Cloud Digital Leader Fundamental Cloud Concepts — Timed 15 Questions

Question 1

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Answer

Cloud Spanner

Answer

BigQuery

Answer

Firestore

Question 2

Which cloud computing characteristic is defined by the NIST as the ability for a consumer to provision computing capabilities automatically without requiring human interaction with each service provider?

Accepted Answer

On-demand self-service. On-demand self-service allows users to provision resources automatically, without needing manual approval or interaction with Google Cloud staff.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity

Question 3

A startup is deploying a containerised web application on Google Cloud. They want to minimise operational overhead and only pay for the resources consumed when requests are being processed. The application should automatically scale to zero when idle. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when idle and charges only for request processing time. App Engine is also serverless but requires a runtime environment and does not scale to zero as gracefully. Compute Engine and GKE require provisioning instances even if idle.

Answer

App Engine Standard

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Question 4

A financial services company must store and process sensitive customer data that is subject to GDPR and PCI DSS. They need to ensure that data is encrypted at rest and in transit, and that encryption keys are managed by a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which Google Cloud service should they use for key management?

Accepted Answer

Cloud Hardware Security Module (Cloud HSM). Cloud HSM provides dedicated HSM hardware, FIPS 140-2 Level 3 certification, and allows customers to manage their own keys. Cloud KMS is software-based and only offers Level 1 validation. Cloud EKM uses external key management but the question asks for a Google-managed HSM option. Secret Manager is for storing secrets, not key management with HSM.

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Secret Manager

Answer

Cloud Key Management Service (Cloud KMS)

Question 5

A global e-commerce platform runs on Compute Engine instances in multiple regions. Users report high latency when accessing the website from South America. The company wants to improve performance by delivering static content (images, CSS, JS) from the nearest edge location. Which Google Cloud service should they implement?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge network (Points of Presence) to cache static content closer to users, reducing latency. Cloud Load Balancing distributes traffic but doesn't cache content. Cloud Armor provides security. Cloud DNS resolves domain names.

Answer

Cloud DNS

Answer

Cloud Load Balancing

Answer

Cloud Armor

Question 6

According to the shared responsibility model, which of the following is the customer responsible for?

Accepted Answer

Data encryption and access control (IAM). Customers are responsible for securing their data, applications, and identity (IAM). Google is responsible for physical infrastructure, networks, and hypervisor security.

Answer

Physical security of data centers

Answer

Network infrastructure security

Answer

Hypervisor security

Question 7

A company wants to run a batch job that processes large files (up to 100 TB each) using a custom Linux executable. The job runs once a month and takes about 12 hours. They want to minimise cost. Which compute option should they choose?

Accepted Answer

Compute Engine with preemptible VMs. Compute Engine Preemptible VMs offer deep discounts (up to 60-90% off) and are suitable for fault-tolerant batch jobs. Preemptible VMs can be terminated at any time, but since the job can be restarted, it's cost-effective. Persistent disks are required for data. Cloud Run has a timeout limit of 60 minutes. GKE with Spot VMs is also an option but adds overhead. Standard Compute Engine is more expensive.

Answer

Compute Engine with standard VMs

Answer

Cloud Run

Answer

App Engine Flexible Environment

Question 8

An engineer needs to create a custom machine type on Compute Engine for a workload that requires exactly 6 vCPUs and 20 GB of memory. The engineer uses the gcloud command-line tool. Which command correctly creates the instance?

Accepted Answer

gcloud compute instances create my-instance --custom-cpu=6 --custom-memory=20GB. Custom machine types are specified using the --custom-cpu and --custom-memory flags. The correct syntax is --custom-cpu=6 --custom-memory=20GB. The other options use incorrect flags or formats.

Answer

gcloud compute instances create my-instance --custom-cpu 6 --custom-memory 20

Answer

gcloud compute instances create my-instance --cpu=6 --memory=20GB

Answer

gcloud compute instances create my-instance --machine-type custom-6-20480

Question 9

A company is migrating its on-premises data warehouse to Google Cloud. The data warehouse contains structured relational data (sales transactions, customer records) and is queried using standard SQL. The company wants to separate compute and storage costs and automatically scale compute resources up and down based on query load. Which Google Cloud service is most appropriate?

Accepted Answer

BigQuery. BigQuery is a serverless data warehouse that separates compute and storage, scales automatically, and supports standard SQL. Cloud SQL is for OLTP, not data warehousing. Spanner is globally distributed OLTP. Dataproc is for Hadoop/Spark workloads, not directly for SQL warehousing.

Answer

Cloud SQL

Answer

Dataproc

Answer

Cloud Spanner

Question 10

What is a key benefit of using a Platform as a Service (PaaS) offering like App Engine compared to Infrastructure as a Service (IaaS) like Compute Engine?

Accepted Answer

No need to manage the underlying OS or runtime environment. PaaS abstracts away the underlying OS and runtime, so developers only manage their code. IaaS requires managing OS, patches, and middleware. PaaS also typically includes built-in scaling and load balancing.

Answer

Lower cost for always-on workloads

Answer

Full control over the operating system and hardware

Answer

Ability to install custom software on the server

Question 11

A company has deployed a web application on Compute Engine in us-central1-a. Users in Europe report high latency. The company wants to reduce latency by serving traffic from a location closer to European users. However, they currently use a zonal managed instance group. What is the MOST cost-effective and operationally simple approach to reduce latency for European users?

Accepted Answer

Change the managed instance group to regional, and use an HTTP(S) load balancer with the backend in europe-west1. A regional managed instance group across multiple zones in a European region (e.g., europe-west1) with a global load balancer will route users to the nearest backend, reducing latency. Recreating in a different zone in the same region doesn't help. Moving to Cloud Run might help but requires containerising the app. Using a single zone in Europe is not as resilient.

Answer

Create a new zonal instance group in europe-west1-a and use a round-robin DNS

Answer

Keep the instance group in us-central1 but enable Cloud CDN

Answer

Move the application to Cloud Run and deploy in europe-west1

Question 12

A company uses Cloud Storage buckets to store sensitive customer data. They must ensure that all objects are encrypted at rest using a customer-managed encryption key (CMEK) stored in Cloud KMS. They also need to prevent any object from being uploaded without encryption. How can they enforce this at the bucket level?

Accepted Answer

Configure a bucket policy that denies uploads unless the x-goog-encryption-kms-key-name header is present with a specific CMEK key. Setting a bucket policy that requires CMEK encryption (via defaultKmsKeyName) and using organization policy constraints (like constraints/storage.requireCustomerManagedEncryption) can enforce encryption. The other options either don't enforce CMEK specifically or are not bucket-level settings.

Answer

Enable object versioning and set a lifecycle rule to delete objects without CMEK

Answer

Use a Cloud Function to scan each object after upload and delete those not encrypted with CMEK

Answer

Set the bucket's default encryption to use a CMEK key, and enable the 'Requester Pays' setting

Question 13

A company is building a real-time chat application that requires low-latency messaging across multiple regions. The application needs to store user profiles and chat history. Which TWO Google Cloud services should the company consider for storing this data?

Accepted Answer

Cloud Memorystore. Cloud Firestore offers real-time synchronization and is suitable for chat messages and user profiles. Cloud Memorystore is a managed Redis/Memcached service that can be used for caching and real-time data. Cloud SQL is not designed for real-time multi-region sync. Bigtable is not ideal for chat history with complex queries. Datastore is the older version of Firestore.

Answer

Cloud SQL

Answer

Cloud Datastore

Answer

Cloud Bigtable

Question 14

Which TWO of the following are NIST-defined characteristics of cloud computing?

Accepted Answer

Resource pooling. The NIST definition includes: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Virtualization is an enabling technology but not a characteristic. High availability is a benefit but not a NIST characteristic.

Answer

High availability

Answer

Pay-as-you-go pricing

Answer

Virtualization

Question 15

A company with a global user base wants to deploy a web application on Google Cloud that is highly available and resilient to zone failures. The application runs on Compute Engine and uses a stateful backend (e.g., a database). Which THREE design elements should they implement?

Accepted Answer

Use a managed database service with automatic failover across zones (e.g., Cloud SQL High Availability). To survive zone failures, deploy across multiple zones, use a regional load balancer to distribute traffic, and use a managed database service like Cloud SQL with high availability (which replicates across zones). A single zone cannot survive failure. Cloud CDN is for static content, not for zone failure resilience. Preemptible VMs are not suitable for stateful applications.

Answer

Use a single zone to keep data consistent

Answer

Use preemptible VMs to reduce costs