Cloud Digital Leader Multiple Select — 30 Questions

Question 1

A company stores sensitive customer data in Cloud Storage buckets. The security team wants to ensure that only authorized users can access the data, and access is logged for audit. Which two practices should they implement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply IAM conditions to restrict access based on user attributes like IP address or time of day.. IAM conditions allow fine-grained, attribute-based access control, such as restricting access to Cloud Storage buckets based on the requester's IP address or time of day, ensuring only authorized users can access the data under specific contexts. Option C is correct because Cloud Audit Logs record all access attempts (including successful and denied requests) to the bucket, providing the necessary audit trail for security and compliance.

Answer

Use Storage Transfer Service to replicate data to a secured bucket.

Answer

Set up Private Google Access to restrict access to the bucket.

Answer

Enable default encryption on all buckets using CMEK.

Question 2

Which TWO of the following are key benefits of cloud technology that are transforming business operations?

Accepted Answer

Elasticity to automatically scale resources up and down. Cloud elasticity allows resources to automatically scale up or down based on demand, eliminating over-provisioning and underutilization. This dynamic adjustment is a key transformation driver, enabling businesses to handle variable workloads efficiently without manual intervention.

Answer

Physical security of data centers

Answer

Data locality to keep data within national borders

Answer

Ability to purchase reserved instances for predictable workloads

Question 3

A company wants to monitor the health and performance of their applications running on Google Cloud. Which two Google Cloud services should they use together for comprehensive observability?

Accepted Answer

Cloud Monitoring. Cloud Monitoring and Cloud Logging together form the core of Google Cloud's observability stack. Cloud Monitoring collects metrics, uptime checks, and alerting policies, while Cloud Logging ingests, stores, and analyzes log data. Combined, they provide the metrics, logs, and alerting needed to comprehensively monitor application health and performance.

Answer

Cloud Profiler

Answer

Cloud Debugger

Answer

Cloud Trace

Question 4

A company wants to monitor its Google Cloud spending and receive alerts when costs exceed a threshold. Which two services should they use together?

Accepted Answer

Cloud Billing Budgets and Alerts. Cloud Billing Budgets and Alerts (D) allows you to define a spending threshold and receive notifications when costs approach or exceed that limit. Cloud Monitoring (E) can ingest those budget alert events and trigger additional actions, such as sending notifications via email, SMS, or Pub/Sub, or integrating with incident management tools. Together, they provide a complete cost monitoring and alerting solution.

Answer

Cloud Scheduler

Answer

Cloud Asset Inventory

Answer

Cloud Logging

Question 5

A company uses Cloud Monitoring to collect metrics from their applications running on Google Kubernetes Engine (GKE). They want to create custom dashboards and set up alerting policies. Which THREE capabilities are available in Cloud Monitoring? (Choose THREE.)

Accepted Answer

Define custom metrics via the Monitoring API. The Cloud Monitoring API allows you to define and write custom metrics, which can then be used in dashboards and alerting policies. This is essential for capturing application-specific data that is not automatically collected by the default GKE integration, such as business KPIs or custom performance counters.

Answer

Query logs using Logging Query Language

Answer

Automatically remediate incidents with Cloud Functions

Question 6

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Answer

Access Transparency

Answer

Security Command Center

Answer

Cloud Armor

Question 7

An organization wants to enforce that all Compute Engine instances must have a label 'environment' set to 'production', 'staging', or 'development'. They also want to ensure that instances in the 'production' folder cannot be created with public IP addresses. Which THREE steps should they take? (Choose 3)

Accepted Answer

Use IAM conditions to deny the compute.instances.create permission without the label.. The correct steps are options A, C, and E. Option A uses IAM conditions to deny the compute.instances.create permission if the required 'environment' label is not present, directly enforcing the labeling requirement. Option C uses an organization policy constraint to prohibit external IP addresses on Compute Engine instances in the production folder, preventing public IPs. Option E uses a custom organization policy constraint to require the 'environment' label on all Compute Engine instances. Option B is incorrect because VPC Service Controls restrict data exfiltration, not the creation of instances with public IPs. Option D is incorrect because automatically applying labels via a Cloud Function is a remediation approach, not an enforcement mechanism; the policy constraints and IAM conditions are the appropriate enforcement tools.

Answer

Set up VPC Service Controls to restrict access to the production VPC.

Answer

Create a folder for each environment and apply the label automatically using a Cloud Function triggered by Resource Manager events.

Question 8

Which THREE practices are recommended for securing a Kubernetes cluster in Google Kubernetes Engine (GKE)?

Accepted Answer

Use Binary Authorization to ensure only trusted container images are deployed. Binary Authorization is correct because it enforces deployment-time policy validation, ensuring that only container images signed by trusted authorities (e.g., via KMS) are allowed to run in GKE. This prevents the deployment of untrusted or tampered images, directly addressing supply chain security.

Answer

Enable node auto-repair to automatically fix security vulnerabilities in nodes

Answer

Expose the cluster control plane via a public endpoint to allow monitoring

Question 9

A startup is building a mobile app that needs to store user profiles and preferences with low latency. The data is unstructured and frequently read/written. Which TWO Google Cloud database services are most suitable? (Choose 2)

Accepted Answer

Bigtable. Firestore is a NoSQL document database optimised for mobile/web apps with low-latency reads/writes. Bigtable is also NoSQL but designed for high-throughput time-series data. Memorystore is a cache, not a primary database. Cloud SQL is relational. The best options are Firestore for user profiles and preferences (unstructured, low-latency) and Bigtable if the scale is very high, but typically Firestore is the go-to for mobile. However, the question asks for TWO; Bigtable is also NoSQL and can be used for user data but is overkill. Alternatively, Firestore and Memorystore can be combined: Firestore as primary, Memorystore as cache. But Memorystore is a cache, not a database. The question says 'database services'. So likely Firestore and Bigtable are both NoSQL databases. But for user profiles, Firestore is more appropriate. I'll select Firestore and Bigtable as two NoSQL options.

Answer

Memorystore

Answer

Cloud Spanner

Answer

Cloud SQL

Question 10

A company needs to reduce costs on Compute Engine instances that run batch jobs for varying durations. They can tolerate interruptions and do not require a specific uptime guarantee. Which TWO instance types or purchasing options should they consider? (Choose 2)

Accepted Answer

Spot VMs. Preemptible VMs can be terminated at any time but are significantly cheaper, suitable for fault-tolerant batch jobs. Spot VMs are similar to preemptible but with no maximum runtime and often lower price. Both are ideal for batch workloads that can handle interruptions.

Answer

Sole-tenant nodes

Answer

Committed use discounts

Answer

Sustained use discounts

Question 11

An organization wants to ensure that all projects in their GCP organization have consistent IAM policies. They also need to restrict the use of external IP addresses on Compute Engine instances for security. Which TWO tools should they use? (Choose TWO.)

Accepted Answer

Use an organization policy constraint 'compute.vmExternalIpAccess' at the organization level. Organization policies can enforce restrictions like disabling external IP addresses across the entire organization. IAM policies at the organization level can set baseline access controls inherited by all projects.

Answer

Apply a deny IAM policy to each project individually

Answer

Set a quota for external IP addresses per project

Answer

Use network tags to block external IPs

Question 12

A company wants to set up cost controls and analysis. They need to receive notifications when spending exceeds certain thresholds, and also be able to run custom queries on billing data. Which TWO actions should they take? (Choose 2)

Accepted Answer

Create a budget and set alert thresholds. To receive notifications at thresholds, they need to create a budget and set alerts. To run custom queries, they should enable billing export to BigQuery.

Answer

Set up a Pub/Sub topic for billing alerts

Answer

Activate the Cost Management dashboard

Answer

Enable billing export to Cloud Storage

Question 13

A company needs to enforce that no project in the organization can create resources outside of the us-central1 region. They also need to allow the Finance team to manage billing for all projects. Which TWO steps should they take?

Accepted Answer

Apply the `gcp.resourceLocations` organization policy constraint at the organization node. Organization policies can be applied at the organization level to restrict locations. Billing account access is controlled by IAM roles on the billing account, granting the Finance team the Billing Account Administrator role.

Answer

Create a separate billing account for each project

Answer

Use IAM deny policies at the organization node to block resource creation outside us-central1

Answer

Create a folder and apply an organization policy constraint to restrict locations at the folder level

Question 14

A company runs a critical application on Compute Engine. They need a backup and disaster recovery strategy that includes automated backups and the ability to restore in a different region. Which TWO services should they use together? (Select 2)

Accepted Answer

Persistent Disk snapshots. Persistent Disk snapshots can be used for automated backups. Cloud Storage can store these snapshots in a different region for DR. Cloud SQL is not relevant if the application runs on Compute Engine. Cloud Run is a compute service, not backup. Dataflow is processing.

Answer

Cloud Run

Answer

Dataflow

Answer

Cloud SQL

Question 15

A developer wants to build a CI/CD pipeline that automatically builds a Docker container from a GitHub repository, stores the image securely, and deploys it to Cloud Run. Which THREE services should they integrate? (Select 3)

Accepted Answer

Cloud Build. Cloud Build builds the Docker image, Artifact Registry stores the image, and Cloud Run deploys it. Cloud Storage is for object storage, not container images. Cloud Build triggers can be used with GitHub, but the question asks for services that are part of the pipeline; Cloud Source Repositories is a code repository, not required if using GitHub.

Answer

Cloud Storage

Answer

Cloud Source Repositories

Question 16

A data scientist needs to build a custom machine learning model using TensorFlow on Google Cloud. The training data is stored in Cloud Storage and is hundreds of gigabytes. The data scientist wants to use a managed service that handles hyperparameter tuning and distributed training without managing infrastructure. Which TWO services can be used together to achieve this? (Choose 2)

Accepted Answer

Vertex AI Training. Vertex AI Training is a managed service for training ML models, supporting distributed training and hyperparameter tuning. Vertex AI Workbench is a Jupyter-based notebook environment for prototyping. Cloud Functions is for event-driven code, not ML training. Cloud Run is for containers. BigQuery ML allows building models using SQL but is limited to simple models.

Answer

BigQuery ML

Answer

Cloud Functions

Answer

Cloud Run

Question 17

A data engineering team needs to process streaming data from IoT devices, perform real-time transformations, and load the results into BigQuery for analysis. Which TWO Google Cloud services should they use?

Accepted Answer

Pub/Sub. Pub/Sub is the messaging service for ingesting streaming data. Dataflow can read from Pub/Sub, perform transformations, and write to BigQuery. Cloud Functions is for small event-driven functions, not streaming pipelines. Dataproc is for batch Hadoop/Spark jobs. Cloud Scheduler is for cron jobs.

Answer

Cloud Scheduler

Answer

Dataproc

Answer

Cloud Functions

Question 18

A company has a multi-regional deployment of a web application on Compute Engine. They want to improve latency for users worldwide and reduce load on the origin servers. They also need to protect against SQL injection and cross-site scripting attacks. Which TWO Google Cloud services should they implement?

Accepted Answer

Cloud Armor. Cloud CDN caches content at edge locations to improve latency and reduce origin load. Cloud Armor provides WAF capabilities to protect against application attacks like SQL injection and XSS. Cloud Load Balancing distributes traffic but doesn't cache. Cloud DNS is for DNS resolution. Cloud NAT is for outbound internet.

Answer

Cloud DNS

Answer

Cloud NAT

Answer

Cloud Load Balancing

Question 19

A retail company wants to reduce latency for customers in Europe and Asia by hosting their application closer to users. They also need high availability in case of a regional outage. Which TWO actions should they take?

Accepted Answer

Deploy the application in multiple regions. Deploying in multiple regions reduces latency for users in different geographies and provides disaster recovery. Replicating data across zones within a single region does not protect against regional failures.

Answer

Use a single region with multiple zones

Answer

Enable Cloud CDN on the application

Answer

Increase machine size in a single zone

Question 20

A company is deploying a global web application and needs to serve users with low latency, protect against DDoS attacks, and scale automatically. Which two Google Cloud services should they combine? (Choose exactly 2.)

Accepted Answer

Cloud Armor. Cloud Load Balancing distributes traffic globally and scales automatically. Cloud Armor provides DDoS protection and WAF. Cloud CDN caches content but does not provide DDoS protection. Cloud DNS resolves domain names. Cloud NAT is for outbound connectivity.

Answer

Cloud CDN

Answer

Cloud NAT

Answer

Cloud DNS