Google Cloud Digital Leader (GCDL) — Questions 1–75

Cloud Monitoring is Google Cloud's primary service for operational visibility and alerting. It ingests metrics from GCP and external sources, stores them in a time-series database, and evaluates alerting policies that can trigger notifications via email, SMS, Pub/Sub, or webhooks. It also offers built-in dashboards and the Metrics Explorer for real-time and historical performance analysis, making it the correct answer for monitoring and alerting.

Hybrid cloud is the correct choice because it allows the financial services company to store sensitive regulated data on-premises, satisfying strict data residency requirements, while still leveraging public cloud resources for burst analytics and compute-intensive workloads. This architecture keeps the data within approved jurisdictions and uses the cloud only for processing, ensuring both compliance and scalability.

Cloud Armor is Google Cloud's WAF. It includes preconfigured rule sets for OWASP Top 10 vulnerabilities including SQL injection and XSS, and operates at the application layer (Layer 7) where it can inspect HTTP requests. It also provides DDoS protection.

Verify that the origin server sets appropriate Cache-Control headers (e.g., max-age=3600) is the correct fix because Cloud CDN explicitly honors the Cache-Control header from the origin. If the origin omits max-age or sets it too low, the CDN caches for a shorter period and re-fetches from origin more frequently, causing content to be served as stale sooner. Setting max-age=3600 explicitly instructs edge caches to treat content as fresh for one hour, balancing user-perceived freshness with reduced origin load.

This is the accurate definition. Horizontal scaling, also known as scaling out, involves adding more instances (e.g., VMs, containers) to a resource pool and using a load balancer to distribute traffic across them, which improves throughput and fault tolerance. Vertical scaling, or scaling up, increases the capacity of an existing instance by adding more CPU, RAM, or storage, but it is limited by the maximum size of a single machine and often requires a restart.

This combination delivers true end-to-end experience transformation: ML models can analyze passenger history and preferences to generate individualized ancillary offers, real-time streaming data pipelines push accurate flight status and disruption alerts to mobile devices, and a mobile-first self-service portal provides a single, frictionless control point from booking through baggage claim. Together, these capabilities close the loop between back-end analytics and front-end engagement, enabling proactive, personalized decisions that fundamentally change how passengers interact with the airline.

The Google Cloud Pricing Calculator is the correct tool because it enables users to select specific Google Cloud products, configure their parameters (e.g., machine type, region, storage class, network egress), and immediately see a detailed monthly cost estimate. It also incorporates pricing tiers, custom machine types, and can account for committed use discounts or sole-tenant nodes, giving a flexible and reasonably accurate projection for a planned workload. This makes it ideal for a startup that needs to budget before any actual infrastructure is created, as it translates desired resource specifications into an estimated monthly bill.

VPC Service Controls is correct because it establishes security perimeters around Google Cloud resources such as Cloud Storage, BigQuery, and Cloud Bigtable. These perimeters restrict data movement by allowing only requests that originate from authorized projects, networks, and identities within the perimeter. This API-level control prevents data exfiltration even if credentials are compromised, going beyond what network-level firewalls can achieve.

Configuring the HPA to consume custom metrics from the Kubernetes Custom Metrics API (e.g., using the Stackdriver adapter or Prometheus adapter) allows it to scale based on request latency metrics such as p95 or p99 duration. This directly measures user-facing performance so the HPA adds pods when latency rises, not just when CPU is saturated. This approach responds to application-level bottlenecks, which is the correct fix for latency-driven scaling on Google Kubernetes Engine.

Cloud Spanner is the only Google Cloud relational database that combines global scalability with strong consistency and ACID transactions, using synchronous replication and Paxos consensus across regions. It is specifically designed to deliver 99.999% availability SLA, meeting the financial services requirement for a globally distributed, strongly consistent relational database. With horizontal scaling and automatic sharding, it can handle massive transaction loads while maintaining external consistency.

Chronicle is Google Cloud's SIEM offering that ingests large volumes of telemetry and log data, normalizes it, and applies analytics and detection rules to identify suspicious activity. It correlates events across multiple data sources with context like user and network behavior, enabling security teams to prioritize and respond to threats. As a SIEM, Chronicle is designed specifically for centralized security analytics and incident investigation.

Cloud Service Mesh (Istio) injects Envoy sidecar proxies into each pod, creating a data plane that intercepts and controls east-west traffic between microservices. It provides mutual TLS, traffic splitting, retries, and rich telemetry, while the control plane manages policies via custom resource definitions. Because it operates transparently at the application layer, teams can enforce security and reliability without modifying service code.

Managed services on Google Cloud, such as App Engine, Cloud Run, and GKE Autopilot, offload the entire lifecycle of infrastructure maintenance. Google handles OS security patching, kernel updates, and automatic failover of unhealthy nodes, eliminating the need for your engineers to spend cycles on routine server administration. This lets teams redeploy effort toward writing code, running experiments, and delivering features, which directly accelerates innovation and reduces the risk of human error during maintenance windows.

The math confirms the SLA was met. 30 days × 1,440 minutes = 43,200 minutes. 0.05% × 43,200 = 21.6 minutes allowed. 12 + 7 = 19 minutes actual downtime. 19 < 21.6, so the SLA is met. However, the remaining buffer is only 2.6 minutes — the team should treat this as a reliability concern.

Data egress fees — Data egress is charged whenever bits leave GCP to the internet, another cloud, or in some cases between zones; pricing is usage-based per GB (e.g., roughly $0.12/GB for standard-tier traffic in the first 1TB). For data-heavy workloads like streaming analytics, backups, or inter-cloud replication, egress can exceed compute cost. Because ingress is free and transfer volume is easy to underestimate, this is a major hidden TCO line.

Secret Manager is Google Cloud's dedicated service for storing secrets like database passwords, API keys, and certificates. It provides versioned secret values, fine-grained IAM roles, and Cloud Audit Logging to track access, and it supports rotation policies by using Cloud Scheduler to create new versions. Unlike the other options, Secret Manager handles the password directly and offers the necessary controls for secure retrieval by applications.

Cloud HSM specifically addresses the FIPS 140-2 Level 3 requirement. Keys generated and stored in Cloud HSM never leave the HSM in plaintext form, and all cryptographic operations occur within the certified hardware. This is the correct answer for workloads requiring hardware-backed key storage at the highest FIPS level.

Vertex AI Training is a fully managed service designed specifically for custom ML training, handling infrastructure provisioning, job scheduling, and scaling automatically. It supports hardware accelerators like GPUs and TPUs, and provides pre-built containers for TensorFlow, PyTorch, and scikit-learn. This lets the data scientist focus on model code rather than cluster management, making it the correct choice.

Looker's LookML semantic layer is precisely designed for governed analytics. Data engineers define business logic (what 'revenue' means, how to join tables) in LookML, which is version-controlled in Git. All Looker reports query through this layer, ensuring consistent definitions. This is the differentiated capability versus Looker Studio.

MFA is the definitive defense against credential stuffing. The stolen credentials work for the first factor (password), but the attack fails at the second factor (authenticator app TOTP, push notification, hardware security key). Attackers would need both the credentials AND access to the user's second factor device — a much higher bar.

A managed instance group (MIG) is a Google Compute Engine resource that manages a collection of VM instances created from an instance template. It supports autoscaling to add or remove instances based on load, but more importantly it supports autohealing: when you configure a health check, the MIG continuously monitors each instance and automatically deletes and recreates any instance that fails that health check. This makes the MIG the correct enabling service because it provides the instance-management layer that can actually replace unhealthy VMs, keeping the e-commerce site resilient without manual intervention.

This is the correct configuration: create a key in Cloud KMS, designate it as the customer-managed encryption key (CMEK) for the Cloud SQL instance, and set the rotation period to 30 days. Cloud KMS then automatically rotates the key material every 30 days, and Cloud SQL transparently re-encrypts data with the new key version, meeting the company's compliance requirement without manual intervention.

Billing export to BigQuery is the correct choice because it lets you continuously export detailed GCP billing data—including cost, usage, SKU, project, and labels—into BigQuery. This data can then be queried with SQL and visualized to identify monthly or daily spending trends by service. The export is set up at the billing account level and supports both standard and detailed usage cost views, making it the intended tool for this analysis.

SaaS (Software-as-a-Service) is a software distribution model where applications are hosted and managed by a vendor, delivered over the internet, typically with a subscription fee, and require no local installation or infrastructure management. Google Workspace epitomizes SaaS: Google provides Gmail, Google Docs, Drive, and Meet as consistent, always-current services with high availability, data redundancy, and centralized admin controls, while subscribers use them directly. The user is not responsible for servers, operating systems, or application upkeep—exactly the SaaS value proposition.

Cloud IAM deny policies always take precedence over allow bindings, regardless of the hierarchy level where either is defined. When a folder-level deny policy matches the group's principal and specifies the same permissions as the granted role, those permissions are unconditionally blocked. Consequently, effective access for the group is zero—even though the folder allow policy exists, the deny rule suppresses all permissions in that role for this group.

Preemptible VM instances cost 60–80% less than equivalent on-demand pricing, making them the most economical choice for fault-tolerant batch workloads. Compute Engine can terminate these instances at any time (up to 24 hours after start), so the nightly batch job must be designed to resume or restart gracefully. Since the job runs nightly and can likely be reattempted, preemptible instances are the ideal cost-saving option.

No local session state means any server can handle any user's request. Add an instance and it's immediately useful; remove one and no user loses their session. This is the foundation of horizontal cloud scalability.

Per-second billing on Compute Engine means the charge is calculated for exactly 227 seconds (3 minutes and 47 seconds) of compute time. While there is a 1-minute minimum for many VM types, this workload exceeds that minimum, so the billed duration equals the actual runtime. No hourly or by-minute rounding is applied, making this the correct and precisely accurate option.

AlloyDB is PostgreSQL-compatible with 4x faster transactions and built-in AI capabilities.

Google Kubernetes Engine (GKE) is a managed Kubernetes service that fully handles the control plane—including the API server, scheduler, and etcd—and optionally the node infrastructure via Autopilot mode, which abstracts node pools and cluster management while exposing the full Kubernetes API. GKE delivers the complete Kubernetes object model (Deployments, Services, StatefulSets, Ingress, ConfigMaps, persistent volumes) enabling declarative deployment, service discovery, auto-scaling, and rolling updates for interdependent microservices. It also integrates deeply with Google Cloud's ecosystem, such as Cloud Load Balancing, Cloud Monitoring, Workload Identity, and multi-cluster gateways, providing the custom networking, storage, and scheduling control that the scenario demands.

Cloud Run is a fully managed serverless container platform that automatically scales instances from zero, handles load balancing and security, and requires no cluster or node management. Developers can deploy any stateless container and pay only for the CPU and memory used during requests, making it the best fit for a fully managed deployment without infrastructure operations.

This is the correct and standard procedure for requesting a quota increase. The IAM & Admin > Quotas page displays all project-level quotas, allowing you to select a specific metric (e.g., Compute Engine vCPU) and click "Edit Quotas" to submit an increase request. If the requested increase falls within the pre-approved limits, it is granted automatically; otherwise, it routes to Google Cloud support for review. This self-service workflow is the only documented way to raise quota limits and is directly accessible from the Cloud Console without opening a support ticket.

This exactly describes IaC + GitOps. Terraform configurations in Git provide repeatability (same config → same infrastructure) and auditability (Git history shows every change, who made it, and when). This is a foundational cloud operations best practice.

Firebase is a Backend-as-a-Service platform purpose-built for mobile and web apps. It bundles Firebase Authentication, Cloud Firestore (which automatically syncs data to mobile clients and works offline), Cloud Functions for serverless logic, and Firebase Hosting—all with minimal configuration. The client SDKs handle real-time updates, offline persistence, and authentication state, so the team can launch fast without managing servers or backend infrastructure.

Terraform blueprints from the Cloud Foundation Toolkit are production-ready, opinionated Infrastructure-as-Code modules that bake in Google Cloud best practices for networking, IAM, logging, and monitoring. When combined with organization policies (constraints that enforce guardrails at the organization level) and custom Terraform that provisions landing zones, every new project starts in a fully pre-configured, compliant state. This approach enforces the golden path automatically: teams inherit secure defaults without needing to manually configure resources, and any departure from standards requires an intentional exemption. This is the only option that operationalizes standards at scale, making the path the path of least resistance.

This is the correct CEO-level business case because it directly ties cloud adoption to measurable business outcomes: faster innovation cycles shorten time-to-market, which is a competitive advantage. Shifting from capital expenditure to operating expense, plus eliminating overprovisioning and datacenter overhead, reduces total cost of ownership. Access to managed AI/analytics services (e.g., BigQuery, Vertex AI) lets the company build data-driven products without massive upfront ML infrastructure investment. These three pillars—speed, cost, and new capabilities—are what drive board-level decisions, unlike purely tactical IT points.

Creating a replica in another Cloud Region using Cloud Storage and Cloud SQL replicas is the correct DR approach because it uses fully managed, native cross-region replication. Cloud Storage regional buckets can be replicated to another region via Object Lifecycle Management or by using dual-region buckets, while Cloud SQL provides built-in cross-region read replicas with automated failover. This solution minimizes RTO/RPO by continuously copying data and enabling promotes to primary during a regional outage, all without manual intervention or upfront infrastructure costs.

FCM is the correct service. It provides the complete push notification pipeline: device token management, message composition, cross-platform delivery (Android via FCM protocol, iOS via APNs), delivery analytics, and topic-based message broadcasting for millions of subscribers. It's the standard Google/Firebase solution for mobile push notifications.

roles/pubsub.publisher is the correct predefined role because it contains only the permissions required to publish messages to a topic, primarily pubsub.topics.publish. It also includes pubsub.topics.get for metadata, but it does not grant any subscription management or administrative capabilities. This matches the principle of least privilege by providing exactly the needed actions and nothing more.

Cloud Storage hosts static files directly, supports bucket configuration for website endpoints, and can be fronted by Cloud CDN for global low-latency delivery. There are no virtual machines or application servers; you pay only for stored bytes and network egress, and the service scales seamlessly from zero to high traffic without management overhead.

Enabling Object Versioning preserves noncurrent versions of objects each time an object is overwritten or deleted, meaning a mistaken deletion leaves the prior version intact and recoverable. A bucket retention policy in Google Cloud Storage enforces a mandatory minimum retention duration, blocking any deletion attempt—even by an administrator—until that period has elapsed. Together, they ensure that accidental deletion can be undone via version history and that the data cannot be permanently purged before a safe recovery window.

The cloud provider is entirely responsible for all physical security controls within its data centers, including perimeter protections, biometric access systems, guards, CCTV, and environmental safeguards like fire suppression and cooling. This is one of the clearest divisions in the shared responsibility model: customer responsibilities begin at the hypervisor and workloads, not at the physical layer. The provider also monitors hardware integrity and manages the lifecycle of servers to prevent tampering, ensuring the physical foundation for customer workloads.

This is precisely digital transformation. The manufacturing company isn't just automating existing tasks — it's creating a new decision-making capability (proactive 8-week predictions vs. reactive shortage responses) that wasn't possible before cloud-scale ML. The competitive advantage created is qualitatively new.

Cloud Armor is Google Cloud's web application firewall (WAF) that filters HTTP/HTTPS traffic at the edge before it reaches your application. Its pre-configured WAF rules along with custom expressions block common web exploits such as SQL injection, cross-site scripting, and OWASP Top 10 threats. It also supports IP reputation lists, geo-blocking, and DDoS mitigation, delivering real-time protection for public web applications.

This correctly identifies the transformation as digitizing an error-prone manual process into a real-time, automated visibility platform. By leveraging cloud-based data pipelines, APIs, and notification services, the company fundamentally changes how customers interact with shipments—proactively receiving updates instead of requesting them. This operational overhaul directly improves customer experience and creates a scalable model for service delivery, which is the root of the measured satisfaction gain.

The subscription model converts one-time license purchases into predictable monthly or annual recurring revenue (MRR/ARR), improving financial forecasting and lowering per-sale friction. Continuous delivery is enabled by cloud infrastructure and automated release pipelines, allowing the vendor to ship features, fixes, and security updates regularly without re-licensing or manual distribution. Because customers are on an ongoing contract, the vendor gains real-time usage data and structured feedback loops, deepening relationships through account management, tier upgrades, and value-driven engagement.

Vertex AI is the correct choice because it is Google Cloud's unified platform for building, training, and deploying ML models at scale. It provides a custom training service where you can launch training jobs with your own code, containers, and hardware accelerator configurations, and it manages compute clusters and automatically handles node provisioning. It also offers persistent online prediction endpoints, batch prediction, and integration with Vertex AI Pipelines for orchestration, making it ideal for a data scientist who needs full control.

Unifying customer data from disparate silos into a single 360-degree view platform fundamentally changes the customer service workflow: agents now have real-time context about the customer's history, preferences, and prior interactions. This is a business process transformation because it changes how employees perform their work, and a customer experience transformation because it enables faster, more personalized service. It goes beyond IT modernization by driving new operational capabilities and outcomes, not just replacing technology.

Cloud IoT Edge runs on local gateway devices (e.g., industrial gateways, Raspberry Pi) and performs data preprocessing, filtering, aggregation, and even local ML inference before sending only essential data to the cloud. This reduces the volume and frequency of data transmitted over possibly poor or high-latency connectivity, which directly lowers end-to-end latency for decisions made at the edge. It also enables real-time responses even if the cloud is temporarily unreachable, making it the correct approach for latency-sensitive IoT deployments.

Cloud Load Balancing uses a single anycast IPv4/IPv6 address to route traffic via Google's global network to the closest region with available backend capacity, enabling global load distribution. Cloud CDN then caches static and dynamic content at over 100 edge locations worldwide, drastically reducing latency and offloading requests from the origin. The global external HTTP(S) load balancer automatically handles failover across regions, scales to millions of QPS, and integrates with CDN for cacheable content — making this the correct choice for a global web app.

This is the strategic argument. 'Undifferentiated heavy lifting' — the operational work common to every company running that software — is what managed services absorb. No company's competitive advantage comes from being better at PostgreSQL patch management; it comes from the applications and insights built on top of databases. Managed services free teams for that differentiated work.

Cloud Transcoder auto-scales, and Cloud Storage lifecycle moves old files to cheaper tiers, optimizing cost.

Domain Restricted Sharing is the correct control. It's an org policy constraint that makes it impossible to add external users (gmail.com accounts or accounts from other Google Cloud organizations) to any IAM policy in the organization. This prevents accidental or intentional sharing of resources outside the company's domain.

Configuring a log sink with a Cloud Storage bucket in a central project is the recommended pattern for long-term, cross-project log aggregation. Log sinks can be defined at the organization, folder, or project level with `includeChildren` set, automatically routing all matching log entries from every child project into a single Cloud Storage bucket, which provides durable, low-cost, and immutable object storage. Combined with lifecycle policies to transition logs to colder storage classes, this minimizes cost while satisfying audit and retention requirements.

Public cloud computing, exemplified by Google Cloud, provides on-demand compute, storage, and networking via shared, multitenant infrastructure owned and operated by the provider. Customers use a pay-as-you-go model, paying only for metered usage, which converts traditionally capital expenditures (servers, racks, power) into operating expenses. This eliminates upfront hardware procurement, maintenance, and capacity planning, allowing a startup to scale globally with no capital investment. It directly fulfills the requirement to reduce CapEx on hardware.

IaaS provides virtualized compute resources (e.g., Compute Engine) where the customer selects the OS image, manages OS patches, and has full administrative control, including kernel tuning. This allows the legacy application to run with its required OS version and dependencies. Google only manages the physical hardware and hypervisor, not the guest OS. Thus IaaS is the right choice.

Cloud SQL with read replicas is the correct choice because Cloud SQL is a fully managed relational database (MySQL, PostgreSQL, or SQL Server) that provides strong consistency for reads and writes. Read replicas are asynchronous replicas of the primary instance that can serve read traffic, and this allows you to scale read capacity without downtime or architectural changes. Replicas can be promoted to primary if the original fails, and the SQL interface aligns naturally with most mobile backend APIs, making it a simple, cost-effective solution for a read-heavy workload.

Security Command Center is Google Cloud's native security and risk management platform, aggregating asset inventory, vulnerability findings, misconfiguration detections, threat event data, and compliance violations across every project in an organization. It automatically evaluates each resource against CIS and PCI-DSS benchmarks and surfaces actionable findings in a unified dashboard, making it the definitive single pane of glass for cloud security posture.

This is the SRE-aligned answer. Toil elimination is a core SRE value. The math: 10 hours/month saved, 160 hours invested → 16 month payback. But the more important point is that automation eliminates the toil permanently and scales with service growth, while manual toil grows proportionally. SREs should invest in eliminating toil even with moderate payback periods.

Google Cloud purchases renewable energy equal to 100% of the electricity consumed by its global data center operations, meaning the operational carbon emissions from a customer's workloads are effectively offset. This match is applied at the corporate level and covers all regions, so a workload running on Google Cloud has a near-zero market-based carbon footprint attributable to electricity. Consequently, this is the only option that directly addresses the company's actual carbon footprint at the infrastructure layer.

Cloud Armor is a managed edge security service that works directly with external HTTP(S) load balancers to protect applications from DDoS attacks and web-based threats. It provides a customizable Web Application Firewall (WAF) with OWASP Top 10 rules, IP allow/deny lists, rate limiting, IP reputation filters, and geography-based access control, making it the appropriate choice for blocking malicious traffic and enforcing regional access policies on a global web application.

Enabling CMEK on a Cloud SQL instance lets you associate a customer-managed key from Cloud KMS with the instance at creation time. You can rotate the key in Cloud KMS by creating a new key version and setting it as the primary version; Cloud SQL automatically uses the new primary version without reconfiguring the instance. This gives you full control over key lifecycle and rotation, meeting the requirement.

The Viewer role at the project level is a predefined IAM role that grants read-only access to all resources and configurations within that project, including metadata, permissions, and runtime states, while preventing any modification or deletion. This makes it the ideal choice for a third-party auditor because it provides comprehensive visibility with zero write capability, adhering to the principle of least privilege. It is the correct answer because it fully satisfies the review requirement without exposing any administrative control.

Labels are the correct mechanism for key-value metadata in Google Cloud. They are explicitly designed to organize and track resources—for example, attaching entries like "cost-center: engineering" or "environment: production" to virtual machines, disks, and storage buckets. Labels integrate directly with billing export and Cloud Monitoring, enabling cost allocation and filtering, which precisely matches the stated requirement.

This is the comprehensive approach. Disabling the Workspace identity immediately invalidates all active OAuth tokens and prevents new sign-ins — all GCP access based on that identity stops instantly. Auditing for service account keys they created closes the remaining gap (keys are separate credentials not tied to the user account).

Resource pooling is one of the five essential characteristics in NIST SP 800-145. It means the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where physical and virtual resources are dynamically assigned and reassigned according to consumer demand. A critical aspect is location independence: consumers generally have no control or knowledge over the exact resource location, but they may be able to specify at a higher level of abstraction, such as country, state, or datacenter. This pooling enables economies of scale and is foundational to cloud's flexibility.

Attaching a dedicated service account to the Compute Engine instance is the recommended keyless approach. The metadata server automatically provides OAuth2 access tokens to the instance, so the application code can implicitly use the attached identity to authenticate to Google Cloud APIs. Granting only the required IAM roles on the bucket (e.g., Storage Object Viewer) follows least privilege, and because no private key ever leaves Google's infrastructure, credential rotation and expiry are handled automatically by the platform.

Cloud CDN is the correct service because it leverages Google's globally distributed edge points of presence to cache content in close proximity to end users. By reducing the number of round trips back to the origin, it significantly lowers latency and offloads origin traffic. Cloud CDN works with HTTPS load balancing and can use Cloud Storage as its origin, making it ideal for delivering e-commerce site content globally.

Applying committed use discounts (CUDs) at the project or folder level allows you to aggregate usage across multiple projects under one commitment. This ensures that all eligible Compute Engine resources in those scopes receive the discounted rate, preventing situations where separate per-project commitments underutilize purchased capacity. It also simplifies management by enabling centralized procurement and automatic application to matching resource types, thereby reducing overall compute costs.

Cloud Run is a fully managed serverless platform that executes stateless containers and automatically scales from zero to handle each incoming request. For a legacy monolith, you can package it as a container and deploy without managing servers, with built-in request-driven autoscaling and pay-per-use billing. It supports any language and integrates with Cloud SQL for your persistent data, making it the lowest-operational-overhead option for a migrate-to-containers strategy.

Cloud Run is the correct choice because it abstracts away all infrastructure and Kubernetes concepts: you deploy a container image, and Cloud Run runs it in a fully managed, autoscaled execution environment. It scales to zero when idle, so you pay for only the exact duration of requests or instances during active traffic. This gives you container portability and common HTTP API support without the operational burden of GKE or the runtime lock-in of App Engine.

Preemptible VMs on Compute Engine are the right choice for a nightly batch process because they are up to 80% cheaper than standard VMs, which directly reduces operational cost for a recurring, interruptible workload. Since batch jobs are inherently fault-tolerant—they can be checkpointed or simply rerun from the start—the risk of preemption is acceptable, and Google Cloud automatically restarts the VM if capacity is available. For a simple scheduled job, a preemptible VM is a low-complexity, high-savings solution.

This is the correct approach. Per day: 16 × 10 = 160 VM-hours (normal) + 8 × 50 = 400 VM-hours (peak) = 560 VM-hours. Fixed: 50 × 24 = 1,200 VM-hours. Autoscaling uses 53% fewer VM-hours. Pricing Calculator gives the $/VM-hour to calculate actual dollar savings.