Cloud Digital Leader Hard Questions — 25 Difficult Questions

Question 1

A company is migrating an on-premises Oracle database to Cloud Spanner. They need to move 10 TB of data with minimal downtime. Which migration strategy should they use?

Accepted Answer

Create a VPN tunnel and use Oracle GoldenGate for replication. For migrating an Oracle database to Cloud Spanner with minimal downtime, you need continuous change data capture (CDC). Oracle GoldenGate is a widely used tool for this purpose and can replicate data from Oracle to Cloud Spanner over a VPN tunnel. Database Migration Service (DMS) is designed for migrations to Cloud SQL (MySQL, PostgreSQL) and SQL Server, not Cloud Spanner.

Answer

Export the Oracle database as CSV files, upload to Cloud Storage, and import into Spanner using Dataflow

Answer

Use gcloud commands to stream data from Oracle to Spanner

Answer

Use Database Migration Service (DMS) with continuous replication

Question 2

An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?

Accepted Answer

VPC Service Controls with an access level that includes the IP range. VPC Service Controls can restrict access based on IP addresses via access levels. IAP is for user authentication. Cloud Armor is for HTTP(S) load balancing. Firewall rules apply to network traffic, not API access to Cloud Storage.

Answer

Cloud Armor security policy

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Question 3

A finance team needs to analyze detailed cost data across multiple projects, including resource-level breakdowns, labels, and cost attribution. They want to export this data to a BigQuery dataset for custom analysis. Which billing export option should they enable?

Accepted Answer

Enable billing export to BigQuery (standard usage cost data). Standard billing export to a BigQuery dataset provides detailed cost data with resource-level items, labels, and cost breakdowns. It is the recommended method for granular analysis.

Answer

Use the Cloud Billing API to pull cost data programmatically

Answer

Set up a budget alert with notifications to Pub/Sub and ingest into BigQuery

Answer

Enable billing export to Cloud Storage in CSV format

Question 4

A security engineer wants to block malicious traffic patterns at the edge of Google's network before it reaches their application. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is a web application firewall (WAF) and DDoS protection service that works with Cloud Load Balancing to filter traffic based on IP addresses, geo-location, and Layer 7 attributes. Cloud CDN caches content, Cloud DNS resolves domain names, and VPC firewall rules protect at the instance level, not at the edge.

Answer

VPC firewall rules

Answer

Cloud DNS

Answer

Cloud CDN

Question 5

An operations team tracks the following metrics for their customer portal: request latency p99, error rate, and requests per second. In Site Reliability Engineering terminology, what are these metrics called, and what do they collectively define?

Accepted Answer

Service Level Indicators (SLIs), which measure specific dimensions of service behavior from the user's perspective and collectively define how reliability is quantified. In Site Reliability Engineering (SRE), the metrics p99 latency, error rate, and requests per second are classified as Service Level Indicators (SLIs). SLIs are carefully chosen quantitative measures of specific aspects of the service's behavior, such as availability, latency, or throughput, as experienced by the end user. Collectively, these SLIs define how reliability is quantified and are used to set and monitor Service Level Objectives (SLOs).

Answer

Key Performance Indicators (KPIs) that define the overall health of the business

Answer

Service Level Agreements (SLAs), defining the contractual commitments made to customers

Answer

Operational metrics that are only relevant to the infrastructure team and not to business stakeholders

Question 6

A company is moving a regulated workload to Google Cloud and must ensure that their encryption keys are stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3 validation. Which Google Cloud key management option satisfies this requirement?

Accepted Answer

Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules. Cloud HSM is the correct choice because it provides a dedicated HSM service that stores and manages encryption keys in FIPS 140-2 Level 3 validated hardware security modules. This directly meets the regulatory requirement for a hardware security module with that specific validation level, as opposed to software-backed or customer-supplied key options.

Answer

Cloud KMS software-backed keys, which are managed by Google and stored in Google's secure key management infrastructure

Answer

Customer-supplied encryption keys (CSEK), where the customer provides the key with each API request

Answer

Secret Manager, which stores API keys and credentials with automatic rotation

Question 7

An architect is evaluating whether to use a relational database or a NoSQL database for a new application that must store product catalog data. Products have highly variable attributes — a book has ISBN, author, and genre; a bicycle has frame size, wheel diameter, and material. Which database characteristic makes NoSQL document databases advantageous for this use case?

Accepted Answer

NoSQL document databases support flexible schemas where each document can have different fields — making them well-suited for product catalogs where different product types have different attributes. NoSQL document databases, such as MongoDB, store data in flexible, schema-less documents (often JSON or BSON). This allows each document to have a different set of fields, making them ideal for product catalogs where a book and a bicycle have entirely different attributes (e.g., ISBN vs. frame size). Relational databases require a predefined schema with fixed columns, forcing you to either create many sparse columns or use complex join tables to handle variable attributes.

Answer

NoSQL databases always provide faster query performance than relational databases for all use cases

Answer

NoSQL databases support ACID transactions better than relational databases, making them safer for product catalog updates

Answer

NoSQL databases are simpler to query because they don't require learning SQL

Question 8

An SRE team is practicing 'chaos engineering' by simulating a zone-level failure in their staging environment. They find that their application does not automatically recover — traffic is not redirected and the service remains down. What architectural component is most likely missing?

Accepted Answer

A load balancer with health checks across multiple zones is most likely missing — without it, there is no mechanism to detect the zone failure and automatically redirect traffic to healthy instances in surviving zones. In a zone-level failure, traffic cannot be redirected to healthy instances in surviving zones without a load balancer that performs health checks across multiple zones. Google Cloud's external or internal load balancers (e.g., HTTP(S) Load Balancer, TCP/UDP Network Load Balancer) use health checks to detect unhealthy instances and automatically route traffic only to healthy backends. Without this component, the application has no mechanism to detect the zone failure and reroute traffic, leaving the service down.

Answer

The application needs more replicas in the failing zone to survive the failure

Answer

The application needs a larger machine type to handle the full traffic load without the failed zone's capacity

Answer

Cloud Monitoring alerts need to be configured to notify the team when a zone fails, enabling manual traffic redirection

Question 9

A large bank is undergoing a cloud transformation. The CTO argues that the transformation will require a 'bimodal IT' approach — running two modes of IT simultaneously. What does bimodal IT mean in this context, and what is its primary criticism?

Accepted Answer

Bimodal IT runs stable core systems (Mode 1) alongside an agile innovation team (Mode 2); critics argue it creates organizational division, delays core modernization, and produces digital capabilities that eventually can't integrate with unreformed core systems. Bimodal IT, as described by Gartner, separates IT into Mode 1 (traditional, stable, and risk-averse systems) and Mode 2 (agile, exploratory, and fast-moving innovation teams). In a cloud transformation context, Mode 1 typically runs legacy core banking systems on-premises or in a private cloud, while Mode 2 rapidly develops cloud-native applications. The primary criticism is that this creates a permanent organizational and technical divide, where Mode 2 builds digital capabilities that cannot integrate with the unreformed, monolithic Mode 1 systems, leading to technical debt and delaying the necessary modernization of the core.

Answer

Bimodal IT means using two different cloud providers for redundancy; the criticism is that it creates vendor lock-in with two providers instead of one

Answer

Bimodal IT means running both cloud and on-premises systems; the criticism is that hybrid environments are too complex to manage

Answer

Bimodal IT has no critics — it is universally accepted as the best approach to banking digital transformation

Question 10

An operations team has been asked to estimate the annual cost impact of a proposed new cloud architecture. The architecture would replace 50 on-demand n2-standard-4 VMs (running 24/7) with an autoscaling group that averages 10 VMs under normal load but scales to 50 during peak hours (approximately 8 hours per day). Which analytical approach best estimates the cost impact?

Accepted Answer

Model the actual usage pattern: calculate cost for (16 normal hours × 10 VMs) + (8 peak hours × 50 VMs) per day, compare to fixed cost of 50 VMs × 24 hours, and use Google Cloud Pricing Calculator to price the VM type. It accurately models the variable usage pattern of the autoscaling group: 16 hours at 10 VMs plus 8 peak hours at 50 VMs per day. This approach then compares the daily cost to the fixed 50 VMs × 24 hours baseline, using the Google Cloud Pricing Calculator to price the n2-standard-4 instance type. This reflects the pay-per-use billing model of Google Compute Engine, where autoscaling does not change per-VM pricing but reduces total cost by running fewer instances during off-peak hours.

Answer

Assume the autoscaling group always runs at average load (10 VMs) and multiply by the annual hours to get the new cost

Answer

Request a custom quote from Google Cloud sales since pricing for autoscaling groups is negotiated individually

Answer

The cost will be identical since autoscaling groups use the same VM type as the fixed fleet

Question 11

A CISO is evaluating Google Cloud's security posture and asks about independent third-party validation of Google's security practices. Which types of certifications and audit reports most directly provide this independent assurance?

Accepted Answer

Third-party audit certifications such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP, which independently verify that Google's security controls meet defined international and industry standards. Independent third-party validation of Google Cloud's security posture is most directly provided by certifications and audit reports such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP. These are issued by accredited external auditors who verify that Google's security controls, processes, and infrastructure meet rigorous, internationally recognized standards. This gives customers objective assurance beyond Google's own claims.

Answer

Google's internal security policies and self-assessment reports published on its website

Answer

Google's Bug Bounty program, which shows that the public can report security vulnerabilities

Answer

Customer testimonials from large enterprises that use Google Cloud for sensitive workloads

Question 12

A company wants to expose its internal backend services to external partners through a managed API layer that handles authentication, rate limiting, traffic management, and analytics — without modifying the underlying services. Which Google Cloud product is designed for this API management use case?

Accepted Answer

Apigee, Google Cloud's full-featured enterprise API management platform for authentication, rate limiting, analytics, and developer portal without modifying backend services. Apigee is Google Cloud's full-featured enterprise API management platform designed to expose backend services to external partners without requiring modifications to those services. It provides built-in authentication, rate limiting, traffic management, and analytics, along with a developer portal for partner onboarding. This makes it the correct choice for the described use case.

Answer

Cloud Load Balancing, which distributes API requests across backend instances

Answer

Cloud Endpoints, a lighter-weight API gateway for Google Cloud-hosted APIs

Answer

Cloud Armor, Google Cloud's web application firewall and DDoS protection service

Question 13

A company has a requirement from their security auditor to demonstrate that all administrative actions performed in Google Cloud (such as creating VMs, modifying IAM policies, and deleting storage buckets) are logged and tamper-evident. Which Cloud Logging log type fulfills this requirement?

Accepted Answer

Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.. Admin Activity audit logs are always-on, tamper-resistant logs that record all administrative API calls, such as creating VMs, modifying IAM policies, and deleting storage buckets. They cannot be disabled or modified by users, ensuring tamper-evident logging for security auditor requirements.

Answer

Data Access audit logs — they capture all read and write operations.

Answer

System Event audit logs — they capture all Google Cloud operations.

Answer

Cloud Monitoring logs — they track all changes to monitored resources.

Question 14

A multinational retail company has an on-premises infrastructure with a mix of Windows and Linux servers. They are planning to migrate their e-commerce platform to Google Cloud to take advantage of scalability and reduce latency. The platform consists of a web frontend (Apache), a backend API (Node.js), and a MySQL database. They want to minimize downtime during the migration. They have a limited budget and need a solution that is cost-effective and quick to implement. The IT team has experience with containers but prefers to avoid managing Kubernetes. Which approach should they take?

Accepted Answer

Migrate the frontend to App Engine Standard, the backend to Cloud Run, and the database to Cloud SQL with read replicas.. It combines fully managed, serverless services (App Engine Standard for the web frontend and Cloud Run for the backend API) with Cloud SQL for the database, which meets the requirements of minimizing downtime, being cost-effective, and avoiding Kubernetes management. App Engine Standard and Cloud Run automatically scale to zero when not in use, reducing costs, and Cloud SQL with read replicas provides high availability and low-latency reads without complex orchestration. This approach also allows for a gradual migration with minimal disruption, as the existing code can be adapted with minimal changes.

Answer

Use Compute Engine for the web frontend, Cloud Functions for the backend API, and Cloud Spanner for the database.

Answer

Lift and shift all components to Compute Engine with an autoscaling managed instance group, and migrate the database to Cloud SQL.

Answer

Containerize all components using GKE, use Cloud SQL for the database, and deploy using a CI/CD pipeline.

Question 15

An architect is evaluating trade-offs between using Google Cloud's global network backbone for application traffic versus routing traffic over the public internet. She notes that Google's global network is one of the largest private networks in the world. What is the primary performance advantage of routing application traffic over Google's private backbone?

Accepted Answer

Traffic on Google's private backbone avoids public internet congestion and variable routing, providing consistently lower latency and higher throughput for traffic between regions and to users near Google PoPs. Google's private backbone is a dedicated, software-defined network that uses Google's own fiber infrastructure and BGP routing policies to keep traffic entirely within Google's controlled environment. This avoids the unpredictable congestion, packet loss, and variable routing paths of the public internet, resulting in consistently lower latency and higher throughput for traffic between Google Cloud regions and to users near Google Points of Presence (PoPs).

Answer

Google's private backbone uses faster optical fiber than public internet service providers

Answer

Google's private backbone is free for customers while public internet egress incurs data transfer charges

Answer

Using Google's backbone eliminates the need for application-level TLS encryption because the network is inherently secure

Question 16

A global fintech company needs a database that can handle financial transactions across 50+ countries with consistent, ACID-compliant operations, SQL queries, and automatic global replication with no downtime for maintenance. Which Google Cloud database service meets all these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that provides ACID-compliant transactions, full SQL support, and automatic synchronous global replication with no downtime for maintenance. It is designed for horizontally scalable, globally distributed applications that require strong consistency across regions, making it the ideal choice for a fintech company operating in 50+ countries.

Answer

Cloud SQL (PostgreSQL)

Answer

Cloud Bigtable

Answer

Firestore

Question 17

A chief digital officer is designing a transformation roadmap. She argues that cloud adoption must be accompanied by organizational changes to be effective. Which organizational change is most critical for realizing the full potential of cloud technology?

Accepted Answer

Shifting from project-based, siloed IT teams to persistent, cross-functional product teams that own services end-to-end — enabling continuous delivery and rapid iteration aligned with cloud-native operating models. Cloud-native operating models (e.g., microservices, containers, CI/CD) require persistent, cross-functional product teams that own services end-to-end. This structure enables continuous delivery, rapid iteration, and aligns with DevOps practices, which are essential for leveraging cloud elasticity and automation. Without this organizational shift, technical cloud adoption alone often fails to deliver expected agility and cost efficiencies.

Answer

Replacing all existing employees with new hires who have cloud certifications

Answer

Moving IT from a cost center to a profit center by charging business units market rates for cloud services

Answer

Outsourcing all cloud operations to a managed service provider so internal teams can focus on business strategy

Question 18

A company's risk management team wants to understand Google Cloud's approach to supply chain security — specifically, how Google ensures that the hardware and firmware running in its data centers have not been tampered with. Which Google security initiative addresses hardware supply chain integrity?

Accepted Answer

Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance. Google's Titan security chip is a dedicated hardware root of trust that cryptographically verifies the boot firmware integrity and machine identity at every startup. This ensures that only Google-signed firmware runs on servers, preventing tampering during manufacturing, shipping, or deployment. Titan provides a hardware-anchored attestation chain that validates the entire supply chain from chip fabrication to rack installation.

Answer

Google uses third-party antivirus software to scan all hardware components for tampering before installation

Answer

Google relies on hardware manufacturers' security certifications to ensure supply chain integrity

Answer

Google encrypts all hardware components with AES-256 to prevent tampering

Question 19

A CEO asks why the company should invest in a cloud migration when the existing on-premises infrastructure 'still works fine.' Which business case arguments are MOST relevant to present? (Select the best answer.)

Accepted Answer

Cloud enables faster innovation and time-to-market, reduces total cost of ownership, and provides access to advanced capabilities (AI, analytics) that improve competitive positioning.. It directly addresses the CEO's strategic concerns by highlighting cloud's ability to accelerate innovation and time-to-market, reduce total cost of ownership (TCO) through pay-as-you-go pricing and elimination of hardware lifecycle costs, and provide access to advanced capabilities like AI and analytics that on-premises infrastructure cannot easily match. These arguments frame cloud migration as a competitive necessity rather than a mere technology upgrade, which is the core of the business case.

Answer

The cloud uses newer hardware and newer versions of Linux, which are technically superior.

Answer

Cloud providers have more IT staff than the company, so IT headcount can be reduced immediately.

Answer

The current infrastructure will eventually fail, so proactive migration avoids future risk.

Question 20

An SRE team analyzes that their service had 47 minutes of downtime in the past 30 days. Their SLO is 99.9% monthly availability. How should the team characterize their performance relative to the SLO?

Accepted Answer

The SLO was missed: 99.9% availability allows approximately 43.2 minutes of downtime in a 30-day month, so 47 minutes exceeded the error budget by about 3.8 minutes. The SLO of 99.9% monthly availability allows a maximum downtime of 43.2 minutes in a 30-day month (30 days × 24 hours × 60 minutes × 0.001 = 43.2 minutes). Since the actual downtime was 47 minutes, the error budget was exceeded by 3.8 minutes, meaning the SLO was missed. This calculation is standard for Google Cloud SRE practices, where error budgets are derived directly from the SLO percentage.

Answer

The SLO was met because 47 minutes is less than 1 hour of downtime per month

Answer

The SLO cannot be evaluated because downtime minutes are not the correct unit for measuring availability

Answer

The SLO was met with margin because 47 minutes represents less than 0.5% downtime