Google Cloud Digital Leader (GCDL) — Questions 901–975

Anthos provides a consistent platform across on-premises and cloud. Cloud VPN or Cloud Interconnect can connect on-prem to Google Cloud. Secret Manager is for secrets; Cloud Run is serverless; BigQuery is analytics but does not enable hybrid architecture.

BigQuery is a serverless data warehouse that stores petabytes and uses SQL with fast query performance via columnar storage and separation of compute and storage.

Organization policies can enforce constraints on labels. Using a custom organization policy, you can require that certain labels be present on resources within a folder. This is done via the 'constraints/gcp.resourceLabels' constraint.

This illustrates that cloud infrastructure adoption without changing software delivery practices provides limited agility benefits. Cloud's agility potential is unlocked by complementary practices: CI/CD pipelines, automated testing, trunk-based development, and feature flags that enable continuous delivery. Quarterly release cycles with manual testing create the same bottleneck regardless of whether the infrastructure is on-premises or in the cloud.

Public cloud offers pay-as-you-go pricing, on-demand scaling, and no upfront hardware costs, ideal for unpredictable workloads. Private and hybrid models typically involve capital expenditure.

Cloud CDN with global external HTTP(S) load balancing is the most suitable solution because it caches static and dynamic content at edge locations worldwide, reducing latency for users across multiple continents. The global load balancer provides anycast IP addresses that route traffic to the nearest healthy backend, while Cloud CDN serves cached content directly from the edge, minimizing round-trip time and improving page load times.

Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Cloud Spanner is the only Google Cloud database that provides globally distributed, strongly consistent relational data with a 99.999% SLA.

Option A is correct because it directly addresses the retailer's goal of sensing market trends earlier and responding faster. Real-time analytics on social media, search trends, and purchase signals enable early detection of emerging preferences, while cloud-integrated supply chain APIs allow for rapid product launches by automating and accelerating the procurement and production processes. This combination of sensing and response capabilities is the most direct enabler of competitive advantage in trend-responsive retail.

Security Command Center for vulnerability scanning and threat detection, Chronicle for SIEM and incident response, and Mandiant for threat intelligence and forensic investigation.

BeyondCorp Enterprise is Google's zero-trust security model that allows access based on identity and context, without VPNs.

Option A is correct because the `gcp.resourceLocations` organization policy constraint explicitly restricts the physical location where Google Cloud resources can be created. By setting this policy to allow only EU regions, the organization ensures that no compute, storage, or database resources can be provisioned outside the EU, directly enforcing GDPR data residency requirements. This policy is evaluated at resource creation time and applies to all projects under the organization, providing a hard enforcement boundary.

Cloud Dataflow is the correct choice because it is a fully managed, serverless service designed specifically for stream and batch data processing. It uses Apache Beam as its programming model, enabling you to apply transformations, filter events, and write results to BigQuery in real-time, exactly matching the described pipeline requirements.

Pub/Sub for ingestion allows event replay (by setting a subscription's retention), and Dataflow for stream processing handles real-time transformations and writes to BigQuery.

Organization policies applied at the organization node are inherited by all folders and projects under it. This is the most efficient way to enforce a blanket restriction across the entire resource hierarchy.

Database Migration Service (DMS) supports continuous migration from Oracle to Cloud Spanner with minimal downtime using change data capture (CDC).

Worker-2 and worker-4 are preemptible (spot) instances, which are significantly cheaper than standard instances. The job can be interrupted and resume from the last checkpoint, so preemptible instances are suitable. This combination minimizes cost while meeting the 2-hour completion requirement because preemptible instances have a maximum runtime of 24 hours and can be terminated earlier, but the checkpointing allows the job to complete within the 2-hour window even if interrupted.

Secret Manager is designed for storing secrets like API keys and passwords, with built-in rotation and integration with Cloud KMS for CMEK.

NIST's five essential characteristics of cloud computing are: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. 'On-demand self-service' specifically describes the ability for users to provision capabilities automatically without provider interaction — using a web console or API to spin up VMs, databases, or storage instantly, without calling a salesperson or waiting for manual provisioning.

Cloud Build is the correct service because it is Google Cloud's fully managed CI/CD platform that can automatically build, test, and deploy code from a repository. For Cloud Run services, Cloud Build can trigger builds on code changes, run tests, and then deploy the container image directly to Cloud Run using a cloudbuild.yaml configuration file.

Archive storage is the lowest-cost storage class for long-term retention, with a 365-day minimum storage duration and higher retrieval costs.

Option A is correct because a GAUGE metric type represents a point-in-time value (e.g., current number of items), not a cumulative counter. To calculate a rate (items per second), you need a CUMULATIVE counter metric that monotonically increases, allowing Cloud Monitoring to compute the derivative over time. GAUGE metrics lack the necessary monotonicity and cumulative semantics, so they cannot be used to derive a meaningful rate of change.

Cloud Storage is Google Cloud's fully managed, scalable object storage service designed for unstructured data such as images, videos, backups, and documents. It offers high durability (99.999999999% annual durability) and global accessibility via a unified namespace, making it the correct choice for storing large volumes of unstructured data at any scale.

A preventive control (org policy custom constraint requiring the label) stops future non-compliant resources. A detective/corrective control (Cloud Asset Inventory + Cloud Functions or Security Command Center) finds and remediates existing unlabeled resources. Both are needed for comprehensive enforcement.

Cloud Armor is a web application firewall (WAF) that provides DDoS protection and security rules to protect applications distributed across Google Cloud. Cloud CDN accelerates content, Cloud NAT provides outbound internet access, and VPC is for virtual networking.

Google Cloud Workflows is the correct choice because it is a fully managed orchestration platform specifically designed to define multi-step workflows that call Google Cloud APIs and external services in sequence. It supports conditional logic (e.g., if-then-else), error handling (e.g., retries with exponential backoff), and state management, making it ideal for the described scenario of running a Cloud Build job, checking results, and conditionally deploying to Cloud Run or sending a notification.

Cloud CDN uses Google's global edge cache to deliver content with low latency. Cloud DNS provides fast, reliable DNS resolution. Cloud Load Balancing distributes traffic but does not cache content; Cloud Armor is for security; Cloud Interconnect is for hybrid connectivity.

Cloud External Key Manager (Cloud EKM) is the correct approach because it allows you to manage encryption keys in an external key management system, such as an on-premises HSM, while using those keys to encrypt data at rest in Google Cloud. This meets the requirement of storing the key in the on-premises HSM, as Cloud EKM integrates with supported external key management partners or directly with your HSM via a key management proxy, ensuring that Google Cloud never has direct access to the raw key material.

The correct order is: instance group, health check, backend service, URL map, then target proxy and forwarding rule.

Cloud Armor provides WAF and DDoS protection, including IP blacklisting/whitelisting, rate limiting, and custom rules. Cloud CDN caches content, Cloud NAT provides outbound connectivity, and VPC Firewall rules are for network-level filtering inside VPC.

Option C (Dataproc Serverless with Spark job) is correct because it provides a fully managed, serverless execution environment for running custom Java transformations on large datasets (10 TB) without provisioning or managing clusters. Dataproc Serverless automatically scales resources based on the job's needs, minimizing operational overhead while supporting Spark jobs that can read from Cloud Storage and write results to BigQuery.

Access Transparency logs provide detailed records of Google personnel access to customer data, including reason and scope.

Admin Activity audit logs record all changes to IAM policies and other configuration changes in Google Cloud. By combining these logs with Cloud Monitoring log-based alerting, the security team can create a specific alert that triggers whenever an IAM policy is modified by a principal with administrative permissions, enabling real-time detection of unauthorized changes.

Option B is correct because a blameless postmortem is a core SRE practice that focuses on documenting incidents, root causes, and preventive actions without assigning individual blame. Google's SRE culture emphasizes this to foster psychological safety, enabling teams to openly share failures and drive systemic improvements, which is essential for maintaining high reliability in large-scale distributed systems.

Measured service is a key characteristic of cloud computing as defined by NIST (SP 800-145). It means that cloud systems automatically control and optimize resource usage by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). This allows both the provider and consumer to monitor, control, and report usage, providing transparency for billing and chargeback.

Access Transparency logs provide detailed records of actions taken by Google personnel on customer data, enabling customers to monitor and approve such access.

App Engine is a fully managed PaaS that abstracts the underlying infrastructure, allowing developers to focus solely on code. Cloud Run requires container images, Compute Engine requires full OS management, and GKE requires cluster management.

Archive storage class is the correct choice because it is designed for data accessed less than once a year, with the lowest storage cost among Google Cloud storage classes. The customer's requirement of retaining data for 10 years with infrequent access aligns perfectly with Archive's 365-day minimum storage duration and retrieval costs that are higher but acceptable given the rare access pattern.

Monoliths are simpler to develop, test, and deploy initially but scale as a unit and create tight coupling — a change to one part requires deploying the whole application. Microservices enable independent deployment and scaling of components but introduce distributed systems complexity (network calls, service discovery, distributed tracing, eventual consistency). Neither is universally better — the trade-off depends on team size, domain complexity, and operational maturity.

Option D is correct because an SLI (Service Level Indicator) is defined as the ratio of good events to total events, which directly measures the proportion of successful requests over a 30-day window. This aligns with the requirement to track request success rate, not just system uptime. In Google Cloud operations, SLOs are built on SLIs that count discrete events like HTTP 200 responses versus all requests.

BeyondCorp Enterprise provides zero-trust access based on user identity and device context, eliminating the need for a VPN. IAP is a component but the full solution is BeyondCorp Enterprise.

When a retailer migrates from owning and maintaining its own data centers to using a public cloud, it shifts from a capital expenditure (CapEx) model—where it buys servers and pays for facilities upfront—to an operational expenditure (OpEx) model, where it pays for cloud services as a recurring, usage-based cost. This change eliminates large upfront hardware investments and replaces them with predictable monthly or consumption-based billing, aligning costs directly with actual demand.

Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

CUDs require a commitment of 1 or 3 years and provide a discount in exchange. They apply to specific resource usage like vCPUs and memory.

Cloud Functions can be triggered by Pub/Sub messages. The functions scale automatically based on the number of messages, and they are stateless and short-lived.

Binary Authorization is correct because it enforces deployment-time policy validation, ensuring that only container images signed by trusted authorities (e.g., via KMS) are allowed to run in GKE. This prevents the deployment of untrusted or tampered images, directly addressing supply chain security.

Google Cloud matches 100% of its global electricity consumption with renewable energy and aims for 24/7 carbon-free energy by 2030.

Compute Engine provides IaaS, allowing full control over the OS and application stack, including custom patches and configurations.

Cloud Billing Budgets and Alerts (D) allows you to define a spending threshold and receive notifications when costs approach or exceed that limit. Cloud Monitoring (E) can ingest those budget alert events and trigger additional actions, such as sending notifications via email, SMS, or Pub/Sub, or integrating with incident management tools. Together, they provide a complete cost monitoring and alerting solution.

Organization Policy Service constraints, specifically `compute.vmExternalIpAccess` and `compute.requireOsLogin` or custom constraints for labels, are evaluated at resource creation time. They block non-compliant VM creation before the API call succeeds, enforcing policies like 'no external IPs' and 'required labels' without relying on post-creation detection or IAM permissions.

In Site Reliability Engineering (SRE), the metrics p99 latency, error rate, and requests per second are classified as Service Level Indicators (SLIs). SLIs are carefully chosen quantitative measures of specific aspects of the service's behavior, such as availability, latency, or throughput, as experienced by the end user. Collectively, these SLIs define how reliability is quantified and are used to set and monitor Service Level Objectives (SLOs).

BigQuery is a serverless data warehouse that scales to petabytes and uses SQL for analytics. Cloud SQL is for OLTP, Cloud Storage is object storage, and Dataflow is for data processing pipelines.

Persistent Disk Snapshots are the correct Google Cloud feature for creating point-in-time backups of Persistent Disks. They capture the disk's data and configuration at a specific moment, allowing you to restore the disk or create new disks from that snapshot. This is the native, recommended method for backup and disaster recovery of Compute Engine VM disks.

Firestore is a NoSQL document database designed for mobile apps, with real-time sync and offline support. Cloud SQL and Spanner are relational, not ideal for hierarchical data. Bigtable is for time-series/analytics, not mobile app data.

First create and prepare the bucket, then set up a load balancer, enable CDN, and test.

VPC Service Controls create perimeters around managed services to restrict access to only allowed VPC networks.

Option D is correct because it leverages the Cloud Healthcare API to ingest and standardize data from disparate on-premises databases into a unified format, stores it in BigQuery for serverless ad-hoc querying, and uses BigQuery ML to build predictive models without managing infrastructure. This fully meets HIPAA compliance through built-in data residency and access controls, while the small IT team avoids hardware procurement and maintenance overhead.

Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. They are ideal for fault-tolerant, batch workloads.

BigQuery is Google Cloud's serverless, highly scalable data warehouse specifically designed for petabyte-scale analytical SQL queries. It separates compute from storage and uses a columnar storage format and a distributed query engine to execute complex SQL on massive datasets without provisioning infrastructure, making it the ideal choice for the described workload.

Persistent Disk provides durable block storage with consistent performance attached to a single VM. Local SSDs are ephemeral and not suitable for stateful data.