Cloud Digital Leader How Google Cloud Resources Are Managed — Timed 10 Questions

Question 1

An engineer wants to export billing cost data to BigQuery for custom reporting. They have created a BigQuery dataset and linked it to the billing account. However, the billing export tables are not being populated. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

The BigQuery dataset is in a different location from the billing account's default region. Billing export to BigQuery requires the billing account to be linked to a project that contains the dataset, and the dataset must be in the same location (e.g., US or EU) as the billing account's default region.

Answer

The billing export has not been enabled in the Cloud Console

Answer

The engineer does not have the Billing Administrator IAM role

Answer

The billing account is not linked to the project containing the BigQuery dataset

Question 2

A team needs to analyze spending patterns across projects using BigQuery. The billing export is already configured. However, the team cannot see any data in the billing export dataset. What is the most likely reason?

Accepted Answer

The IAM permissions for the BigQuery dataset are incorrect. Billing export tables are typically populated within a few hours to a day. If no data is visible, the most common cause is that the team lacks necessary IAM permissions (e.g., BigQuery Data Viewer) on the export dataset. Dataset location does not need to match a billing account region, and export tables are not monthly.

Answer

The billing account has not been linked to the project

Answer

The BigQuery dataset is in a different region than the billing account's default region

Answer

The billing export tables are only updated monthly

Question 3

A company needs to optimize costs for Compute Engine VMs. They have a mix of workloads: some are batch jobs that can be interrupted, while others are critical services that must run 24/7. The company wants to use the most cost-effective options without sacrificing reliability for critical services. Which THREE strategies should they implement?

Accepted Answer

Use committed use discounts for the 24/7 critical services. Committed use discounts provide larger discounts for predictable, always-on workloads. Rightsizing VMs using Active Assist recommendations helps eliminate wasted resources by matching VM sizes to actual usage. Preemptible/Spot VMs are ideal for fault-tolerant batch jobs. The other options are not effective cost optimization strategies.

Answer

Set up budget alerts to monitor spending

Answer

Rely solely on sustained use discounts for all instances

Question 4

A company needs to track spending per team by tagging resources with a 'team' label. However, some engineers are not applying consistent labels, leading to untagged resources. How can they enforce that all new resources are created with a specific label?

Accepted Answer

Use a custom organization policy to require the 'team' label on all resources.. Organization policies can be used to enforce that resources must have certain labels by defining a custom constraint that requires the 'team' label on all resources. This denies resource creation if the label is missing.

Answer

Set up a budget alert to notify when untagged resources are created.

Answer

Create a folder per team and apply labels at the folder level.

Answer

Run a weekly script to tag untagged resources.

Question 5

A developer wants to create a new project in Google Cloud. They have the Project Creator role at the organization level. Which of the following is NOT required to create a project?

Accepted Answer

The Google Cloud CLI installed locally. The Google Cloud CLI installed locally is NOT required to create a project, because projects can be created via the Cloud Console, the gcloud CLI, the Resource Manager REST API, or client libraries — no local CLI installation is mandatory. The other options are all genuinely required or relevant: B (resourcemanager.projects.create permission) is the IAM permission needed to create a project, which the Project Creator role grants; C (a billing account linked to the project) is required to use billable services and is part of the normal project-creation flow; and D (enabling the Cloud Resource Manager API) is needed for programmatic project creation via the API. Thus only A is not a requirement.

Answer

The resourcemanager.projects.create permission

Answer

A billing account linked to the project

Answer

Enabling the Cloud Resource Manager API

Question 6

A company has a Premium support plan. They experience a critical production outage and need immediate assistance. What is the guaranteed response time for a P1 (Priority 1) case?

Accepted Answer

15 minutes. Google Cloud Premium Support guarantees a 15-minute response time for P1 cases, which are defined as critical production outages with severe business impact. This is the fastest SLA tier and is explicitly documented for Premium support. The 15-minute target applies to initial response, not resolution.

Answer

4 hours

Answer

8 hours

Answer

1 hour

Question 7

An organization wants to enforce that all Compute Engine instances must have a label 'environment' set to 'production', 'staging', or 'development'. They also want to ensure that instances in the 'production' folder cannot be created with public IP addresses. Which THREE steps should they take? (Choose 3)

Accepted Answer

Use IAM conditions to deny the compute.instances.create permission without the label.. Option A is correct because IAM conditions on the compute.instances.create permission can enforce attribute-based access control, allowing instance creation only when the request includes the required 'environment' label with an allowed value (production, staging, or development), effectively denying creation without it. Option C is correct because the predefined organization policy constraint constraints/compute.vmExternalIpAccess (or the newer constraints/compute.requireShieldedVm-style external IP constraints) applied at the production folder level blocks Compute Engine instances from being assigned external/public IP addresses, exactly matching the requirement for the production folder. Option E is correct because a custom organization policy constraint (using a CEL expression on resource.labels) can require that every Compute Engine instance carries the 'environment' label, enforcing the labeling mandate across the organization or specified folders. Option B is not appropriate because VPC Service Controls creates a service perimeter around APIs and resources to mitigate data exfiltration; it does not enforce label requirements or block public IP assignment on instances. Option D is not appropriate because a Cloud Function triggered by Resource Manager events would only apply labels after resource creation (or reactively), not prevent non-compliant instances from being created, and it does not address the public IP restriction.

Answer

Set up VPC Service Controls to restrict access to the production VPC.

Answer

Create a folder for each environment and apply the label automatically using a Cloud Function triggered by Resource Manager events.

Question 8

An organization has a folder for each department, with multiple projects under each folder. The security team wants to deny the creation of VMs with public IPs in all projects under the 'production' folder, except for the 'web-server' project where public IPs are required. How can they implement this using IAM and Organization Policies?

Accepted Answer

Apply a deny policy at the folder level, then use tags with organization policy conditional enforcement to allow the exception project.. Set an organization policy at the folder level to deny public IPs by default, then use resource tags with conditional enforcement in the organization policy to allow the exception project (e.g., resources tagged with 'allow-public-ip' are exempt).

Answer

Apply an allow policy at the project level and a deny policy at the resource level.

Answer

Apply a deny policy at the organization node and an allow policy at the project level.

Answer

Use IAM roles to restrict VM creation only in the production folder.

Question 9

A company uses a single billing account for multiple projects. The finance team needs to see costs broken down by team (based on a label 'team'). However, some resources are missing the label. What is the most efficient way to identify unlabeled resources and enforce labeling?

Accepted Answer

Export billing data to BigQuery and query for resources missing the label.. Option A is correct because exporting billing data to BigQuery lets you run SQL queries against the detailed billing export, including label columns, to efficiently find line items where the 'team' label is missing across all projects in the billing account. This is the most scalable and efficient approach for identifying unlabeled resources, and it can be combined with enforcement mechanisms like organization policies or labels enforcement. Option B only lists resources that already have the 'team' label, so it cannot identify unlabeled resources. Option C is manual and not efficient at scale. Option D is incorrect because budget alerts track spend thresholds, not missing labels.

Answer

Use the gcloud command 'gcloud compute instances list --filter labels:team' to list resources with the label.

Answer

Use the Cloud Console to manually check each resource.

Answer

Set up a budget alert for resources without labels.

Question 10

Which GCP support plan provides 15-minute response time for P1 incidents and a Technical Account Manager (TAM)?

Accepted Answer

Premium. Premium Support is the only plan that offers a 15-minute response time for P1 incidents and includes a Technical Account Manager (TAM). Enhanced Support provides a 1-hour P1 response time and does not include a TAM.

Answer

Enhanced

Answer

Standard

Answer

Basic