Cloud Digital Leader Fundamental Cloud Concepts Practice Question
A financial institution is deploying a sensitive workload on Compute Engine and needs to meet PCI DSS compliance. The security team wants to ensure that the virtual machines run on dedicated, single-tenant hardware and that no other customer's VMs share the same host. Which Compute Engine feature should they enable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sole-tenant nodes
Sole-tenant nodes ensure that VMs from that project are the only ones running on the underlying hardware, providing physical isolation and meeting compliance requirements for dedicated infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidential VMs
Why it's wrong here
Confidential VMs use AMD SEV memory encryption to protect data in use, but the physical host is still multitenant——other customers may run on the same server. Even though the hypervisor cannot see VM memory, the hardware itself is shared, so PCI DSS's requirement for dedicated infrastructure is not met.
- ✗
Preemptible VMs
Why it's wrong here
Preemptible VMs are ephemeral spots that can be terminated within 24 hours when Google needs to reclaim capacity. They are not bound to dedicated hardware and share the same physical pool as all other cloud tenants, offering no physical segregation. Their unpredictable lifetime rules them out for a steady, sensitive workload.
- ✓
Sole-tenant nodes
Why this is correct
By binding VMs to a dedicated physical server, sole-tenant nodes ensure that no other Google Cloud customer's VMs run on that hardware. This direct physical isolation meets PCI DSS's requirement for secure hosting and data segregation, simplifying audit evidence. The tenant gains exclusive control over server provisioning, maintenance, and placement, which is impossible with standard multi-tenant VMs.
- ✗
Shielded VMs
Why it's wrong here
Shielded VMs offer secure boot, UEFI firmware integrity, and vTPM-based attestation to guard against OS-level tampering and rootkits. However, these protections do nothing to alter the underlying shared host; multiple customers may still occupy the same physical server. Consequently, they do not provide the physical separation required for compliance with dedicated hardware mandates.
Go deeper
Related to this question
Learn chapter
Google Cloud Infrastructure
Key term
PCI DSS
The Payment Card Industry Data Security Standard is a set of security requirements designed to protect credit card data during storage, processing, and transmission.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.