Cloud Digital Leader Fundamental Cloud Concepts Practice Test 4 — 15 Questions

Question 1

A startup wants to run a containerized web application on Google Cloud without managing the underlying servers or Kubernetes clusters. They expect traffic to vary significantly, and they want to only pay for the resources consumed during request processing. Which Google Cloud compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that runs containers in response to events or HTTP requests, scales to zero, and charges only for resources used during request processing. It abstracts away all infrastructure management.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard

Question 2

A company wants to ensure that their customer data stored in BigQuery is encrypted at rest using customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud Key Management Service (Cloud KMS) allows customers to create, manage, and use encryption keys, including CMEK for BigQuery and other GCP services.

Answer

Cloud HSM

Answer

Identity-Aware Proxy (IAP)

Answer

Secret Manager

Question 3

A financial institution is deploying a sensitive workload on Compute Engine and needs to meet PCI DSS compliance. The security team wants to ensure that the virtual machines run on dedicated, single-tenant hardware and that no other customer's VMs share the same host. Which Compute Engine feature should they enable?

Accepted Answer

Sole-tenant nodes. Sole-tenant nodes ensure that VMs from that project are the only ones running on the underlying hardware, providing physical isolation and meeting compliance requirements for dedicated infrastructure.

Answer

Confidential VMs

Answer

Preemptible VMs

Answer

Shielded VMs

Question 4

A data analytics team needs to process streaming data from thousands of IoT devices in real time. They want to ingest the data, process it (e.g., windowed aggregations), and then load it into BigQuery for analysis. Which Google Cloud service should they use for the stream processing step?

Accepted Answer

Cloud Dataflow. Dataflow is a fully managed, serverless service for stream and batch data processing, based on Apache Beam. It can handle real-time streaming data, perform windowed aggregations, and write to BigQuery.

Answer

BigQuery

Answer

Cloud Pub/Sub

Answer

Cloud Dataproc

Question 5

A development team is building a microservices-based application and wants to use a service mesh to secure and observe inter-service communication. They are using Google Kubernetes Engine (GKE). Which Google Cloud service should they integrate with GKE to provide service mesh capabilities?

Accepted Answer

Cloud Service Mesh (Anthos Service Mesh). Anthos Service Mesh (ASM) is a fully managed service mesh that provides traffic management, security (mTLS), and observability for microservices running on GKE and other environments.

Answer

Apigee

Answer

Cloud Traffic Director

Answer

Cloud Endpoints

Question 6

A company is using Cloud SQL for MySQL and notices that read queries are becoming slow as the application scales. They want to offload read traffic from the primary instance to improve performance. Which Cloud SQL feature should they enable?

Accepted Answer

Read replicas. Cloud SQL read replicas are read-only copies of the primary instance that can serve read traffic, reducing load on the primary and improving query performance.

Answer

Automatic failover replicas

Answer

Connection pooling

Answer

Point-in-time recovery

Question 7

A multinational corporation needs to deploy a global web application that serves users from multiple continents. They want to minimize latency for end users by serving content from the nearest location. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud Load Balancing (global) with Cloud CDN. Cloud CDN uses Google's globally distributed edge caches to deliver content close to users, reducing latency. A load balancer with global routing distributes traffic across regional backends and directs users to the nearest healthy backend.

Answer

Compute Engine with regional load balancers

Answer

Cloud Run with Cloud NAT

Answer

Cloud DNS with Traffic Director

Question 8

A data scientist wants to train a machine learning model using a managed service that supports custom TensorFlow code and provides GPU/TPU hardware acceleration. They prefer not to manage the underlying infrastructure. Which Google Cloud service should they use?

Accepted Answer

AI Platform Training (Vertex AI Training). AI Platform Training (now Vertex AI Training) is a managed service that allows you to run custom TensorFlow/PyTorch training jobs on pre-configured VM instances with GPUs/TPUs, without managing the cluster.

Answer

Compute Engine with pre-installed TensorFlow

Answer

Cloud Functions

Answer

Google Kubernetes Engine with GPU nodes

Question 9

A security administrator needs to grant a developer the minimum permissions to create and delete Cloud Storage buckets in a specific project, but NOT allow them to modify the contents of those buckets (e.g., upload or delete objects). Which IAM role should they assign?

Accepted Answer

Custom role with storage.buckets.* permissions. Storage Admin (roles/storage.admin) grants full control over buckets and objects, which is too permissive. The correct approach is to create a custom role with only storage.buckets.* permissions, or use predefined roles like Storage Object Admin? Actually, Storage Object Admin allows object management. The question requires bucket management only. A custom role with storage.buckets.create and storage.buckets.delete (and maybe storage.buckets.get) is necessary; predefined roles do not separate bucket and object permissions perfectly. But among standard roles, 'Storage Admin' is too broad; there is no predefined role that only allows bucket management without object access. So the answer must be a custom role.

Answer

Storage Admin (roles/storage.admin)

Answer

Storage Object Admin (roles/storage.objectAdmin)

Answer

Project Editor (roles/editor)

Question 10

A company is migrating an on-premises Oracle database to Cloud Spanner. They need to move 10 TB of data with minimal downtime. Which migration strategy should they use?

Accepted Answer

Use Database Migration Service (DMS) with continuous replication. Database Migration Service (DMS) supports continuous migration from Oracle to Cloud Spanner with minimal downtime using change data capture (CDC).

Answer

Create a VPN tunnel and use Oracle GoldenGate for replication

Answer

Export the Oracle database as CSV files, upload to Cloud Storage, and import into Spanner using Dataflow

Answer

Use gcloud commands to stream data from Oracle to Spanner

Question 11

An organization wants to enforce that all Compute Engine VMs in a project are created with a specific set of tags (e.g., 'env=prod') and with a specific service account. Which Google Cloud policy tool should they use?

Accepted Answer

Organization policies (constraints). Organization policies (using constraints) can enforce rules on resource creation, such as requiring certain labels or service accounts. For example, a constraint can require that all VMs have a specific label or use a specific service account.

Answer

Cloud Audit Logs

Answer

Cloud Asset Inventory

Answer

Cloud IAM conditions

Question 12

A DevOps engineer notices that a Cloud Function is timing out after 9 minutes. The function performs a long-running data transformation. They need to increase the timeout. What is the maximum timeout they can set for a Cloud Function (1st gen)?

Accepted Answer

9 minutes. Cloud Functions (1st gen) have a maximum timeout of 9 minutes (540 seconds). For longer timeouts, they would need to use Cloud Functions (2nd gen) which supports up to 60 minutes, or use Cloud Run.

Answer

15 minutes

Answer

30 minutes

Answer

60 minutes

Question 13

A company is building a data lake on Google Cloud. They need to store both structured and unstructured data, and process it using batch and streaming jobs. Which TWO Google Cloud services should they use? (Choose 2)

Accepted Answer

Cloud Storage. Cloud Storage is the primary storage for the data lake (unstructured data, raw files), and BigQuery serves as the query layer for structured analytics. Dataflow could be a processing engine, but the question asks for storage and processing? Actually, the stem says 'store both structured and unstructured data' and 'process it using batch and streaming jobs'. The best combination is Cloud Storage (for storage) and Dataflow (for processing). But BigQuery also stores structured data. However, the question likely expects Cloud Storage for raw data and BigQuery for structured querying. But processing is also mentioned. The correct pair is Cloud Storage and Dataflow/BigQuery? Let's see options.

Answer

Cloud SQL

Answer

Firestore

Answer

Cloud Pub/Sub

Question 14

An e-commerce platform uses Compute Engine to serve its website. During a flash sale, traffic spikes and some instances become unhealthy. The team wants to automatically replace unhealthy instances and maintain a minimum number of running instances. Which TWO features should they configure? (Choose 2)

Accepted Answer

Managed instance group (MIG). Managed instance groups (MIGs) provide autoscaling and autohealing. Autoscaling adjusts the number of instances based on load, and autohealing replaces unhealthy instances automatically.

Answer

Regional load balancer

Answer

Cloud CDN

Answer

Cloud NAT

Question 15

A company wants to comply with GDPR and needs to ensure that personal data stored in Cloud Storage is encrypted at rest using customer-managed keys (CMEK). They also want to control access at the bucket level using IAM conditions. Which THREE steps should they take? (Choose 3)

Accepted Answer

Create a key ring and encryption key in Cloud KMS. To use CMEK, you need to create a key ring and key in Cloud KMS, then configure the bucket to use that key. IAM conditions can be used to restrict access based on attributes. Also, you need to grant the Cloud Storage service account the Encrypter/Decrypter role.

Answer

Use gsutil iam to set bucket-level IAM conditions

Answer

Enable Data Loss Prevention (DLP) API