Cloud Digital Leader Scaling with Google Cloud operations Practice Test 4 — 15 Questions

Question 1

A DevOps team wants to adopt GitOps practices for managing their Google Cloud infrastructure. Which combination of tools and practices defines a GitOps approach to cloud infrastructure management?

Accepted Answer

Storing all infrastructure as code (Terraform or Config Connector) in a Git repository, using pull requests for all changes, and automated CI/CD pipelines that apply changes and detect drift from the declared state. Option B is correct because GitOps is defined by using a Git repository as the single source of truth for declarative infrastructure, with pull requests driving changes and automated CI/CD pipelines reconciling the actual state with the declared state. This approach enforces version control, auditability, and drift detection, which are core to managing Google Cloud infrastructure at scale with tools like Terraform or Config Connector.

Answer

Manually applying Terraform changes from engineers' local machines and documenting changes in a shared wiki

Answer

Using the Google Cloud Console to make infrastructure changes and exporting the configuration to Git after each change

Answer

GitOps only applies to application code deployment, not to cloud infrastructure management

Question 2

An operations team has been asked to estimate the annual cost impact of a proposed new cloud architecture. The architecture would replace 50 on-demand n2-standard-4 VMs (running 24/7) with an autoscaling group that averages 10 VMs under normal load but scales to 50 during peak hours (approximately 8 hours per day). Which analytical approach best estimates the cost impact?

Accepted Answer

Model the actual usage pattern: calculate cost for (16 normal hours × 10 VMs) + (8 peak hours × 50 VMs) per day, compare to fixed cost of 50 VMs × 24 hours, and use Google Cloud Pricing Calculator to price the VM type. Option B is correct because it accurately models the variable usage pattern of the autoscaling group: 16 hours at 10 VMs plus 8 peak hours at 50 VMs per day. This approach then compares the daily cost to the fixed 50 VMs × 24 hours baseline, using the Google Cloud Pricing Calculator to price the n2-standard-4 instance type. This reflects the pay-per-use billing model of Google Compute Engine, where autoscaling does not change per-VM pricing but reduces total cost by running fewer instances during off-peak hours.

Answer

Assume the autoscaling group always runs at average load (10 VMs) and multiply by the annual hours to get the new cost

Answer

Request a custom quote from Google Cloud sales since pricing for autoscaling groups is negotiated individually

Answer

The cost will be identical since autoscaling groups use the same VM type as the fixed fleet

Question 3

A cloud team receives an alert that a critical production service's error rate has spiked. Following incident response best practices, what is the correct first priority action?

Accepted Answer

Mitigate user impact immediately (e.g., rollback, traffic rerouting, scaling) while beginning parallel investigation of the root cause. Option B is correct because incident response best practices prioritize reducing user impact first. In Google Cloud, this could involve rolling back a deployment via Cloud Deploy, rerouting traffic with a load balancer, or scaling up instances with Managed Instance Groups, all while a parallel investigation into the root cause begins. This aligns with the SRE principle of 'error budget' and the 'mitigate before diagnose' approach.

Answer

Identify and fix the root cause before taking any other action to ensure the fix is complete

Answer

Wait to understand the full scope of the issue and inform all stakeholders before taking any technical action

Answer

Escalate to senior leadership and wait for their approval before making any production changes

Question 4

A company wants to reduce its Google Cloud costs without reducing its workload capacity. The team identifies that several production VMs consistently use less than 30% of their allocated CPU and memory. What is the most straightforward cost optimization action?

Accepted Answer

Right-size the VMs by migrating to smaller machine types that match actual CPU and memory consumption, reducing costs proportionally. Right-sizing VMs by migrating to smaller machine types that match actual CPU and memory consumption directly reduces the cost per hour while maintaining the same workload capacity. Since the VMs are consistently under-utilized, this approach eliminates wasted resources without affecting performance or availability.

Answer

Delete the under-utilized VMs since low utilization indicates they are no longer needed

Answer

Purchase Committed Use Discounts for the over-provisioned VMs to reduce their per-hour cost

Answer

Enable sustained use discounts by ensuring VMs run continuously throughout the month

Question 5

A platform engineering team is designing a self-service cloud environment for development teams. They want developers to be able to provision approved cloud resources quickly without waiting for central IT approval for every request, while still ensuring compliance with security and cost policies. Which architectural approach best balances developer agility with governance?

Accepted Answer

Provide a self-service catalog of pre-approved, policy-compliant infrastructure templates with automated provisioning, budget alerts, and org policy guardrails — enabling developer agility while enforcing compliance automatically. Option C is correct because it uses a self-service catalog with pre-approved, policy-compliant templates (e.g., Deployment Manager or Terraform configurations) combined with Organization Policy Service guardrails and automated budget alerts. This approach allows developers to provision resources on demand while enforcing security and cost policies automatically, balancing agility with governance without manual bottlenecks.

Answer

Require all resource provisioning requests to be submitted as tickets to the central IT team for manual review and approval before any resources are created

Answer

Give all developers Owner access to all Google Cloud projects so they can provision any resources without delays

Answer

Allow developers to provision resources freely in a shared sandbox project only, keeping production entirely controlled by central IT

Question 6

A cloud team wants to understand their current Google Cloud resource inventory — specifically, which VMs are running in each region, their machine types, and whether they have public IP addresses. Which approach most efficiently provides this across all projects?

Accepted Answer

Use Cloud Asset Inventory to run a single org-wide query that returns all VM instances, their regions, machine types, and network configurations across all projects. Cloud Asset Inventory provides a single, unified API to query resources across all projects in an organization. By using the `gcloud asset search-all-resources` command with the `--asset-types=compute.googleapis.com/Instance` filter, you can retrieve all VM instances along with their regions, machine types, and network configurations (including public IP addresses) in one operation, without needing to access each project individually.

Answer

Log into each Google Cloud project individually through the Console and manually record VM details in a spreadsheet

Answer

Check the Cloud Billing reports, which list all resources that have incurred charges by resource type

Answer

Enable VPC flow logs in each project to capture VM network activity

Question 7

An operations team is performing a post-incident review after a production outage. The team lead insists that the review must follow a 'blameless postmortem' approach. What does this mean, and why is it important for organizational learning?

Accepted Answer

A blameless postmortem focuses on systemic root causes and improvement opportunities rather than individual fault — creating psychological safety for honest disclosure and leading to more effective prevention of future incidents. Option B is correct because a blameless postmortem in Google Cloud operations (and SRE practice) shifts focus from individual human error to systemic root causes, such as misconfigured alerting thresholds, insufficient canary deployments, or gaps in monitoring coverage. This approach fosters psychological safety, encouraging engineers to report all contributing factors without fear of reprisal, which leads to more effective incident prevention and aligns with Google's Site Reliability Engineering (SRE) principles of learning from failures.

Answer

A blameless postmortem assigns full responsibility to the automated systems involved, not to human engineers, which protects the team from accountability

Answer

A blameless postmortem means the incident is not formally documented to protect employees' privacy and career records

Answer

A blameless postmortem can only be conducted by senior management who have authority to make systemic improvements

Question 8

A company's SRE team sets an SLO of 99.5% monthly availability for a non-critical internal tool. A business stakeholder argues the target should be 99.99%. The SRE team pushes back. Which SRE argument best supports keeping the 99.5% target?

Accepted Answer

For a non-critical internal tool, 99.99% reliability requires disproportionate engineering investment (redundancy, 24/7 on-call, chaos testing) compared to its business value; 99.5% matches the actual reliability need while preserving engineering capacity for higher-value work. Option B correctly applies the SRE principle of aligning SLOs with business value. For a non-critical internal tool, the cost of achieving 99.99% availability—including redundant infrastructure, 24/7 on-call rotations, and chaos engineering—far exceeds the marginal benefit over 99.5%. This preserves engineering capacity for higher-value work, which is a core tenet of Google's SRE approach to error budgets and cost-benefit analysis.

Answer

Higher SLOs are always more expensive to achieve and the company cannot afford cloud infrastructure that provides 99.99% availability

Answer

Google Cloud cannot provide 99.99% availability for any service, so the SLO must be kept lower

Answer

The team should set 99.5% now and plan to increase it to 99.99% next quarter when the tool becomes more popular

Question 9

A cloud team wants to automatically enforce that all new Compute Engine VMs are created with a specific label (environment: production) and that no VMs are created with external IP addresses in the production project. Which Google Cloud capability enforces these organizational policies at resource creation time?

Accepted Answer

Organization Policy Service constraints that enforce no external IPs and required labels at resource creation time, blocking non-compliant VMs before they are created. Organization Policy Service constraints, specifically `compute.vmExternalIpAccess` and `compute.requireOsLogin` or custom constraints for labels, are evaluated at resource creation time. They block non-compliant VM creation before the API call succeeds, enforcing policies like 'no external IPs' and 'required labels' without relying on post-creation detection or IAM permissions.

Answer

Cloud Monitoring alerting policies that detect and notify when non-compliant VMs are created

Answer

Cloud IAM roles that prevent developers from creating VMs without the proper labels

Answer

Cloud Billing budget alerts that detect when VM spending exceeds expected amounts for labeled resources

Question 10

A company has a Google Cloud environment with 50 projects and 200 engineers. The security team wants to ensure that a new security policy — requiring all Cloud Storage buckets to have uniform bucket-level access enabled — applies to all existing and future buckets across all projects. Which approach scales to the entire organization?

Accepted Answer

Apply an Organization Policy constraint ('storage.uniformBucketLevelAccess') at the organization level to enforce the setting automatically across all current and future projects and buckets. Option B is correct because Organization Policy constraints, such as `storage.uniformBucketLevelAccess`, are enforced at the organization level and automatically apply to all existing and future projects and resources within the organization. This ensures uniform compliance without manual intervention, scaling seamlessly across 50 projects and 200 engineers.

Answer

Send an email to all 200 engineers explaining the policy and asking them to manually enable uniform bucket-level access on their buckets

Answer

Create a Cloud Function that checks bucket configurations hourly and enables uniform access on non-compliant buckets

Answer

Grant the security team Owner access to all 50 projects so they can manually enforce the policy in each project

Question 11

A company uses committed use discounts (CUDs) for its production workload baseline. An engineer proposes also using sustained use discounts (SUDs) for the same VMs. Why is this incorrect?

Accepted Answer

CUDs and SUDs are mutually exclusive: VMs already covered by committed use discounts don't accrue sustained use discounts — you receive only the CUD, not both. Option B is correct because committed use discounts (CUDs) and sustained use discounts (SUDs) are mutually exclusive on the same VM. When a VM is covered by a CUD, it does not accrue SUDs; only the CUD discount is applied. This prevents double-discounting and ensures billing consistency.

Answer

CUDs and SUDs can be combined on the same VMs — applying both gives the maximum possible discount

Answer

SUDs cannot be applied to production workloads — they are only available for development environments

Answer

Applying both CUDs and SUDs creates a billing conflict that could result in Google charging the company more than on-demand pricing

Question 12

An SRE team is practicing 'chaos engineering' by simulating a zone-level failure in their staging environment. They find that their application does not automatically recover — traffic is not redirected and the service remains down. What architectural component is most likely missing?

Accepted Answer

A load balancer with health checks across multiple zones is most likely missing — without it, there is no mechanism to detect the zone failure and automatically redirect traffic to healthy instances in surviving zones. In a zone-level failure, traffic cannot be redirected to healthy instances in surviving zones without a load balancer that performs health checks across multiple zones. Google Cloud's external or internal load balancers (e.g., HTTP(S) Load Balancer, TCP/UDP Network Load Balancer) use health checks to detect unhealthy instances and automatically route traffic only to healthy backends. Without this component, the application has no mechanism to detect the zone failure and reroute traffic, leaving the service down.

Answer

The application needs more replicas in the failing zone to survive the failure

Answer

The application needs a larger machine type to handle the full traffic load without the failed zone's capacity

Answer

Cloud Monitoring alerts need to be configured to notify the team when a zone fails, enabling manual traffic redirection

Question 13

A company's cloud operations team is implementing a tagging strategy for cost allocation. They want to ensure that the 'cost-center' label is present on every Compute Engine VM and Cloud Storage bucket created in their Google Cloud organization. Currently, some resources are created without this label. Which combination of controls best enforces and remediates this requirement?

Accepted Answer

Organization Policy custom constraint to prevent creation of resources without the 'cost-center' label (preventive), plus Cloud Asset Inventory to identify existing unlabeled resources for remediation (detective). A preventive control (org policy custom constraint requiring the label) stops future non-compliant resources. A detective/corrective control (Cloud Asset Inventory + Cloud Functions or Security Command Center) finds and remediates existing unlabeled resources. Both are needed for comprehensive enforcement.

Answer

Only organization policy — once new resources are blocked, existing unlabeled resources don't matter

Answer

Only Cloud Asset Inventory monitoring — alerting on unlabeled resources is sufficient without preventing their creation

Answer

Grant all engineers the 'Labels Admin' role to encourage them to add labels voluntarily

Question 14

A company's production database is running on a Compute Engine VM with a 500 GB Persistent Disk. The operations team wants to create a backup they can restore from in case of data corruption or accidental deletion. Which Google Cloud capability provides point-in-time backup for Persistent Disks?

Accepted Answer

Persistent Disk Snapshots, which capture the disk state at a point in time and enable restoration or creation of new disks from that snapshot. Persistent Disk Snapshots are the correct Google Cloud feature for creating point-in-time backups of Persistent Disks. They capture the disk's data and configuration at a specific moment, allowing you to restore the disk or create new disks from that snapshot. This is the native, recommended method for backup and disaster recovery of Compute Engine VM disks.

Answer

Cloud Storage bucket replication, by continuously copying the database files to a storage bucket

Answer

Cloud SQL automated backups, which protect databases running on Compute Engine VMs

Answer

VM live migration, which moves the running VM between physical hosts, automatically creating a backup in the process

Question 15

A company's cloud cost has grown significantly. A FinOps analysis reveals the largest waste category is idle Cloud SQL instances — 12 database instances that were provisioned for projects that have since ended, but were never deleted. What process failure most directly caused this waste?

Accepted Answer

The absence of a resource decommissioning process: when projects end, there is no formal step to identify and delete associated cloud resources, allowing idle infrastructure to persist and accrue costs indefinitely. Option B is correct because the root cause is the lack of a formal resource decommissioning process. When projects end, there is no automated or manual step to identify and delete associated Cloud SQL instances, so idle databases continue to incur costs. In Google Cloud, Cloud SQL instances do not auto-delete; they persist until explicitly removed, making a decommissioning workflow essential to prevent waste.

Answer

The company should have used a cheaper database service instead of Cloud SQL

Answer

Cloud SQL pricing is too high compared to on-premises databases, making any unused capacity expensive

Answer

The database administrators forgot to enable automatic deletion for idle Cloud SQL instances