Cloud Digital Leader Google Cloud products, services, and solutions — Timed 20 Questions

Question 1

A company uses BigQuery for analytics and needs to enforce row-level security based on user department. Only users from the 'Sales' department should see rows where department = 'Sales'. Which BigQuery feature should they use?

20 minute time limit — choose an answer to begin.

Accepted Answer

Row-level access policies using a filter on the department column. Row-level access policies in BigQuery allow you to attach a filter expression (e.g., department = 'Sales') directly to a table, so only users whose department matches the policy's condition can see those rows. This is the native, purpose-built feature for row-level security and works with IAM principals such as users or groups, making it the right fit for restricting Sales users to Sales rows. Custom IAM roles (A) control actions on resources, not individual rows, so they cannot enforce a per-row department filter. Column-level security (B) uses policy tags to mask or restrict columns, not rows. Authorized views (C) can filter rows, but they require querying through the view and do not enforce row-level security on the underlying table itself.

Answer

Custom IAM roles with fine-grained permissions

Answer

Column-level security with classification tags

Answer

Authorized views with a WHERE clause

Question 2

A developer deploys a Cloud Function with the command shown:

gcloud functions deploy my-function --gen2 --region=us-central1 --runtime=python39 --trigger-http --allow-unauthenticated --timeout=300s

The function needs to process a file upload that typically takes 2 minutes. What is the most likely issue?

Accepted Answer

The memory allocation might be too low if the file is large. The command shown does not specify a memory allocation, so the Cloud Function defaults to 256 MB. If the file being uploaded is large, this low memory can cause the function to run out of memory and fail, even if the timeout is sufficient. Processing a file upload often requires loading the file into memory, making memory a critical resource.

Answer

The runtime python39 is not available

Answer

The function cannot be triggered by HTTP

Answer

The timeout is too short for processing a 2-minute upload

Question 3

A financial services company is migrating a legacy monolithic application to Google Cloud. The application uses a SQL Server database and has compliance requirements to encrypt data at rest and in transit. The migration must minimize code changes. The application runs on Windows Server and currently uses Active Directory for authentication. The company wants to use Google Cloud's managed services where possible. Which approach best meets these requirements?

Accepted Answer

Lift and shift the application tier to Compute Engine on Windows VMs. Use Cloud SQL for SQL Server with encryption enabled, and configure Active Directory via Managed Microsoft AD.. Option B minimizes code changes by lifting and shifting the application to Compute Engine while using Cloud SQL for SQL Server, a managed database that supports encryption at rest and in transit. Managed Microsoft AD provides Active Directory authentication. The other options either keep the database on-premises, require containerization, or use unmanaged SQL Server on VMs with manual encryption and connectivity, so they do not best meet the managed services and compliance requirements.

Answer

Migrate the application to Compute Engine with SQL Server on Windows VMs. Use Cloud SQL for SQL Server but keep the database on-premises for compliance.

Answer

Containerize the application and deploy on GKE with SQL Server in a container. Use Cloud SQL for SQL Server with encryption.

Answer

Migrate the application to Compute Engine instances with SQL Server on Windows VMs. Use Cloud VPN for connectivity. Enable encryption on the VMs and use SSL for SQL connections.

Question 4

Given the Cloud Run service configuration above, what happens when a new revision is created after deploying a change to the container image?

Accepted Answer

The new revision receives all traffic automatically.. When you deploy a change to a Cloud Run service, a new revision is created and, by default, it receives 100% of traffic automatically. Traffic is not held on the old revision unless you explicitly use --no-traffic or configure a traffic split that excludes the new revision.

Answer

Traffic is split evenly between the old and new revision.

Answer

The service becomes unavailable until the new revision is ready.

Answer

Cloud Run automatically creates a new revision and routes traffic to it.

Answer

Traffic continues to go to the old revision until the traffic section is updated.

Question 5

A financial services company runs a multi-tier application on Google Kubernetes Engine (GKE). The application consists of a frontend service, a backend service, and a database on Cloud SQL. Recently, they noticed that the backend service experiences high latency during peak trading hours, causing the frontend to time out. The backend service is CPU-intensive and currently runs with a single replica. The team wants to reduce latency and ensure high availability without over-provisioning resources. They have enabled Horizontal Pod Autoscaling (HPA) based on CPU utilization with a target of 80% and default stabilization windows. However, during sudden traffic spikes, the HPA takes over 5 minutes to scale up because of the scale-up stabilization window and the time to trigger. The company cannot tolerate latency spikes during scaling. Which course of action should they take to minimize latency during traffic spikes?

Accepted Answer

Set the HPA target CPU utilization to 70% and remove the scale-up stabilization window (set to 0 seconds).. Reducing the HPA target CPU utilization to 70% provides a larger buffer before the threshold is crossed, allowing earlier scaling initiation. Removing the scale-up stabilization window (setting it to 0 seconds) eliminates the default 3-minute scale-up delay, enabling the HPA to react immediately to CPU spikes. This directly addresses the latency issue during sudden traffic spikes by reducing the time to add replicas.

Answer

Increase the HPA scale-up stabilization window to 10 minutes to prevent thrashing.

Answer

Enable session affinity on the backend service to keep users on the same pod.

Answer

Use a CronJob to proactively scale the backend service before expected peak hours.

Question 6

A startup's development team stores application logs and metrics from its Compute Engine workloads. The team wants a fully managed service that can ingest, search, and analyze this telemetry, and it wants to create alerting policies that notify an on-call engineer when error rates exceed a threshold. Which Google Cloud service should the team use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring is the managed observability platform that collects metrics from Compute Engine and other Google Cloud resources, supports dashboards and metric-based alerting policies, and integrates with Cloud Logging for log-based metrics. It can notify on-call engineers through multiple channels when thresholds are breached, which matches the requirement to ingest, search, and alert on telemetry. The other services specialize in tracing, profiling, or logs alone and lack the combined metric ingestion and alerting capability.

Answer

Cloud Trace

Answer

Cloud Profiler

Answer

Cloud Logging only

Question 7

A data analytics team needs to analyze petabytes of structured data using SQL queries without managing any database infrastructure. Query results must return within seconds for most queries. Which Google Cloud service is designed for this use case?

Accepted Answer

BigQuery. BigQuery is a serverless, highly scalable data warehouse designed for analyzing petabytes of data using SQL without any infrastructure management. Its columnar storage and distributed query engine enable sub-second query performance on large datasets, making it ideal for this use case.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 8

A developer wants to deploy a containerized web application without managing servers, clusters, or Kubernetes configuration. The application should automatically scale to zero when not in use and handle bursts of traffic. Which Google Cloud service is the best fit?

Accepted Answer

Cloud Run. Cloud Run is the best fit because it is a fully managed serverless container platform that automatically scales to zero when idle and scales up to handle traffic bursts, without requiring any server, cluster, or Kubernetes configuration. The developer simply deploys a container image, and Cloud Run handles all infrastructure management, including scaling and load balancing.

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Answer

App Engine Standard

Question 9

A retail company wants to build a recommendation engine that suggests products to customers based on their browsing history. The team has ML expertise but wants to use Google's pre-built ML infrastructure to train and deploy models at scale without managing compute resources. Which Google Cloud service should they use?

Accepted Answer

Vertex AI. Vertex AI is the correct choice because it provides a fully managed, unified ML platform that handles the entire ML workflow—from data preparation and training to deployment and monitoring—without requiring the team to manage underlying compute infrastructure. It integrates with Google Cloud's pre-built ML infrastructure, including distributed training, AutoML, and custom model serving, making it ideal for building and scaling a recommendation engine.

Answer

BigQuery ML

Answer

Cloud AI Platform Notebooks (now Vertex AI Workbench)

Answer

Cloud Dataflow

Question 10

A company needs to store large volumes of unstructured data (images, videos, backups, documents) with high durability and global accessibility. Which Google Cloud service is designed for object storage at any scale?

Accepted Answer

Cloud Storage. Cloud Storage is Google Cloud's fully managed, scalable object storage service designed for unstructured data such as images, videos, backups, and documents. It offers high durability (99.999999999% annual durability) and global accessibility via a unified namespace, making it the correct choice for storing large volumes of unstructured data at any scale.

Answer

Persistent Disk

Answer

Cloud Filestore

Answer

Cloud Spanner

Question 11

A business intelligence team wants to create interactive dashboards and reports from their BigQuery data without writing code. They need to share reports with stakeholders who don't have GCP accounts. Which Google Cloud tool is most appropriate?

Accepted Answer

Looker Studio (formerly Data Studio). Looker Studio (formerly Data Studio) is the correct choice because it is a no-code, drag-and-drop business intelligence tool that connects directly to BigQuery, enabling the creation of interactive dashboards and reports. It also supports sharing reports via public links or embedded views, allowing stakeholders without GCP accounts to access them without needing IAM permissions.

Answer

Vertex AI Workbench

Answer

Cloud Dataprep by Trifacta

Answer

BigQuery Studio

Question 12

A company wants to build an application that can understand and respond to natural language queries from customers (e.g., a customer support chatbot). Which Google Cloud capability should they use?

Accepted Answer

Dialogflow CX or Vertex AI Conversation. Dialogflow CX and Vertex AI Conversation are Google Cloud's purpose-built services for building conversational interfaces, including chatbots that understand natural language. They leverage natural language understanding (NLU) models to parse user intents and entities, enabling the application to respond appropriately to customer queries. This makes them the correct choice for a customer support chatbot.

Answer

Cloud Vision API

Answer

BigQuery ML

Answer

Cloud Translation API

Question 13

A company needs to send messages between different microservices in a decoupled way. When one service publishes an event, multiple downstream services should receive and process it independently. Which Google Cloud service enables this publish-subscribe messaging pattern?

Accepted Answer

Cloud Pub/Sub. Cloud Pub/Sub is the correct choice because it is Google Cloud's fully managed, asynchronous messaging service designed specifically for the publish-subscribe pattern. It allows a publisher service to emit events to a topic, and multiple subscriber services can independently pull or push those messages from that topic, ensuring decoupled and reliable communication.

Answer

Cloud Tasks

Answer

Cloud Scheduler

Answer

Eventarc

Question 14

A global fintech company needs a database that can handle financial transactions across 50+ countries with consistent, ACID-compliant operations, SQL queries, and automatic global replication with no downtime for maintenance. Which Google Cloud database service meets all these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that provides ACID-compliant transactions, full SQL support, and automatic synchronous global replication with no downtime for maintenance. It is designed for horizontally scalable, globally distributed applications that require strong consistency across regions, making it the ideal choice for a fintech company operating in 50+ countries.

Answer

Cloud SQL (PostgreSQL)

Answer

Cloud Bigtable

Answer

Firestore

Question 15

A team needs to process and analyze streaming data in real-time as it arrives from IoT sensors. The pipeline must apply transformations, filter events, and write results to BigQuery. Which Google Cloud service is designed for this stream processing use case?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is the correct choice because it is a fully managed, serverless service designed specifically for stream and batch data processing. It uses Apache Beam as its programming model, enabling you to apply transformations, filter events, and write results to BigQuery in real-time, exactly matching the described pipeline requirements.

Answer

Cloud Dataproc

Answer

Cloud Composer

Answer

BigQuery Streaming Insert

Question 16

A company wants to use pre-trained Google AI models to add vision capabilities to their application — specifically to detect objects in images and extract text from scanned documents — without training their own models. Which Google Cloud APIs provide these capabilities?

Accepted Answer

Cloud Vision API for object detection and OCR; Cloud Document AI for structured document extraction.. Cloud Vision API provides pre-trained models for object detection and OCR (Optical Character Recognition) to extract text from images, while Cloud Document AI specializes in extracting structured data (e.g., fields, tables) from scanned documents. Both services require no custom training, aligning with the company's requirement to use pre-trained Google AI models.

Answer

BigQuery ML for both use cases — it trains vision models on image data stored in BigQuery.

Answer

Vertex AI AutoML Vision — train a custom model on your own images.

Answer

Cloud Natural Language API for text extraction from images.

Question 17

A company runs many containerized microservices that need orchestration — automatic scheduling, scaling, self-healing, and rolling updates. They want a managed service so they don't maintain the control plane themselves. Which Google Cloud service is purpose-built for this?

Accepted Answer

Google Kubernetes Engine (GKE). Google Kubernetes Engine (GKE) is a managed Kubernetes service that provides automatic orchestration, scaling, self-healing, and rolling updates for containerized microservices. It fully manages the Kubernetes control plane, including the API server, etcd, and scheduler, so the customer does not have to maintain them. This makes GKE the purpose-built solution for the described requirements.

Answer

Cloud Run

Answer

Cloud Composer

Answer

Compute Engine with managed instance groups

Question 18

A development team builds a mobile app using Firebase. They need a real-time database that syncs data across all connected clients instantly (e.g., a collaborative to-do app where all users see updates in real-time). Which Firebase/Google Cloud service provides this?

Accepted Answer

Cloud Firestore or Firebase Realtime Database for real-time data sync across all connected clients.. Cloud Firestore and Firebase Realtime Database are the only Firebase/Google Cloud services that provide real-time data synchronization across all connected clients. They use persistent WebSocket connections or HTTP long-polling to push updates instantly to every subscribed client, making them ideal for collaborative apps like a shared to-do list.

Answer

Cloud SQL with read replicas to distribute updates to clients.

Answer

BigQuery streaming inserts for real-time data delivery to mobile clients.

Answer

Cloud Pub/Sub subscriptions on the mobile clients.

Question 19

A company's web application faces DDoS attacks and SQL injection attempts from the internet. They need a service that sits in front of their load balancer to block malicious traffic before it reaches their application servers. Which Google Cloud service provides this protection?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS mitigation service that operates at the edge of Google's network, in front of the load balancer. It can filter incoming traffic based on Layer 7 rules (e.g., SQL injection patterns, cross-site scripting) and Layer 3/4 conditions (e.g., IP reputation, rate limiting), blocking malicious requests before they reach the load balancer or application servers. This makes it the correct choice for protecting against both DDoS attacks and SQL injection attempts at the network perimeter.

Answer

Cloud Firewall (VPC firewall rules)

Answer

Cloud VPN

Answer

Cloud Identity-Aware Proxy (IAP)

Question 20

An enterprise wants employees to access internal web applications securely from any location (including remote work from home) without using a VPN. Employees should only access apps they're authorized for, based on their identity and device context. Which Google Cloud service enables this zero-trust access model?

Accepted Answer

Cloud Identity-Aware Proxy (IAP). Cloud Identity-Aware Proxy (IAP) is the correct service because it enforces zero-trust access by verifying a user's identity and device context before granting access to internal web applications, without requiring a VPN. It uses Google's BeyondCorp model to authenticate and authorize each request based on identity and context, allowing secure access from any location.

Answer

Cloud VPN with split tunneling for internal application access.

Answer

Cloud Armor IP allowlist to restrict access to corporate office IP ranges.

Answer

Cloud Load Balancing with SSL termination.