-Aware Proxy (IAP)

Answer

Secret Manager

Question 15

A financial institution is deploying a sensitive workload on Compute Engine and needs to meet PCI DSS compliance. The security team wants to ensure that the virtual machines run on dedicated, single-tenant hardware and that no other customer's VMs share the same host. Which Compute Engine feature should they enable?

Accepted Answer

Sole-tenant nodes. Sole-tenant nodes provide dedicated, single-tenant hardware for Compute Engine VMs, ensuring that no other customer's VMs share the same host. This meets the PCI DSS requirement for dedicated hardware.

Answer

Confidential VMs

Answer

Preemptible VMs

Answer

Shielded VMs