GCDL Practice Questions

Question 1

An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?

Accepted Answer

VPC Service Controls with an access level that includes the IP range. VPC Service Controls can restrict access based on IP addresses via access levels. IAP is for user authentication. Cloud Armor is for HTTP(S) load balancing. Firewall rules apply to network traffic, not API access to Cloud Storage.

Answer

Cloud Armor security policy

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Question 2

A financial services firm must comply with PCI DSS and wants to run workloads on Google Cloud. They need to isolate their production environment from development and enforce granular access controls. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls and IAM. Google Cloud's VPC Service Controls enable isolation of sensitive data in a VPC perimeter, while IAM provides granular access controls. Together they help meet compliance requirements.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Cloud VPN

Question 3

A finance team needs to analyze detailed cost data across multiple projects, including resource-level breakdowns, labels, and cost attribution. They want to export this data to a BigQuery dataset for custom analysis. Which billing export option should they enable?

Accepted Answer

Enable billing export to BigQuery (standard usage cost data). Standard billing export to a BigQuery dataset provides detailed cost data with resource-level items, labels, and cost breakdowns. It is the recommended method for granular analysis.

Answer

Use the Cloud Billing API to pull cost data programmatically

Answer

Set up a budget alert with notifications to Pub/Sub and ingest into BigQuery

Answer

Enable billing export to Cloud Storage in CSV format

Question 4

A security engineer wants to block malicious traffic patterns at the edge of Google's network before it reaches their application. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is a web application firewall (WAF) and DDoS protection service that works with Cloud Load Balancing to filter traffic based on IP addresses, geo-location, and Layer 7 attributes. Cloud CDN caches content, Cloud DNS resolves domain names, and VPC firewall rules protect at the instance level, not at the edge.

Answer

VPC firewall rules

Answer

Cloud DNS

Answer

Cloud CDN

Question 5

A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow creating perimeters that restrict access to Google Cloud services to trusted VPCs and IP ranges.

Answer

VPC firewall rules

Answer

Cloud Armor

Answer

IAM conditions

Question 6

An organization wants to use Google Cloud for processing healthcare data subject to HIPAA regulations in the United States. Which contractual document must the organization obtain from Google before storing Protected Health Information (PHI) in Google Cloud?

Accepted Answer

A Business Associate Agreement (BAA), which is legally required by HIPAA before any covered entity can process Protected Health Information with a cloud provider. Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Answer

A Non-Disclosure Agreement (NDA) to prevent Google from disclosing the existence of the healthcare application

Answer

A Data Processing Agreement (DPA) as required under GDPR for European data subjects

Answer

An ISO 27001 certificate issued by Google Cloud demonstrating information security compliance

Question 7

An operations team tracks the following metrics for their customer portal: request latency p99, error rate, and requests per second. In Site Reliability Engineering terminology, what are these metrics called, and what do they collectively define?

Accepted Answer

Service Level Indicators (SLIs), which measure specific dimensions of service behavior from the user's perspective and collectively define how reliability is quantified. In Site Reliability Engineering (SRE), the metrics p99 latency, error rate, and requests per second are classified as Service Level Indicators (SLIs). SLIs are carefully chosen quantitative measures of specific aspects of the service's behavior, such as availability, latency, or throughput, as experienced by the end user. Collectively, these SLIs define how reliability is quantified and are used to set and monitor Service Level Objectives (SLOs).

Answer

Key Performance Indicators (KPIs) that define the overall health of the business

Answer

Service Level Agreements (SLAs), defining the contractual commitments made to customers

Answer

Operational metrics that are only relevant to the infrastructure team and not to business stakeholders

Question 8

A company is moving a regulated workload to Google Cloud and must ensure that their encryption keys are stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3 validation. Which Google Cloud key management option satisfies this requirement?

Accepted Answer

Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules. Cloud HSM is the correct choice because it provides a dedicated HSM service that stores and manages encryption keys in FIPS 140-2 Level 3 validated hardware security modules. This directly meets the regulatory requirement for a hardware security module with that specific validation level, as opposed to software-backed or customer-supplied key options.

Answer

Cloud KMS software-backed keys, which are managed by Google and stored in Google's secure key management infrastructure

Answer

Customer-supplied encryption keys (CSEK), where the customer provides the key with each API request

Answer

Secret Manager, which stores API keys and credentials with automatic rotation

Question 9

A company's security architect wants to implement 'privacy by design' principles when building a new customer data platform on Google Cloud. What does privacy by design mean in this context?

Accepted Answer

Privacy by design means privacy protections (encryption, data minimization, access controls, retention policies) are architected into the system from the start, not added after deployment.. Privacy by design is a foundational principle that requires embedding privacy controls—such as encryption, data minimization, access controls, and retention policies—into the architecture of a system from the initial design phase, rather than retrofitting them after deployment. In the context of Google Cloud, this means using services like Cloud KMS for encryption, IAM for fine-grained access control, and data lifecycle policies to minimize data collection and enforce retention limits from the start. Option B correctly captures this proactive, integrated approach.

Answer

Privacy by design means the platform must refuse to collect any personal data from customers.

Answer

Privacy by design is a legal requirement that mandates using only on-premises systems for customer data.

Answer

Privacy by design means storing all data in an encrypted format and using a VPN for all access.

Question 10

A developer needs to store application secrets (database passwords, API keys, OAuth tokens) securely so that they are not hardcoded in source code or environment variables. The secrets should be automatically versioned and rotatable. Which Google Cloud product is designed for this secure secrets management requirement?

Accepted Answer

Secret Manager, which stores secrets encrypted at rest with automatic versioning, rotation support, and fine-grained IAM access control. Secret Manager is Google Cloud's dedicated service for storing application secrets such as database passwords, API keys, and OAuth tokens. It provides encryption at rest using AES-256, automatic versioning (each new secret version is immutable and timestamped), and built-in rotation support via scheduled rotation policies. Fine-grained IAM roles (e.g., roles/secretmanager.secretAccessor) ensure least-privilege access without exposing secrets in source code or environment variables.

Answer

Cloud Storage, by storing secrets in an encrypted bucket with restricted IAM access

Answer

Cloud KMS, which generates encryption keys for encrypting application data

Answer

Cloud SQL, by storing secrets in an encrypted database table with restricted access

Question 11

An architect is evaluating whether to use a relational database or a NoSQL database for a new application that must store product catalog data. Products have highly variable attributes — a book has ISBN, author, and genre; a bicycle has frame size, wheel diameter, and material. Which database characteristic makes NoSQL document databases advantageous for this use case?

Accepted Answer

NoSQL document databases support flexible schemas where each document can have different fields — making them well-suited for product catalogs where different product types have different attributes. NoSQL document databases, such as MongoDB, store data in flexible, schema-less documents (often JSON or BSON). This allows each document to have a different set of fields, making them ideal for product catalogs where a book and a bicycle have entirely different attributes (e.g., ISBN vs. frame size). Relational databases require a predefined schema with fixed columns, forcing you to either create many sparse columns or use complex join tables to handle variable attributes.

Answer

NoSQL databases always provide faster query performance than relational databases for all use cases

Answer

NoSQL databases support ACID transactions better than relational databases, making them safer for product catalog updates

Answer

NoSQL databases are simpler to query because they don't require learning SQL

Question 12

A cloud operations team wants to ensure that all cloud resources created in their Google Cloud organization comply with company naming standards and required cost allocation labels. Which Google Cloud capability can automatically enforce these standards on resource creation?

Accepted Answer

Organization Policy Service with custom constraints or required label policies that prevent resource creation if naming and label standards are not met. Organization Policy Service with custom constraints or required label policies is correct because it provides a preventive control that blocks resource creation if the resource does not meet defined naming and label standards. This is enforced at the Google Cloud resource hierarchy level before any resource is provisioned, ensuring compliance automatically without relying on post-creation detection or manual processes.

Answer

Cloud Billing reports, which flag resources missing required labels after they are created

Answer

Cloud Monitoring alerts that notify the team when non-compliant resources are detected

Answer

Cloud IAM roles that only grant resource creation permissions to employees who have passed a naming standards training

Question 13

A company's DevOps team wants to orchestrate a complex workflow that involves calling multiple Google Cloud APIs in sequence — first running a Cloud Build job, then checking the results, then either deploying to Cloud Run or sending a notification. Which Google Cloud product is designed for orchestrating multi-step workflow logic?

Accepted Answer

Google Cloud Workflows, which orchestrates multi-step processes by calling APIs in sequence with conditional logic, error handling, and state management. Google Cloud Workflows is the correct choice because it is a fully managed orchestration platform specifically designed to define multi-step workflows that call Google Cloud APIs and external services in sequence. It supports conditional logic (e.g., if-then-else), error handling (e.g., retries with exponential backoff), and state management, making it ideal for the described scenario of running a Cloud Build job, checking results, and conditionally deploying to Cloud Run or sending a notification.

Answer

Cloud Scheduler, which triggers a series of jobs at specified cron intervals

Answer

Cloud Pub/Sub, by publishing messages between pipeline stages to trigger each subsequent step

Answer

Cloud Run, by writing the orchestration logic as a container application that calls other services sequentially

Question 14

A data engineering team needs to build a pipeline that reads event data from Pub/Sub in real time, applies transformations and aggregations, and writes results to BigQuery — all without managing any infrastructure. Which Google Cloud product is designed for this serverless stream and batch data processing use case?

Accepted Answer

Cloud Dataflow, Google Cloud's serverless stream and batch data processing service built on Apache Beam. Cloud Dataflow is Google Cloud's fully managed, serverless service for both stream and batch data processing, built on Apache Beam. It directly reads from Pub/Sub, applies transformations and aggregations using the Beam SDK, and writes the results to BigQuery without requiring any infrastructure management, making it the correct choice for this use case.

Answer

Cloud Composer, Google Cloud's managed Apache Airflow service for workflow orchestration

Answer

Cloud Dataproc, Google Cloud's managed Spark and Hadoop service

Answer

BigQuery directly, using streaming inserts to load Pub/Sub data in real time

Question 15

An SRE team is practicing 'chaos engineering' by simulating a zone-level failure in their staging environment. They find that their application does not automatically recover — traffic is not redirected and the service remains down. What architectural component is most likely missing?

Accepted Answer

A load balancer with health checks across multiple zones is most likely missing — without it, there is no mechanism to detect the zone failure and automatically redirect traffic to healthy instances in surviving zones. In a zone-level failure, traffic cannot be redirected to healthy instances in surviving zones without a load balancer that performs health checks across multiple zones. Google Cloud's external or internal load balancers (e.g., HTTP(S) Load Balancer, TCP/UDP Network Load Balancer) use health checks to detect unhealthy instances and automatically route traffic only to healthy backends. Without this component, the application has no mechanism to detect the zone failure and reroute traffic, leaving the service down.

Answer

The application needs more replicas in the failing zone to survive the failure

Answer

The application needs a larger machine type to handle the full traffic load without the failed zone's capacity

Answer

Cloud Monitoring alerts need to be configured to notify the team when a zone fails, enabling manual traffic redirection

Google Cloud Digital Leader GCDL practice test

Three ways to study

Study GCDL by domain

Study GCDL by topic

How Google Cloud Resources Are Managed practice questions

Why Cloud Technology Can Transform Business practice questions

Fundamental Cloud Concepts practice questions

Google Cloud Security practice questions

Google Cloud Products and Services practice questions

Why cloud technology is transforming business practice questions

Google Cloud products, services, and solutions practice questions

Scaling with Google Cloud operations practice questions

Trust and security with Google Cloud practice questions

GCDL fundamentals practice questions

GCDL scenario practice questions

GCDL troubleshooting practice questions

Google Cloud Digital Leader practice questions

How to use these GCDL questions

Quick answer