Cloud Digital Leader How Google Cloud Resources Are Managed — Timed 30 Questions

Question 1

An engineer wants to export billing cost data to BigQuery for custom reporting. They have created a BigQuery dataset and linked it to the billing account. However, the billing export tables are not being populated. What is the most likely cause?

30 minute time limit — choose an answer to begin.

Accepted Answer

The BigQuery dataset is in a different location from the billing account's default region. Billing export to BigQuery requires the billing account to be linked to a project that contains the dataset, and the dataset must be in the same location (e.g., US or EU) as the billing account's default region.

Answer

The billing export has not been enabled in the Cloud Console

Answer

The engineer does not have the Billing Administrator IAM role

Answer

The billing account is not linked to the project containing the BigQuery dataset

Question 2

A team needs to analyze spending patterns across projects using BigQuery. The billing export is already configured. However, the team cannot see any data in the billing export dataset. What is the most likely reason?

Accepted Answer

The IAM permissions for the BigQuery dataset are incorrect. Billing export tables are typically populated within a few hours to a day. If no data is visible, the most common cause is that the team lacks necessary IAM permissions (e.g., BigQuery Data Viewer) on the export dataset. Dataset location does not need to match a billing account region, and export tables are not monthly.

Answer

The billing account has not been linked to the project

Answer

The BigQuery dataset is in a different region than the billing account's default region

Answer

The billing export tables are only updated monthly

Question 3

A company needs to optimize costs for Compute Engine VMs. They have a mix of workloads: some are batch jobs that can be interrupted, while others are critical services that must run 24/7. The company wants to use the most cost-effective options without sacrificing reliability for critical services. Which THREE strategies should they implement?

Accepted Answer

Use committed use discounts for the 24/7 critical services. Committed use discounts provide larger discounts for predictable, always-on workloads. Rightsizing VMs using Active Assist recommendations helps eliminate wasted resources by matching VM sizes to actual usage. Preemptible/Spot VMs are ideal for fault-tolerant batch jobs. The other options are not effective cost optimization strategies.

Answer

Set up budget alerts to monitor spending

Answer

Rely solely on sustained use discounts for all instances

Question 4

A company needs to track spending per team by tagging resources with a 'team' label. However, some engineers are not applying consistent labels, leading to untagged resources. How can they enforce that all new resources are created with a specific label?

Accepted Answer

Use a custom organization policy to require the 'team' label on all resources.. Organization policies can be used to enforce that resources must have certain labels by defining a custom constraint that requires the 'team' label on all resources. This denies resource creation if the label is missing.

Answer

Set up a budget alert to notify when untagged resources are created.

Answer

Create a folder per team and apply labels at the folder level.

Answer

Run a weekly script to tag untagged resources.

Question 5

A developer wants to create a new project in Google Cloud. They have the Project Creator role at the organization level. Which of the following is NOT required to create a project?

Accepted Answer

The Google Cloud CLI installed locally. The Google Cloud CLI installed locally is NOT required to create a project, because projects can be created via the Cloud Console, the gcloud CLI, the Resource Manager REST API, or client libraries — no local CLI installation is mandatory. The other options are all genuinely required or relevant: B (resourcemanager.projects.create permission) is the IAM permission needed to create a project, which the Project Creator role grants; C (a billing account linked to the project) is required to use billable services and is part of the normal project-creation flow; and D (enabling the Cloud Resource Manager API) is needed for programmatic project creation via the API. Thus only A is not a requirement.

Answer

The resourcemanager.projects.create permission

Answer

A billing account linked to the project

Answer

Enabling the Cloud Resource Manager API

Question 6

A company has a Premium support plan. They experience a critical production outage and need immediate assistance. What is the guaranteed response time for a P1 (Priority 1) case?

Accepted Answer

15 minutes. Google Cloud Premium Support guarantees a 15-minute response time for P1 cases, which are defined as critical production outages with severe business impact. This is the fastest SLA tier and is explicitly documented for Premium support. The 15-minute target applies to initial response, not resolution.

Answer

4 hours

Answer

8 hours

Answer

1 hour

Question 7

An organization wants to enforce that all Compute Engine instances must have a label 'environment' set to 'production', 'staging', or 'development'. They also want to ensure that instances in the 'production' folder cannot be created with public IP addresses. Which THREE steps should they take? (Choose 3)

Accepted Answer

Use IAM conditions to deny the compute.instances.create permission without the label.. Option A is correct because IAM conditions on the compute.instances.create permission can enforce attribute-based access control, allowing instance creation only when the request includes the required 'environment' label with an allowed value (production, staging, or development), effectively denying creation without it. Option C is correct because the predefined organization policy constraint constraints/compute.vmExternalIpAccess (or the newer constraints/compute.requireShieldedVm-style external IP constraints) applied at the production folder level blocks Compute Engine instances from being assigned external/public IP addresses, exactly matching the requirement for the production folder. Option E is correct because a custom organization policy constraint (using a CEL expression on resource.labels) can require that every Compute Engine instance carries the 'environment' label, enforcing the labeling mandate across the organization or specified folders. Option B is not appropriate because VPC Service Controls creates a service perimeter around APIs and resources to mitigate data exfiltration; it does not enforce label requirements or block public IP assignment on instances. Option D is not appropriate because a Cloud Function triggered by Resource Manager events would only apply labels after resource creation (or reactively), not prevent non-compliant instances from being created, and it does not address the public IP restriction.

Answer

Set up VPC Service Controls to restrict access to the production VPC.

Answer

Create a folder for each environment and apply the label automatically using a Cloud Function triggered by Resource Manager events.

Question 8

An organization has a folder for each department, with multiple projects under each folder. The security team wants to deny the creation of VMs with public IPs in all projects under the 'production' folder, except for the 'web-server' project where public IPs are required. How can they implement this using IAM and Organization Policies?

Accepted Answer

Apply a deny policy at the folder level, then use tags with organization policy conditional enforcement to allow the exception project.. Set an organization policy at the folder level to deny public IPs by default, then use resource tags with conditional enforcement in the organization policy to allow the exception project (e.g., resources tagged with 'allow-public-ip' are exempt).

Answer

Apply an allow policy at the project level and a deny policy at the resource level.

Answer

Apply a deny policy at the organization node and an allow policy at the project level.

Answer

Use IAM roles to restrict VM creation only in the production folder.

Question 9

A company uses a single billing account for multiple projects. The finance team needs to see costs broken down by team (based on a label 'team'). However, some resources are missing the label. What is the most efficient way to identify unlabeled resources and enforce labeling?

Accepted Answer

Export billing data to BigQuery and query for resources missing the label.. Option A is correct because exporting billing data to BigQuery lets you run SQL queries against the detailed billing export, including label columns, to efficiently find line items where the 'team' label is missing across all projects in the billing account. This is the most scalable and efficient approach for identifying unlabeled resources, and it can be combined with enforcement mechanisms like organization policies or labels enforcement. Option B only lists resources that already have the 'team' label, so it cannot identify unlabeled resources. Option C is manual and not efficient at scale. Option D is incorrect because budget alerts track spend thresholds, not missing labels.

Answer

Use the gcloud command 'gcloud compute instances list --filter labels:team' to list resources with the label.

Answer

Use the Cloud Console to manually check each resource.

Answer

Set up a budget alert for resources without labels.

Question 10

Which GCP support plan provides 15-minute response time for P1 incidents and a Technical Account Manager (TAM)?

Accepted Answer

Premium. Premium Support is the only plan that offers a 15-minute response time for P1 incidents and includes a Technical Account Manager (TAM). Enhanced Support provides a 1-hour P1 response time and does not include a TAM.

Answer

Enhanced

Answer

Standard

Answer

Basic

Question 11

A company wants to reduce costs for their Compute Engine workloads. They have predictable baseline usage and are willing to commit to a 1-year term. They also want to automatically get discounts for instances running more than 25% of a month. Which THREE options should they use? (Select THREE)

Accepted Answer

Apply CUDs at the project or folder level.. Option B is correct because purchasing committed use discounts (CUDs) lets the company commit to a 1-year term for predictable baseline usage and receive discounted rates on Compute Engine resources. Option C is correct because sustained use discounts (SUDs) are automatically applied to instances that run for more than 25% of a month, matching the requirement to get discounts without manual action. Option A is correct because CUDs can be applied at the project or folder level, allowing the company to share the commitment across resources within that scope. Option D is not appropriate because preemptible VMs are short-lived, can be terminated at any time, and are not suitable for all workloads. Option E is not relevant because billing export to BigQuery is for cost analysis and reporting, not for obtaining discounts.

Answer

Use preemptible VMs for all workloads.

Answer

Set up billing export to BigQuery.

Question 12

An organization has a folder-level IAM policy that grants the 'roles/compute.instanceAdmin' role to a group. A project under that folder has a policy that denies this role to the same group. What is the effective access for the group on Compute Engine instances in the project?

Accepted Answer

The group has no access because the deny overrides the allow. In Google Cloud IAM, deny policies take precedence over allow policies. Even though the folder-level policy grants the role, the project-level deny policy explicitly denies it for the same group. Therefore, the effective access is no access, because the deny overrides the allow.

Answer

The group has full admin access because the folder policy allows it

Answer

The group has view access only

Answer

The group retains permissions but cannot modify instances

Question 13

A team wants to enforce that resources in a specific folder must have a label with key 'cost-center' and value 'finance'. Which Google Cloud feature can enforce this requirement?

Accepted Answer

Organization policies with a constraint on labels. Organization policies can enforce this requirement using a custom constraint. For example, a custom boolean constraint with CEL can require that every resource in the folder has the label 'cost-center' with value 'finance'. The predefined 'constraints/gcp.resourceLabels' constraint is a list constraint that limits which labels can be applied, but it does not require a label to be present.

Answer

IAM Conditions

Answer

Active Assist recommendations

Answer

Cloud Audit Logs

Question 14

Which THREE actions can help reduce Compute Engine costs? (Choose three.)

Accepted Answer

Purchase committed use discounts for predictable workloads.. Option A is correct because committed use discounts (CUDs) let you commit to a specific amount of vCPU and memory usage in a region for a 1- or 3-year term in exchange for up to 57% (resource-based) or 70% (spend-based) discounts, which is ideal for predictable, steady-state workloads. Option B is correct because rightsizing—using Cloud Monitoring utilization metrics and the recommender to match machine type (vCPU/memory) to actual demand—eliminates paying for idle or over-provisioned resources. Option C is correct because preemptible (Spot) VMs cost up to 60–91% less than standard instances and are well suited to fault-tolerant batch jobs that can be interrupted. Option D is not a cost-reduction action: increasing persistent disk snapshots adds storage charges (around $0.026/GB-month for standard snapshot storage) and increases cost rather than reducing it. Option E is incorrect as stated because sustained use discounts are applied automatically to eligible instances—you cannot 'enable' them by simply running instances continuously; the discount is a function of usage, not an action you take to reduce cost.

Answer

Increase the number of persistent disk snapshots.

Answer

Enable sustained use discounts by running instances continuously.

Question 15

A company has set a budget at the project level with alerts at 50%, 90%, and 100% of the budget. However, they notice that actual spending is not triggering alerts. What is the most likely cause?

Accepted Answer

The budget was created at the billing account level instead of the project level. If the budget was created at the billing account level instead of the project level, alerts are based on the total billing account spend, not the individual project spend. Since the company set the budget at the project level but might have inadvertently created it at the billing account level, they would not receive alerts for that specific project's spending until the billing account reaches the threshold.

Answer

The project has exceeded the default service quota

Answer

The budget amount is lower than the committed use discount amount

Answer

The budget was created at the project level, but alerts can only be set on billing account budgets

Question 16

A company wants to reduce Compute Engine costs for a production workload that runs 24/7. They are willing to commit to a 1-year term. Which TWO actions would help reduce costs? (Choose TWO.)

Accepted Answer

Use active assist recommendations to rightsize VMs. Committed use discounts (CUDs) provide significant discounts for 1- or 3-year commitments and are ideal for 24/7 workloads. Rightsizing recommendations from Active Assist help reduce costs by resizing VMs to match actual usage. Preemptible VMs are not suitable for 24/7 workloads as they can be terminated at any time. Sustained use discounts are automatic, so there is no action to 'enable' them.

Answer

Change all VMs to n1-standard-1 instances

Answer

Enable sustained use discounts

Answer

Use preemptible VMs instead of regular VMs

Question 17

A company wants to allocate costs for shared resources (e.g., a Cloud SQL instance used by multiple teams) to each team's budget. They also need to filter resources by environment (prod, dev) in the Cost Management dashboard. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Apply labels to the Cloud SQL instance such as 'team:alpha' and 'environment:prod'. Labels are the primary mechanism for cost allocation and filtering in the Cost Management dashboard. Applying labels like 'team:alpha' and 'environment:prod' to the shared Cloud SQL instance allows you to allocate costs and filter by environment. Additionally, enabling billing export to BigQuery and querying by label is a best practice for detailed cost analysis and reporting, enabling you to allocate shared resource costs to each team's budget effectively. Together, these two steps provide both the necessary metadata (labels) and the tooling to query and allocate costs accurately.

Answer

Create separate Cloud SQL instances for each team

Answer

Purchase committed use discounts for the instance

Answer

Use a budget for each team at the project level

Question 18

A company is running a production application on Compute Engine and wants to ensure that if a quota for a resource is exceeded, the engineering team is notified immediately. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Create a log-based metric for quota usage and alert on it. Option B is correct because a log-based metric can be built from Compute Engine quota-related log entries (for example, quota exceeded events surfaced in Cloud Logging) and then used as the signal for an alerting policy, which is the standard way to detect quota exhaustion. Option C is correct because quota alerts are created as Cloud Monitoring alert policies via the Monitoring API (projects.alertPolicies.create), allowing the team to programmatically define the condition that fires when the quota metric breaches its threshold. Option E is correct because an alert policy only notifies anyone once a notification channel such as Email or Pub/Sub is attached to it, so configuring the channel is required for immediate notification. Option A is not one of the required steps because requesting a quota increase is a preventive capacity action, not a mechanism that notifies the team when a quota is exceeded. Option D is not correct because a Cloud Billing budget alert with a 100% threshold tracks cost spend, not Compute Engine resource quota consumption, so it would not reliably notify the team of a quota breach.

Answer

Request a quota increase before hitting the limit

Answer

Set up a budget alert with a threshold of 100%

Question 19

A platform team manages a Google Cloud organization with folders for each business unit. They need to grant a group of auditors read-only access to all current and future projects across the entire organization, while ensuring that no project-level IAM policy can remove or restrict that access. What should they do?

Accepted Answer

Grant the roles/iam.securityReviewer role to the auditors group at the organization node, and rely on the fact that IAM policies are additive and cannot be overridden by child resources.. IAM policies in Google Cloud are additive and inherited down the resource hierarchy. Granting a read-only role at the organization node ensures the auditors have access to all current and future projects. Because child resources cannot remove inherited grants, project-level IAM policies cannot restrict that access. Using roles/iam.securityReviewer instead of basic roles adheres to least privilege.

Answer

Create a custom role with the necessary read-only permissions and grant it to the auditors group at the organization node, then use an IAM deny policy to prevent project-level administrators from modifying the auditors' access.

Answer

Grant the roles/viewer role to the auditors group at the organization node, and enable IAM policy inheritance so that child resources cannot override it.

Answer

Grant the roles/editor role to the auditors group at each folder level, and instruct project administrators not to remove these grants.

Question 20

A financial services company has a Google Cloud organization with a folder for each department. The security team wants to ensure that all Cloud Storage buckets in the organization are encrypted with customer-managed encryption keys (CMEK) and that this requirement cannot be bypassed by project owners. They also want to enforce this policy retroactively on existing buckets. What should they do?

Accepted Answer

Create an organization policy constraint for storage.bucketEncryption with CMEK enforcement, apply it at the organization node, and then remediate existing buckets by updating their encryption configuration.. Organization Policy constraints provide centralized, hierarchical enforcement of configuration rules. The predefined constraint storage.bucketEncryption can enforce CMEK on all buckets when applied at the organization node, and project owners cannot override it. Existing buckets must be updated to comply, which can be done by setting their default encryption to CMEK. This approach meets both enforcement and retroactive requirements without custom code.

Answer

Enable uniform bucket-level access at the organization level and configure default encryption with CMEK using the gcloud command-line tool for each bucket.

Answer

Create a custom organization policy constraint that checks for CMEK on buckets, apply it at the organization node, and use a Cloud Function to automatically remediate non-compliant buckets.

Answer

Use IAM conditions to require that all storage.buckets.create requests include a CMEK key, and apply this at the folder level.