Cloud Digital Leader How Google Cloud Resources Are Managed — 15 Questions

Question 1

An engineer wants to export billing cost data to BigQuery for custom reporting. They have created a BigQuery dataset and linked it to the billing account. However, the billing export tables are not being populated. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BigQuery dataset is in a different location from the billing account's default region. Billing export to BigQuery requires the billing account to be linked to a project that contains the dataset, and the dataset must be in the same location (e.g., US or EU) as the billing account's default region.

Answer

The billing export has not been enabled in the Cloud Console

Answer

The engineer does not have the Billing Administrator IAM role

Answer

The billing account is not linked to the project containing the BigQuery dataset

Question 2

A team needs to analyze spending patterns across projects using BigQuery. The billing export is already configured. However, the team cannot see any data in the billing export dataset. What is the most likely reason?

Accepted Answer

The IAM permissions for the BigQuery dataset are incorrect. Billing export tables are typically populated within a few hours to a day. If no data is visible, the most common cause is that the team lacks necessary IAM permissions (e.g., BigQuery Data Viewer) on the export dataset. Dataset location does not need to match a billing account region, and export tables are not monthly.

Answer

The billing account has not been linked to the project

Answer

The BigQuery dataset is in a different region than the billing account's default region

Answer

The billing export tables are only updated monthly

Question 3

A company needs to optimize costs for Compute Engine VMs. They have a mix of workloads: some are batch jobs that can be interrupted, while others are critical services that must run 24/7. The company wants to use the most cost-effective options without sacrificing reliability for critical services. Which THREE strategies should they implement?

Accepted Answer

Use committed use discounts for the 24/7 critical services. Committed use discounts provide larger discounts for predictable, always-on workloads. Rightsizing VMs using Active Assist recommendations helps eliminate wasted resources by matching VM sizes to actual usage. Preemptible/Spot VMs are ideal for fault-tolerant batch jobs. The other options are not effective cost optimization strategies.

Answer

Set up budget alerts to monitor spending

Answer

Rely solely on sustained use discounts for all instances

Question 4

A company needs to track spending per team by tagging resources with a 'team' label. However, some engineers are not applying consistent labels, leading to untagged resources. How can they enforce that all new resources are created with a specific label?

Accepted Answer

Use a custom organization policy to require the 'team' label on all resources.. Organization policies can be used to enforce that resources must have certain labels by defining a custom constraint that requires the 'team' label on all resources. This denies resource creation if the label is missing.

Answer

Set up a budget alert to notify when untagged resources are created.

Answer

Create a folder per team and apply labels at the folder level.

Answer

Run a weekly script to tag untagged resources.

Question 5

A developer wants to create a new project in Google Cloud. They have the Project Creator role at the organization level. Which of the following is NOT required to create a project?

Accepted Answer

The Google Cloud CLI installed locally. The Google Cloud CLI installed locally is NOT required to create a project, because projects can be created via the Cloud Console, the gcloud CLI, the Resource Manager REST API, or client libraries — no local CLI installation is mandatory. The other options are all genuinely required or relevant: B (resourcemanager.projects.create permission) is the IAM permission needed to create a project, which the Project Creator role grants; C (a billing account linked to the project) is required to use billable services and is part of the normal project-creation flow; and D (enabling the Cloud Resource Manager API) is needed for programmatic project creation via the API. Thus only A is not a requirement.

Answer

The resourcemanager.projects.create permission

Answer

A billing account linked to the project

Answer

Enabling the Cloud Resource Manager API

Question 6

A company has a Premium support plan. They experience a critical production outage and need immediate assistance. What is the guaranteed response time for a P1 (Priority 1) case?

Accepted Answer

15 minutes. Google Cloud Premium Support guarantees a 15-minute response time for P1 cases, which are defined as critical production outages with severe business impact. This is the fastest SLA tier and is explicitly documented for Premium support. The 15-minute target applies to initial response, not resolution.

Answer

4 hours

Answer

8 hours

Answer

1 hour

Question 7

An organization wants to enforce that all Compute Engine instances must have a label 'environment' set to 'production', 'staging', or 'development'. They also want to ensure that instances in the 'production' folder cannot be created with public IP addresses. Which THREE steps should they take? (Choose 3)

Accepted Answer

Use IAM conditions to deny the compute.instances.create permission without the label.. Option A is correct because IAM conditions on the compute.instances.create permission can enforce attribute-based access control, allowing instance creation only when the request includes the required 'environment' label with an allowed value (production, staging, or development), effectively denying creation without it. Option C is correct because the predefined organization policy constraint constraints/compute.vmExternalIpAccess (or the newer constraints/compute.requireShieldedVm-style external IP constraints) applied at the production folder level blocks Compute Engine instances from being assigned external/public IP addresses, exactly matching the requirement for the production folder. Option E is correct because a custom organization policy constraint (using a CEL expression on resource.labels) can require that every Compute Engine instance carries the 'environment' label, enforcing the labeling mandate across the organization or specified folders. Option B is not appropriate because VPC Service Controls creates a service perimeter around APIs and resources to mitigate data exfiltration; it does not enforce label requirements or block public IP assignment on instances. Option D is not appropriate because a Cloud Function triggered by Resource Manager events would only apply labels after resource creation (or reactively), not prevent non-compliant instances from being created, and it does not address the public IP restriction.

Answer

Set up VPC Service Controls to restrict access to the production VPC.

Answer

Create a folder for each environment and apply the label automatically using a Cloud Function triggered by Resource Manager events.

Question 8

An organization has a folder for each department, with multiple projects under each folder. The security team wants to deny the creation of VMs with public IPs in all projects under the 'production' folder, except for the 'web-server' project where public IPs are required. How can they implement this using IAM and Organization Policies?

Accepted Answer

Apply a deny policy at the folder level, then use tags with organization policy conditional enforcement to allow the exception project.. Set an organization policy at the folder level to deny public IPs by default, then use resource tags with conditional enforcement in the organization policy to allow the exception project (e.g., resources tagged with 'allow-public-ip' are exempt).

Answer

Apply an allow policy at the project level and a deny policy at the resource level.

Answer

Apply a deny policy at the organization node and an allow policy at the project level.

Answer

Use IAM roles to restrict VM creation only in the production folder.

Question 9

A company uses a single billing account for multiple projects. The finance team needs to see costs broken down by team (based on a label 'team'). However, some resources are missing the label. What is the most efficient way to identify unlabeled resources and enforce labeling?

Accepted Answer

Export billing data to BigQuery and query for resources missing the label.. Option A is correct because exporting billing data to BigQuery lets you run SQL queries against the detailed billing export, including label columns, to efficiently find line items where the 'team' label is missing across all projects in the billing account. This is the most scalable and efficient approach for identifying unlabeled resources, and it can be combined with enforcement mechanisms like organization policies or labels enforcement. Option B only lists resources that already have the 'team' label, so it cannot identify unlabeled resources. Option C is manual and not efficient at scale. Option D is incorrect because budget alerts track spend thresholds, not missing labels.

Answer

Use the gcloud command 'gcloud compute instances list --filter labels:team' to list resources with the label.

Answer

Use the Cloud Console to manually check each resource.

Answer

Set up a budget alert for resources without labels.

Question 10

Which GCP support plan provides 15-minute response time for P1 incidents and a Technical Account Manager (TAM)?

Accepted Answer

Premium. Premium Support is the only plan that offers a 15-minute response time for P1 incidents and includes a Technical Account Manager (TAM). Enhanced Support provides a 1-hour P1 response time and does not include a TAM.

Answer

Enhanced

Answer

Standard

Answer

Basic

Question 11

A company wants to reduce costs for their Compute Engine workloads. They have predictable baseline usage and are willing to commit to a 1-year term. They also want to automatically get discounts for instances running more than 25% of a month. Which THREE options should they use? (Select THREE)

Accepted Answer

Apply CUDs at the project or folder level.. Option B is correct because purchasing committed use discounts (CUDs) lets the company commit to a 1-year term for predictable baseline usage and receive discounted rates on Compute Engine resources. Option C is correct because sustained use discounts (SUDs) are automatically applied to instances that run for more than 25% of a month, matching the requirement to get discounts without manual action. Option A is correct because CUDs can be applied at the project or folder level, allowing the company to share the commitment across resources within that scope. Option D is not appropriate because preemptible VMs are short-lived, can be terminated at any time, and are not suitable for all workloads. Option E is not relevant because billing export to BigQuery is for cost analysis and reporting, not for obtaining discounts.

Answer

Use preemptible VMs for all workloads.

Answer

Set up billing export to BigQuery.

Question 12

An organization has a folder-level IAM policy that grants the 'roles/compute.instanceAdmin' role to a group. A project under that folder has a policy that denies this role to the same group. What is the effective access for the group on Compute Engine instances in the project?

Accepted Answer

The group has no access because the deny overrides the allow. In Google Cloud IAM, deny policies take precedence over allow policies. Even though the folder-level policy grants the role, the project-level deny policy explicitly denies it for the same group. Therefore, the effective access is no access, because the deny overrides the allow.

Answer

The group has full admin access because the folder policy allows it

Answer

The group has view access only

Answer

The group retains permissions but cannot modify instances

Question 13

A team wants to enforce that resources in a specific folder must have a label with key 'cost-center' and value 'finance'. Which Google Cloud feature can enforce this requirement?

Accepted Answer

Organization policies with a constraint on labels. Organization policies can enforce this requirement using a custom constraint. For example, a custom boolean constraint with CEL can require that every resource in the folder has the label 'cost-center' with value 'finance'. The predefined 'constraints/gcp.resourceLabels' constraint is a list constraint that limits which labels can be applied, but it does not require a label to be present.

Answer

IAM Conditions

Answer

Active Assist recommendations

Answer

Cloud Audit Logs

Question 14

Which THREE actions can help reduce Compute Engine costs? (Choose three.)

Accepted Answer

Purchase committed use discounts for predictable workloads.. Option A is correct because committed use discounts (CUDs) let you commit to a specific amount of vCPU and memory usage in a region for a 1- or 3-year term in exchange for up to 57% (resource-based) or 70% (spend-based) discounts, which is ideal for predictable, steady-state workloads. Option B is correct because rightsizing—using Cloud Monitoring utilization metrics and the recommender to match machine type (vCPU/memory) to actual demand—eliminates paying for idle or over-provisioned resources. Option C is correct because preemptible (Spot) VMs cost up to 60–91% less than standard instances and are well suited to fault-tolerant batch jobs that can be interrupted. Option D is not a cost-reduction action: increasing persistent disk snapshots adds storage charges (around $0.026/GB-month for standard snapshot storage) and increases cost rather than reducing it. Option E is incorrect as stated because sustained use discounts are applied automatically to eligible instances—you cannot 'enable' them by simply running instances continuously; the discount is a function of usage, not an action you take to reduce cost.

Answer

Increase the number of persistent disk snapshots.

Answer

Enable sustained use discounts by running instances continuously.

Question 15

A company has set a budget at the project level with alerts at 50%, 90%, and 100% of the budget. However, they notice that actual spending is not triggering alerts. What is the most likely cause?

Accepted Answer

The budget was created at the billing account level instead of the project level. If the budget was created at the billing account level instead of the project level, alerts are based on the total billing account spend, not the individual project spend. Since the company set the budget at the project level but might have inadvertently created it at the billing account level, they would not receive alerts for that specific project's spending until the billing account reaches the threshold.

Answer

The project has exceeded the default service quota

Answer

The budget amount is lower than the committed use discount amount

Answer

The budget was created at the project level, but alerts can only be set on billing account budgets