Google Cloud Digital Leader GCDL Questions 76–150 | Page 2/7

MCQhard

An SRE team analyzes that their service had 47 minutes of downtime in the past 30 days. Their SLO is 99.9% monthly availability. How should the team characterize their performance relative to the SLO?

A.The SLO was met because 47 minutes is less than 1 hour of downtime per month

B.The SLO was missed: 99.9% availability allows approximately 43.2 minutes of downtime in a 30-day month, so 47 minutes exceeded the error budget by about 3.8 minutes

C.The SLO cannot be evaluated because downtime minutes are not the correct unit for measuring availability

D.The SLO was met with margin because 47 minutes represents less than 0.5% downtime

AnswerB

The math: 30 days × 24 hours × 60 minutes = 43,200 minutes. 0.1% × 43,200 = 43.2 minutes allowed downtime. 47 minutes actual > 43.2 minutes allowed → SLO missed by ~3.8 minutes. The error budget is exhausted and the team should prioritize reliability work.

Why this answer

The SLO of 99.9% monthly availability allows a maximum downtime of 43.2 minutes in a 30-day month (30 days × 24 hours × 60 minutes × 0.001 = 43.2 minutes). Since the actual downtime was 47 minutes, the error budget was exceeded by 3.8 minutes, meaning the SLO was missed. This calculation is standard for Google Cloud SRE practices, where error budgets are derived directly from the SLO percentage.

Exam trap

Google Cloud often tests the precise calculation of error budgets from SLO percentages, trapping candidates who round or assume common approximations (like 1 hour per month) instead of computing the exact allowed downtime.

How to eliminate wrong answers

Option A is wrong because it incorrectly assumes a fixed 1-hour threshold; the correct error budget for 99.9% availability over 30 days is 43.2 minutes, not 60 minutes. Option C is wrong because downtime minutes are the correct unit for measuring availability when the SLO is expressed as a percentage of uptime over a defined period. Option D is wrong because 47 minutes represents approximately 0.11% downtime (47 / 43,200), not less than 0.5%, and the SLO was missed, not met with margin.

Full explanation →

MCQhard

A media streaming company runs its video transcoding pipeline on Google Cloud. The pipeline uses Compute Engine instances with GPU accelerators to process videos. The instances are started and stopped by a custom scheduler based on a Cloud Pub/Sub queue of new video uploads. Recently, the team noticed that transcoding jobs are failing intermittently with 'Out of memory' errors on some instances, and the overall cost has increased by 30% over the past month. The operations team reports that the same job configurations used to succeed before. The pipeline does not use any managed instance groups or autoscaling; each job provisions its own instance manually via a script. The company wants to reduce failures and costs. Which course of action should they take?

A.Move the transcoding pipeline to Cloud Functions to automatically scale without VM management

B.Increase the memory of all instances to 64 GB and manually select GPU types with more memory

C.Switch all instances to preemptible VMs to reduce cost, and increase the number of retry attempts for failed jobs

D.Use a managed instance group with custom autoscaling based on CPU/memory utilization and implement a queue-based scaling metric

AnswerD

Autoscaling ensures right-sized instances are used, reducing failures and costs.

Why this answer

Option D is correct because using a managed instance group (MIG) with custom autoscaling based on CPU/memory utilization and a queue-based scaling metric (e.g., Cloud Pub/Sub queue depth) addresses both the intermittent 'Out of memory' errors and the cost increase. The MIG automatically provisions and terminates instances based on actual workload, preventing resource over-provisioning (which drives cost) and under-provisioning (which causes OOM failures). This eliminates the manual, static instance provisioning that cannot adapt to varying job resource requirements.

Exam trap

The trap here is that candidates assume increasing resources (Option B) or using cheaper VMs (Option C) will solve the problem, but Cisco tests the understanding that intermittent failures in a batch processing pipeline are often due to lack of dynamic scaling, not static resource sizing or cost alone.

How to eliminate wrong answers

Option A is wrong because Cloud Functions has a maximum timeout of 9 minutes (for HTTP functions) and 540 seconds (for background functions), which is insufficient for video transcoding jobs that often run for hours; also, Cloud Functions does not support GPU accelerators, which are required for the pipeline. Option B is wrong because blindly increasing memory to 64 GB and selecting GPU types with more memory does not address the root cause of intermittent failures (likely due to resource contention or mis-sized instances) and will significantly increase costs, not reduce them. Option C is wrong because switching to preemptible VMs reduces cost but increases failure rates due to preemption (VMs can be terminated at any time within 24 hours), and simply increasing retry attempts does not fix the underlying OOM errors caused by insufficient memory for the job.

Full explanation →

MCQmedium

A company is evaluating whether to use a public cloud (Google Cloud), a private cloud (on-premises VMware), or a managed private cloud (hosted single-tenant environment). Which scenario is the strongest argument for choosing a managed private cloud over a public cloud?

A.The company wants to pay less for cloud services.

B.The company has regulatory requirements that mandate physically dedicated (single-tenant) infrastructure or strict hardware-level isolation.

C.The company wants the fastest possible internet speeds for their applications.

D.The company has fewer than 10 employees and doesn't need multi-tenant scale.

AnswerB

Some highly regulated industries (defense, certain financial regulations, healthcare in some jurisdictions) require dedicated hardware. Managed private cloud provides this while still outsourcing operations.

Why this answer

Option B is correct because a managed private cloud (hosted single-tenant) provides physically dedicated infrastructure that ensures hardware-level isolation, which is often required by strict regulatory standards such as HIPAA, PCI-DSS, or FedRAMP. Public clouds like Google Cloud typically use multi-tenant architectures where multiple customers share the same physical hardware, which may not satisfy these compliance mandates. The key differentiator is the guarantee of dedicated physical resources, not just logical isolation.

Exam trap

Google Cloud often tests the misconception that 'private cloud' always means on-premises, but the trap here is that a managed private cloud is hosted off-premises yet still provides single-tenant hardware isolation, which is the key differentiator from public cloud multi-tenancy.

How to eliminate wrong answers

Option A is wrong because managed private clouds are generally more expensive than public clouds due to dedicated hardware and management overhead, so cost reduction is not a valid argument. Option C is wrong because internet speed is determined by the company's ISP and network connectivity, not by the cloud deployment model; public clouds often have faster global network backbones. Option D is wrong because a small company with fewer than 10 employees would typically benefit from the lower cost and scalability of a public cloud, not the higher cost and overhead of a managed private cloud.

Full explanation →

MCQmedium

A cloud team performs a quarterly review of its Compute Engine instances and discovers 15 VMs that have had zero CPU utilization for over 90 days. What is the recommended operational response to these idle resources?

A.Leave the VMs running in case they are needed for future workloads — storage costs are minimal for idle VMs

B.Investigate whether each VM is still needed; delete confirmed unused VMs to eliminate wasted spend, potentially saving thousands per month

C.Upgrade the idle VMs to larger machine types so they can handle future workloads if needed

D.Apply committed use discounts to the idle VMs to reduce their cost while keeping them available

AnswerB

This is the correct operational response. Investigate first (some may have legitimate low-utilization purposes like DR standby), then delete confirmed waste. 15 idle VMs can represent significant ongoing cost that stops immediately upon deletion. Cloud's on-demand model means these can be re-created if needed.

Why this answer

Option B is correct because the recommended operational response to idle Compute Engine instances is to investigate their necessity and delete them if unused. Idle VMs with zero CPU utilization for over 90 days incur ongoing costs for persistent disks, static IPs, and other attached resources, even if the CPU is idle. Deleting confirmed unused VMs eliminates this wasted spend, potentially saving thousands per month, aligning with Google Cloud's cost optimization best practices.

Exam trap

The trap here is that candidates may assume idle VMs have negligible cost, overlooking the ongoing charges for persistent disks and static IPs, or mistakenly think committed use discounts are a catch-all cost-saving measure for any VM.

How to eliminate wrong answers

Option A is wrong because leaving idle VMs running incurs costs for attached persistent disks, static IPs, and other resources, which are not minimal; storage costs for boot disks and additional disks can accumulate significantly over time. Option C is wrong because upgrading idle VMs to larger machine types would increase costs without addressing the underlying waste, as the VMs are not being utilized. Option D is wrong because applying committed use discounts (CUDs) to idle VMs locks in a 1- or 3-year commitment for resources that are not needed, increasing financial risk and negating the cost-saving purpose of CUDs, which are intended for steady-state workloads.

Full explanation →

Multi-Selecteasy

Which THREE of the following are traditional IT constraints that cloud technology helps businesses overcome?

Select 3 answers

A.Increased security risks from public connectivity

B.Managing hardware refresh cycles and end-of-life

C.Accurate capacity planning to avoid over- or under-provisioning

D.Limited ability to serve customers in remote geographical areas

E.Compliance with industry regulations

AnswersB, C, D

Cloud providers handle hardware maintenance and upgrades.

Why this answer

Option B is correct because cloud providers manage the underlying hardware, including regular refresh cycles and end-of-life replacements, which eliminates the need for businesses to invest capital in new servers or storage arrays. This shifts the burden of hardware lifecycle management from the customer to the provider, reducing operational overhead and ensuring access to up-to-date infrastructure.

Exam trap

Google Cloud often tests the misconception that cloud technology eliminates all security risks or compliance burdens, when in fact it shifts the responsibility model and requires careful configuration by the customer.

Full explanation →

MCQmedium

A media company stores video files, images, and static website assets that must be served globally with low latency. They want an object storage solution that is highly durable, accessible via standard HTTPS, and can be configured to make specific assets publicly accessible. Which Google Cloud storage product is most appropriate?

A.Cloud Storage, Google Cloud's object storage for unstructured data accessible via HTTPS with configurable public access

B.Filestore, Google Cloud's managed NFS file storage service

C.Persistent Disk, Google Cloud's block storage for virtual machine instances

D.Cloud SQL, Google Cloud's managed relational database service

AnswerA

Cloud Storage is exactly right for this use case. It stores unstructured data (videos, images, static files) with 11 nines durability, serves objects via HTTPS, supports public/private access control at the bucket and object level, and integrates with Cloud CDN for global low-latency delivery.

Why this answer

Cloud Storage is Google Cloud's object storage service designed for unstructured data such as video files, images, and static website assets. It provides global accessibility via standard HTTPS, offers 99.999999999% (11 9's) durability, and supports granular access control through IAM and ACLs, allowing specific assets to be made publicly accessible. This directly matches all the requirements in the question.

Exam trap

Cisco often tests the distinction between object storage (Cloud Storage), file storage (Filestore), and block storage (Persistent Disk), and the trap here is assuming any storage service can serve content over HTTPS with public access, whereas only Cloud Storage is designed for that purpose.

How to eliminate wrong answers

Option B (Filestore) is wrong because it is a managed NFS file storage service for shared file systems, not object storage, and it does not natively serve content over HTTPS or support public access configuration for individual assets. Option C (Persistent Disk) is wrong because it is block storage attached to virtual machine instances, designed for use as VM disks, not for serving content globally over HTTPS with public access controls. Option D (Cloud SQL) is wrong because it is a managed relational database service for structured data, not an object storage solution, and cannot serve files or static assets over HTTPS.

Full explanation →

MCQeasy

A retail company needs to handle sudden spikes in customer traffic during holiday promotions without over-provisioning hardware. Which cloud characteristic directly enables this capability?

A.Load balancing

B.High availability

C.Elasticity

D.Disaster recovery

AnswerC

Elasticity enables automatic scaling of resources to match demand, key for handling traffic spikes.

Why this answer

Elasticity is the cloud characteristic that allows resources to automatically scale up or down in response to demand. For a retail company handling sudden traffic spikes, elasticity ensures compute and network capacity dynamically adjusts without manual intervention or over-provisioning, directly matching the workload in real time.

Exam trap

Google Cloud often tests the distinction between elasticity and scalability, where candidates mistakenly choose load balancing or high availability because they associate traffic spikes with distribution or redundancy rather than dynamic resource adjustment.

How to eliminate wrong answers

Option A is wrong because load balancing distributes traffic across existing resources but does not automatically add or remove those resources; it manages distribution, not capacity scaling. Option B is wrong because high availability ensures uptime and fault tolerance through redundancy, but it does not inherently adjust resource quantity to meet variable demand. Option D is wrong because disaster recovery focuses on restoring operations after a failure, not on dynamically adapting to traffic spikes.

Full explanation →

MCQmedium

A data engineering team needs to orchestrate a complex data pipeline that involves multiple steps: extracting data from various sources, transforming it with Dataflow, loading it into BigQuery, and running validation jobs — all in a specific sequence with retry logic and scheduling. Which Google Cloud service manages this workflow orchestration?

A.Cloud Scheduler — cron-based job scheduling.

B.Cloud Composer (managed Apache Airflow)

C.Cloud Dataflow — stream and batch processing.

D.Cloud Functions — event-driven function execution.

AnswerB

Cloud Composer orchestrates complex multi-step workflows as DAGs. It handles scheduling, step dependencies, retries, and provides a Airflow UI for monitoring pipeline runs.

Why this answer

Cloud Composer is a managed Apache Airflow service that provides workflow orchestration, including dependency management, retry logic, and scheduling for complex pipelines. It allows you to define a DAG (Directed Acyclic Graph) that sequences tasks like Dataflow extraction, BigQuery loading, and validation jobs, with built-in retry and scheduling capabilities.

Exam trap

Google Cloud often tests the distinction between a scheduler (Cloud Scheduler) and a full orchestrator (Cloud Composer), where candidates mistakenly choose Cloud Scheduler because they see 'scheduling' in the question, ignoring the need for retry logic and multi-step dependency management.

How to eliminate wrong answers

Option A is wrong because Cloud Scheduler is a cron-based job scheduler that triggers individual tasks at specified times, but it lacks native support for complex workflow dependencies, retry logic, or multi-step orchestration. Option C is wrong because Cloud Dataflow is a data processing service for stream and batch transformations, not a workflow orchestrator; it cannot manage sequencing or retries across multiple services. Option D is wrong because Cloud Functions is an event-driven compute service for executing single-purpose functions, not designed to orchestrate multi-step pipelines with dependencies and retry logic.

Full explanation →

MCQhard

A company uses Cloud Functions (2nd gen) to process events from Pub/Sub. During traffic spikes, function instances scale but latency increases. They want to maximize throughput per instance. What should they configure?

A.Increase the concurrency setting.

B.Allocate more memory.

C.Increase the max instances limit.

D.Increase the function timeout.

AnswerA

Concurrency controls how many requests are handled by a single instance; higher concurrency increases throughput per instance.

Why this answer

Increasing the concurrency setting allows each Cloud Functions (2nd gen) instance to handle multiple requests simultaneously, maximizing throughput per instance during traffic spikes. By default, concurrency is 1, meaning each instance processes one event at a time; raising this value enables parallel processing within a single instance, reducing the need to scale out and lowering latency.

Exam trap

Google Cloud often tests the misconception that scaling out (max instances) or increasing resources (memory) is the primary way to handle throughput, when the key to per-instance efficiency is concurrency tuning.

How to eliminate wrong answers

Option B is wrong because allocating more memory increases CPU power and instance performance, but it does not directly increase the number of events processed concurrently per instance; throughput gains are limited by the single-threaded default. Option C is wrong because increasing the max instances limit allows more instances to be created, which helps with scaling out but does not improve throughput per individual instance—it may even increase latency due to cold starts. Option D is wrong because increasing the function timeout extends the maximum execution duration for a single event, but does not enable parallel processing or improve per-instance throughput; it only prevents premature termination of long-running functions.

Full explanation →

MCQmedium

A company's finance director asks: 'If we move to cloud, do we need to buy fewer servers?' An IT architect responds that the answer depends on whether the company is adopting IaaS, PaaS, or SaaS. How does the service model affect hardware ownership?

A.All three models (IaaS, PaaS, SaaS) require the same amount of customer-owned hardware since cloud supplements rather than replaces on-premises systems

B.In all three models, the cloud provider owns and manages the physical hardware, eliminating the need for customer-owned servers for those workloads — with IaaS requiring the most customer management (VMs) and SaaS requiring the least (just use the application)

C.Only SaaS eliminates the need for customer servers; IaaS and PaaS still require on-premises hardware for hybrid connectivity

D.The service model doesn't affect hardware ownership — hardware purchase decisions are independent of whether the company uses cloud services

AnswerB

This is correct. In all three models, the provider owns the physical hardware — the customer buys no servers. The difference is how much software infrastructure the customer manages on top: IaaS → manage VMs; PaaS → manage application code; SaaS → just use the product. All three eliminate customer hardware ownership for covered workloads.

Why this answer

Option B is correct because in IaaS, PaaS, and SaaS, the cloud provider owns and manages the physical hardware in their data centers. The customer's hardware ownership decreases as the service model abstracts more layers: IaaS provides virtual machines (VMs) that the customer manages, PaaS provides a managed platform (runtime, middleware) without customer control over the underlying OS or hardware, and SaaS delivers a fully managed application where the customer only uses the software. Thus, moving to any of these models reduces or eliminates the need for customer-owned servers for those specific workloads.

Exam trap

Cisco often tests the misconception that IaaS still requires on-premises servers for hybrid connectivity or that PaaS requires customer hardware, when in fact all three models shift physical hardware ownership to the cloud provider, and the difference lies in the level of customer management, not hardware ownership.

How to eliminate wrong answers

Option A is wrong because it incorrectly claims all three models require the same amount of customer-owned hardware; in reality, each model shifts hardware ownership to the provider to varying degrees, with SaaS eliminating it entirely for the workload. Option C is wrong because it falsely states that only SaaS eliminates the need for customer servers; both IaaS and PaaS also offload physical hardware ownership to the provider, though IaaS may still require customer-managed VMs and PaaS may require some configuration, but neither requires on-premises servers for the cloud-hosted workloads. Option D is wrong because the service model directly affects hardware ownership: IaaS, PaaS, and SaaS each define different levels of abstraction and responsibility, which determines whether the customer must own physical servers or can rely entirely on provider-managed infrastructure.

Full explanation →

MCQhard

A mid-sized company runs a legacy inventory management system on a single on-premises server. The system uses a monolithic Java application and a PostgreSQL database. The server has reached 90% CPU usage during business hours, and the database is 800 GB. The company wants to migrate to Google Cloud to take advantage of autoscaling and reduce hardware costs. The migration must have minimal downtime and the application cannot be significantly rewritten. The team also wants to enable future scalability for peak seasons. The IT team includes experienced database administrators but limited application development resources. Given the constraints, which approach should the team take?

A.Containerize the entire monolithic application and deploy it on Google Kubernetes Engine with a persistent volume for the database, with horizontal pod autoscaling.

B.Use Database Migration Service to migrate the PostgreSQL database to Cloud SQL with continuous replication for minimal downtime. Simultaneously, rehost the application on a managed instance group with autoscaling. Have a rollback plan.

C.Use Database Migration Service to migrate the PostgreSQL database to Cloud SQL with a one-time dump and restore, and rehost the application on a single Compute Engine instance.

D.Refactor the monolithic application into microservices, deploy on Cloud Run, and use Cloud Spanner for the database.

AnswerB

Continuous replication minimizes downtime, MIG provides autoscaling, and rollback plan ensures safety.

Why this answer

Option B is correct because it combines Database Migration Service with continuous replication (CDC) to achieve near-zero downtime for the 800 GB PostgreSQL database, while rehosting the monolithic application on a managed instance group with autoscaling to address CPU spikes without code changes. This approach respects the constraint of limited app development resources by avoiding refactoring, and the rollback plan provides safety during migration.

Exam trap

Google Cloud often tests the misconception that containerization (GKE) is always the best path to scalability, but here the constraints (no rewrite, limited dev resources) make rehosting on MIGs with Database Migration Service the pragmatic choice, not the most architecturally 'modern' one.

How to eliminate wrong answers

Option A is wrong because containerizing the monolithic app on GKE with a persistent volume for the database does not address the database migration to a managed service, and GKE adds operational complexity (e.g., cluster management, networking) that contradicts the limited app development resources constraint; also, persistent volumes do not provide the autoscaling or managed backup benefits of Cloud SQL. Option C is wrong because using a one-time dump and restore for an 800 GB database will cause significant downtime (hours to days), violating the minimal downtime requirement, and rehosting on a single Compute Engine instance does not enable autoscaling for peak seasons. Option D is wrong because refactoring the monolithic application into microservices requires significant application rewrite, which contradicts the constraint that the application cannot be significantly rewritten, and Cloud Spanner is overkill for a legacy PostgreSQL workload and introduces higher cost and complexity.

Full explanation →

MCQeasy

Google Cloud runs its own infrastructure operations using the Site Reliability Engineering (SRE) model, which Google invented. What is the core principle that distinguishes SRE from traditional IT operations?

A.SRE teams never allow production deployments to ensure maximum stability.

B.SRE applies software engineering principles to operations — automating toil, using quantitative SLOs, and treating reliability as an engineered system property.

C.SRE relies entirely on external monitoring vendors to detect and respond to all incidents.

D.SRE means development and operations teams are separate departments that communicate only via ticketing systems.

AnswerB

SRE (Google's operational model) uses software to automate repetitive work, measures reliability with SLOs/error budgets, and gives engineers ownership of the full system lifecycle — distinguishing it from traditional reactive IT ops.

Why this answer

Option B is correct because the core principle of SRE is applying software engineering practices to operations work. This means automating manual toil, defining quantitative Service Level Objectives (SLOs) to measure reliability, and treating reliability as an engineered property of the system — not as an afterthought. This contrasts with traditional IT operations, which often rely on manual processes and reactive troubleshooting.

Exam trap

Cisco often tests the misconception that SRE is just a rebranding of traditional IT operations or that it prohibits deployments entirely; the trap here is assuming SRE is purely about stability at the expense of innovation, when in fact it uses error budgets to balance both.

How to eliminate wrong answers

Option A is wrong because SRE teams do allow production deployments; they use error budgets to balance reliability with feature velocity, not to block all changes. Option C is wrong because SRE relies on internal monitoring and alerting (e.g., using Stackdriver or Prometheus) and on-call rotations, not on external vendors for incident detection and response. Option D is wrong because SRE breaks down silos between development and operations; SRE teams work closely with development teams, often using shared ownership and common tooling, not ticketing systems as the primary communication channel.

Full explanation →

MCQhard

A company wants to expose its internal backend services to external partners through a managed API layer that handles authentication, rate limiting, traffic management, and analytics — without modifying the underlying services. Which Google Cloud product is designed for this API management use case?

A.Cloud Load Balancing, which distributes API requests across backend instances

B.Cloud Endpoints, a lighter-weight API gateway for Google Cloud-hosted APIs

C.Apigee, Google Cloud's full-featured enterprise API management platform for authentication, rate limiting, analytics, and developer portal without modifying backend services

D.Cloud Armor, Google Cloud's web application firewall and DDoS protection service

AnswerC

Apigee is the complete API management solution. Its proxy architecture sits in front of any backend service and adds authentication (OAuth, API keys), rate limiting, quota enforcement, traffic transformation, analytics, and a developer portal — with zero changes required to the backend services.

Why this answer

Apigee is Google Cloud's full-featured enterprise API management platform designed to expose backend services to external partners without requiring modifications to those services. It provides built-in authentication, rate limiting, traffic management, and analytics, along with a developer portal for partner onboarding. This makes it the correct choice for the described use case.

Exam trap

The trap here is that candidates confuse Cloud Endpoints (a lightweight option for Google Cloud-native backends) with Apigee (the enterprise platform for exposing any backend to external partners), missing the requirement for a developer portal and no backend modifications.

How to eliminate wrong answers

Option A is wrong because Cloud Load Balancing is a traffic distribution layer (Layer 4/7) that does not provide API-level authentication, rate limiting, or analytics; it only distributes requests across backends. Option B is wrong because Cloud Endpoints is a lighter-weight API gateway that requires the backend to be hosted on Google Cloud (e.g., Cloud Run, App Engine) and does not offer a developer portal or enterprise-grade analytics and rate limiting without additional configuration. Option D is wrong because Cloud Armor is a web application firewall and DDoS protection service that operates at the network/edge layer and does not handle API authentication, rate limiting, or analytics.

Full explanation →

MCQeasy

A company is comparing the total cost of keeping its data center versus moving to public cloud. An analyst argues that the comparison should include not just hardware costs but also facility costs. What facility costs should be included in the on-premises total cost of ownership calculation?

A.Only the cost of the servers themselves, since other costs are shared across the organization

B.Physical space/rent, electricity (for servers and cooling), cooling system maintenance, physical security, and fire suppression — all of which are real costs borne by the organization for operating its own data center

C.Internet connectivity costs only, since data centers require high-bandwidth connections

D.Data center facility costs do not need to be included since they are fixed costs that don't change whether servers are present or not

AnswerB

This is the complete set of facility costs. Power is often the largest ongoing cost after staff. Cooling typically adds 30-50% to the power cost of the IT equipment itself. Physical security and fire suppression add further costs. All must be included for an accurate TCO comparison against cloud.

Why this answer

Option B is correct because a comprehensive on-premises total cost of ownership (TCO) must include all facility-related costs that are directly incurred to operate a data center. These include physical space/rent, electricity for servers and cooling, cooling system maintenance, physical security, and fire suppression. Excluding these costs would understate the true cost of running an on-premises environment, which is a key consideration when comparing to public cloud models like IaaS.

Exam trap

Cisco often tests the misconception that facility costs are either negligible or shared overhead, when in fact they are direct, variable costs that must be included in a proper TCO analysis for on-premises versus cloud comparison.

How to eliminate wrong answers

Option A is wrong because it incorrectly limits facility costs to only the servers themselves; in reality, servers are hardware, not facility costs, and other costs like power and cooling are real, not shared arbitrarily. Option C is wrong because internet connectivity is a network cost, not a facility cost; while important, it is separate from the physical infrastructure costs of the data center itself. Option D is wrong because facility costs are not fixed regardless of server presence; they scale with the data center's operation and are directly attributable to the on-premises deployment, so they must be included for an accurate TCO comparison.

Full explanation →

MCQhard

Refer to the exhibit. A company configures a lifecycle policy on a Cloud Storage bucket. The bucket contains objects uploaded over the past year with custom time set on each object. After 60 days, what happens to the objects?

A.All objects older than 30 days from now are deleted.

B.Objects with custom time more than 30 days ago are deleted.

C.Objects are deleted after 30 days from the last access.

D.The lifecycle policy is invalid because custom time is not supported.

AnswerB

The condition uses daysSinceCustomTime, so objects are deleted when the time since custom time exceeds 30 days.

Why this answer

Option B is correct because the lifecycle policy uses the `customTime` attribute, and the rule is configured to delete objects when `customTime` is older than 30 days. After 60 days from upload, objects with a `customTime` set at upload will have had that timestamp for 60 days, so they are more than 30 days past their `customTime` and are deleted. The policy does not use object age or last access time.

Exam trap

Google Cloud often tests the distinction between object age (creation time) and custom time, trapping candidates who assume lifecycle policies always use the object's creation date instead of the user-defined `customTime` attribute.

How to eliminate wrong answers

Option A is wrong because the lifecycle policy does not use the object's creation or upload time; it uses the `customTime` attribute, so objects are not deleted based on being older than 30 days from now. Option C is wrong because lifecycle policies in Cloud Storage do not support deletion based on last access time; they use conditions like age, creation date, or custom time. Option D is wrong because `customTime` is a fully supported metadata field in Cloud Storage lifecycle policies, allowing users to set a user-defined timestamp for deletion rules.

Full explanation →

MCQhard

A data analytics company uses BigQuery for large-scale queries. They notice that some queries are very expensive due to scanning large amounts of data. They want to reduce costs without changing query logic. Which feature should they use?

A.Query caching

B.Partitioning and clustering tables

C.Authorized views

D.Flat-rate pricing with reservations

AnswerB

Partitioning prunes partitions, clustering orders data; both reduce bytes processed.

Why this answer

Partitioning and clustering tables in BigQuery physically organize data into smaller, manageable segments based on specified columns (e.g., date or timestamp). This allows queries to use partition pruning and clustering-based block pruning to scan only the relevant data, drastically reducing the amount of data processed and thus lowering costs without altering the query logic.

Exam trap

Google Cloud often tests the misconception that cost reduction must come from changing pricing models (like flat-rate) rather than from data organization techniques that reduce the actual amount of data processed.

How to eliminate wrong answers

Option A is wrong because query caching only returns results from previously run queries if the underlying data hasn't changed, but it does not reduce the cost of new or uncached queries that scan large datasets. Option C is wrong because authorized views control access to underlying tables by allowing users to query through a view, but they do not reduce the amount of data scanned or the cost of the query itself. Option D is wrong because flat-rate pricing with reservations provides a fixed-cost capacity model that can make costs predictable, but it does not reduce the amount of data scanned per query; it only changes the billing method, and queries still process the same large volumes of data.

Full explanation →

MCQhard

An enterprise needs advanced business intelligence capabilities: governed semantic models that business users query with natural language, embedded analytics in their customer-facing application, and centralized data access controls. Which Google Cloud analytics product is purpose-built for these enterprise BI requirements?

A.Looker Studio (free BI dashboards)

B.Looker (enterprise BI platform with LookML semantic layer)

C.BigQuery — it provides natural language querying via BQML.

D.Vertex AI — it builds ML models that answer business questions.

AnswerB

Looker's LookML semantic model defines business metrics centrally. Business users explore data naturally; embedded analytics APIs allow customer-facing deployment; row/column-level security enforces data governance.

Why this answer

Looker is purpose-built for enterprise BI with its LookML semantic modeling layer, which governs data definitions and access controls. It supports natural language querying through Looker's 'Ask Looker' feature and enables embedded analytics via its API and SDK, directly matching the requirements for governed semantic models, natural language queries, and embedded analytics.

Exam trap

Cisco often tests the distinction between a BI platform with a semantic layer (Looker) and a data warehouse (BigQuery) or ML platform (Vertex AI), leading candidates to mistakenly choose BigQuery because it supports natural language queries, overlooking the need for governed semantic models and embedded analytics.

How to eliminate wrong answers

Option A is wrong because Looker Studio is a free, lightweight dashboarding tool that lacks a governed semantic layer (LookML), centralized data access controls, and native natural language querying—it is not designed for enterprise-grade BI governance. Option C is wrong because BigQuery is a data warehouse, not a BI platform; while it supports natural language queries via BigQuery ML (BQML) for ML model creation, it does not provide a semantic modeling layer or embedded analytics capabilities for customer-facing applications. Option D is wrong because Vertex AI is a machine learning platform for building and deploying ML models, not a BI tool; it does not offer semantic models, natural language querying for business users, or embedded analytics dashboards.

Full explanation →

MCQmedium

A developer is building a mobile backend that receives thousands of events per second from IoT devices. The events must be processed in real time and then stored for analysis. Which set of services should they use?

A.Cloud Pub/Sub -> Cloud Dataflow -> BigQuery

B.Cloud IoT Core -> Cloud Storage -> Dataproc

C.Cloud Pub/Sub -> Cloud Storage -> BigQuery

D.Cloud Pub/Sub -> Cloud Functions -> Cloud SQL

AnswerA

Pub/Sub for ingestion, Dataflow for stream processing, BigQuery for storage and analysis.

Why this answer

Option A is correct because Cloud Pub/Sub provides a scalable, fully managed message ingestion service for high-throughput event streams, Cloud Dataflow (based on Apache Beam) enables real-time stream processing with exactly-once semantics and low latency, and BigQuery offers a serverless data warehouse for fast analytical queries on the processed data. This combination handles the requirements of real-time processing and subsequent storage for analysis without operational overhead.

Exam trap

The trap here is that candidates confuse Cloud Storage as a real-time processing service (it is not—it is a durable object store for batch data) and overlook the need for a stream processing engine like Dataflow to handle real-time transformations before analysis.

How to eliminate wrong answers

Option B is wrong because Cloud IoT Core is a device management service, not a real-time event ingestion pipeline; Cloud Storage is an object store for blobs, not a streaming data sink, and Dataproc is a managed Hadoop/Spark service for batch processing, not real-time stream processing. Option C is wrong because while Cloud Pub/Sub can ingest events and Cloud Storage can store them, this path lacks a real-time processing step (like Dataflow) to transform or analyze events before storage, and BigQuery would query raw stored data without stream processing. Option D is wrong because Cloud Functions has a maximum timeout of 9 minutes and is designed for short-lived, event-driven compute, not for continuous high-throughput stream processing; Cloud SQL is a relational database not optimized for real-time event ingestion or analytical queries at scale.

Full explanation →

MCQmedium

Two competing retail companies adopt cloud at the same time. Company A uses cloud to run its existing applications more cheaply (lift-and-shift). Company B uses cloud to build new personalized customer experiences, real-time inventory optimization, and a mobile-first shopping platform. Five years later, Company B significantly outperforms Company A. What does this outcome illustrate?

A.Company B must have spent more on cloud than Company A, proving that higher cloud investment always produces better outcomes

B.Cloud adoption creates competitive advantage only when used to transform business models and customer experiences, not just to reduce infrastructure costs

C.Company A made a mistake by moving to cloud; it should have stayed on-premises to avoid disruption

D.Company B succeeded because it used a different cloud provider with superior technology

AnswerB

This is the lesson. Cloud as infrastructure cost reduction provides efficiency gains but doesn't create sustainable competitive differentiation — competitors can do the same thing at the same cost. Cloud as business transformation (new products, better experiences, new operating models) creates differentiation that compounds over time.

Why this answer

This scenario illustrates the critical distinction between cloud as cost reduction versus cloud as business enablement. Both companies 'adopted cloud,' but Company A treated it as infrastructure cost optimization (digitization) while Company B used it to fundamentally change customer experiences and business operations (digital transformation). The competitive divergence confirms that transformation, not mere migration, is the source of cloud's competitive value.

Full explanation →

MCQeasy

A startup wants to deploy a containerized web application without managing the underlying infrastructure. They want to only focus on code. Which Google Cloud service is most suitable?

A.Google Kubernetes Engine

B.Compute Engine

C.App Engine

D.Cloud Run

AnswerD

Cloud Run is a fully managed serverless platform for containers, abstracting infrastructure completely.

Why this answer

Cloud Run is the correct choice because it is a fully managed serverless platform that executes stateless containers in a request-driven environment, abstracting all infrastructure management. This allows the startup to focus solely on code by deploying container images directly from Artifact Registry or Container Registry, with automatic scaling down to zero when not in use.

Exam trap

The trap here is that candidates often confuse App Engine's automatic scaling with container support, overlooking that App Engine Standard requires specific language runtimes and does not accept arbitrary containers, while Cloud Run provides true container portability without infrastructure management.

How to eliminate wrong answers

Option A is wrong because Google Kubernetes Engine (GKE) requires managing a Kubernetes cluster, including node pools, networking, and scaling policies, which contradicts the requirement to avoid infrastructure management. Option B is wrong because Compute Engine provides virtual machines that demand manual provisioning, patching, and capacity planning, directly opposing the goal of focusing only on code. Option C is wrong because App Engine, while serverless, is a platform-as-a-service that restricts the runtime environment to specific supported languages and runtimes, whereas the startup explicitly wants to deploy a containerized application without such constraints.

Full explanation →

MCQeasy

A company is concerned about which security responsibilities belong to Google versus which belong to them when using Google Cloud's managed database service (Cloud SQL). In the shared responsibility model, which security tasks does Google handle?

A.Google controls who can access the database and what data can be stored.

B.Google handles physical security, hardware maintenance, and OS and database software patching.

C.Google is responsible for backing up customer data and ensuring data recovery.

D.Google determines which compliance certifications the customer's application must meet.

AnswerB

For managed services, Google manages the entire infrastructure layer: physical security, hardware, hypervisor, and service software updates. Customers manage their configuration and data.

Why this answer

In the shared responsibility model for Google Cloud services like Cloud SQL, Google is responsible for security 'of' the cloud, which includes physical security of data centers, hardware maintenance, and patching the underlying operating system and database software. This ensures the infrastructure hosting Cloud SQL instances is secure, while the customer remains responsible for securing their data, access policies, and application-level configurations.

Exam trap

The trap here is that candidates often confuse Google's responsibility for patching the database software (which Google handles) with the customer's responsibility for managing database access controls and backup configurations, leading them to incorrectly select options A or C.

How to eliminate wrong answers

Option A is wrong because Google does not control who accesses the database or what data is stored; those are customer responsibilities under IAM and data classification. Option C is wrong because while Google provides backup and recovery capabilities as a feature, the customer is responsible for configuring and enabling backups, and for verifying recovery procedures. Option D is wrong because Google does not determine which compliance certifications the customer's application must meet; the customer must assess their own compliance requirements and choose Google Cloud services that align with those certifications.

Full explanation →

Multi-Selectmedium

A site reliability engineer is implementing SRE practices in Google Cloud. Which TWO of the following are key principles of SRE? (Choose TWO.)

Select 2 answers

A.Using error budgets to balance reliability and feature velocity

B.Measuring everything with SLIs, SLOs, and SLAs

C.Automating manual tasks

D.Centralizing all operations in a single team

E.Deploying changes only during maintenance windows

AnswersA, C

Error budgets allow teams to innovate while maintaining reliability.

Why this answer

Option A is correct because error budgets are a core SRE principle that define the acceptable level of failure (e.g., 99.9% uptime allows 0.1% errors). This budget is used to balance the tension between releasing new features (velocity) and maintaining system reliability, allowing teams to halt deployments when the budget is exhausted.

Exam trap

Google Cloud often tests the distinction between SRE principles (like error budgets and automation) versus supporting practices (like SLIs/SLOs), leading candidates to mistakenly select measurement tools as principles.

Full explanation →

MCQeasy

A CEO presents a strategic plan to 'move everything to the cloud.' The board asks what business outcome should be the primary measure of success for the cloud migration. Which answer best reflects a business-outcome-oriented approach to measuring cloud migration success?

A.The percentage of applications successfully migrated to cloud infrastructure

B.Measurable business improvements such as reduced time-to-market for new products, lower infrastructure costs, and improved customer satisfaction enabled by cloud capabilities

C.The number of cloud certifications earned by the IT team during the migration

D.Achieving 100% elimination of on-premises infrastructure by the end of the first year

AnswerB

Business-outcome-oriented success measures tie the migration directly to value creation: faster launches generate revenue, cost reduction improves margins, and customer satisfaction metrics capture whether the investment is working. These are the metrics that matter to the board.

Why this answer

Option B is correct because it ties cloud migration success directly to measurable business outcomes, such as reduced time-to-market, lower infrastructure costs, and improved customer satisfaction. This aligns with the GCDL principle that cloud technology is a business enabler, not just an IT project. A business-outcome-oriented approach ensures that migration efforts are evaluated by their impact on strategic goals, such as agility and cost efficiency, rather than technical milestones.

Exam trap

Google Cloud often tests the distinction between technical metrics and business outcomes, trapping candidates who confuse project completion (e.g., percentage migrated) with actual business value (e.g., cost savings or agility improvements).

How to eliminate wrong answers

Option A is wrong because it measures a technical milestone (percentage of applications migrated) rather than a business outcome; simply moving applications to the cloud does not guarantee improved business performance or value. Option C is wrong because cloud certifications earned by the IT team are a measure of skill development, not a direct business outcome; certifications do not reflect whether the migration has improved operational efficiency or customer experience. Option D is wrong because achieving 100% elimination of on-premises infrastructure by a fixed deadline prioritizes a technical target over business value; a rushed migration can lead to service disruptions, cost overruns, and missed opportunities to optimize cloud-native capabilities.

Full explanation →

MCQhard

A large enterprise runs a critical application on Google Cloud consisting of Compute Engine instances behind a TCP load balancer. The application experiences intermittent slow response times that last for about 10 minutes before returning to normal. This pattern has been occurring every few days at random times. The operations team has configured Cloud Monitoring alerts for CPU and memory, but no alerts have fired. They have also reviewed the load balancer logs and see no errors, but the latency spikes. The application logs show no errors during these periods. The team suspects a resource bottleneck but cannot find it. Further investigation reveals that the application makes synchronous calls to an external authentication service for each request. What is the most likely cause and corrective action?

A.The TCP load balancer is experiencing connection draining issues; switch to a proxy-based load balancer.

B.The instance group's autoscaler is configured with a cooldown period that is too long; reduce the cooldown period.

C.The application is making synchronous calls to an external authentication service that occasionally has latency spikes; implement caching and asynchronous processing.

D.The virtual machine instances are suffering from CPU throttling due to sustained use of burstable CPU; move to a machine type with more CPUs.

AnswerC

External dependency latency is a common cause of intermittent slowdowns, and caching or async processing can mitigate it.

Why this answer

The intermittent latency spikes lasting ~10 minutes, with no errors in application or load balancer logs and no CPU/memory alerts, point to an external dependency issue. The synchronous calls to the external authentication service are the likely bottleneck: if that service experiences transient latency, every request is blocked, causing the application's response time to spike. Caching authentication tokens and using asynchronous processing (e.g., a queue or background refresh) decouples the application from the external service's variability, eliminating the cascading latency.

Exam trap

Google Cloud often tests the misconception that all latency originates from internal infrastructure (load balancers, autoscalers, or CPU), when the real cause is an external dependency's synchronous call pattern that creates a hidden bottleneck without triggering resource alerts.

How to eliminate wrong answers

Option A is wrong because TCP load balancers do not have connection draining issues that cause intermittent latency spikes; connection draining is a feature for graceful shutdown, not a source of random latency, and switching to a proxy-based load balancer would not fix an external dependency problem. Option B is wrong because the autoscaler's cooldown period affects scaling decisions, not the latency of individual requests; if CPU/memory are not spiking, autoscaling is irrelevant, and a long cooldown would cause slow scaling, not 10-minute latency bursts. Option D is wrong because CPU throttling from burstable machine types would trigger CPU utilization alerts and would not produce latency spikes without CPU or memory alerts; the pattern of random 10-minute spikes with no resource alerts contradicts sustained CPU throttling.

Full explanation →

100

MCQeasy

Refer to the exhibit. A user receives this error when trying to copy an object from one bucket to another. What is the most likely cause?

A.The service account used does not have the required IAM permissions to copy objects.

B.The buckets are located in different regions and cross-region copy is not allowed.

C.The destination bucket has exceeded its storage quota.

D.The source bucket name is misspelled in the request.

AnswerA

The 403 error indicates access denied due to missing permissions.

Why this answer

The error when copying an object between buckets is most likely due to insufficient IAM permissions. In Google Cloud, the service account initiating the copy must have both `storage.objects.get` (to read the source object) and `storage.objects.create` (to write to the destination bucket) permissions. Without these, the operation fails with an access denied error, even if the buckets exist and are accessible.

Exam trap

Google Cloud often tests the misconception that cross-region copy is blocked by default, but in Google Cloud Storage, cross-region copies are allowed as long as IAM permissions are correct, making permissions the primary gatekeeper.

How to eliminate wrong answers

Option B is wrong because cross-region copy is fully supported in Google Cloud Storage; objects can be copied between buckets in different regions without restriction. Option C is wrong because exceeding the storage quota would cause a quota exceeded error, not a permissions-related error, and the error message shown is typical of access issues. Option D is wrong because a misspelled bucket name would result in a 'bucket not found' error (HTTP 404), not a permissions error.

Full explanation →

101

Matchingmedium

Match each Google Cloud networking concept to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Virtual Private Cloud – isolated network

Content delivery network for low-latency delivery

Distributes traffic across instances

Outbound internet for private instances

Dedicated connection between on-prem and GCP

Why these pairings

These are key networking components in Google Cloud.

Full explanation →

102

MCQeasy

A company uses Cloud Functions and notices that some functions are taking longer than expected. They want to identify which functions have the highest latency. What should they use?

A.Cloud Audit Logs

B.Error Reporting

C.Cloud Monitoring metrics

D.Cloud Logging queries

AnswerC

Cloud Monitoring collects metrics like execution time for Cloud Functions.

Why this answer

Cloud Monitoring metrics, specifically the 'execution_time' metric for Cloud Functions, provide the precise latency data needed to identify functions with the highest execution duration. Unlike logs or error reports, metrics are designed for numerical aggregation and can be used to create dashboards or alerts that rank functions by their p50, p95, or p99 latency values.

Exam trap

Google Cloud often tests the distinction between logs (Cloud Logging) and metrics (Cloud Monitoring), trapping candidates who think that because latency data appears in logs, querying logs is the correct method, when in fact metrics are the proper tool for numerical aggregation and ranking.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs record administrative actions and access to resources, not the execution duration of individual function invocations. Option B is wrong because Error Reporting is designed to capture and analyze exceptions and errors, not to measure performance metrics like latency. Option D is wrong because Cloud Logging queries can retrieve individual log entries that may contain execution times, but they are not optimized for aggregating and ranking latency across many functions; Cloud Monitoring metrics are purpose-built for this numerical analysis.

Full explanation →

103

MCQmedium

What is the most likely cause of the error?

A.The machine type is invalid

B.The zone is incorrect

C.The user lacks compute.instances.create permission

D.The project does not exist

AnswerD

The error indicates the project was not found.

Why this answer

The error occurs because the specified project does not exist in Google Cloud. When you attempt to create a compute instance using a project ID that is either mistyped, deleted, or never created, the API returns a 'project not found' error. This is a fundamental prerequisite check before any resource creation can proceed.

Exam trap

Google Cloud often tests the order of API validation steps — candidates mistakenly think permission errors come first, but Google Cloud validates project existence before checking IAM permissions.

How to eliminate wrong answers

Option A is wrong because an invalid machine type would produce a different error, such as 'Invalid machine type: [type]', not a project-level error. Option B is wrong because an incorrect zone would result in a 'zone does not exist' or 'zone not found' error, which is distinct from a project error. Option C is wrong because lacking compute.instances.create permission would return a 'Permission denied' or 'Forbidden' error, not a project not found error.

Full explanation →

104

MCQmedium

A media company currently licenses proprietary software for video editing that costs $50,000 per seat annually. They are considering a cloud-based SaaS alternative at $5,000 per seat annually. Beyond the licensing cost, which additional financial benefits should they consider when calculating total cost of ownership (TCO)?

A.Only the licensing cost difference ($45,000 per seat) matters for the financial comparison.

B.Eliminated hardware costs, reduced IT maintenance staff, no upgrade cycles, and freed facilities costs — all lowering the true on-premises TCO that should be compared against the SaaS subscription.

C.The SaaS option has an internet dependency risk that may cost more than the savings.

D.The vendor's market capitalization, since larger companies are more financially stable.

AnswerB

On-premises TCO includes hardware procurement/refresh, IT admin staff, software maintenance, facilities (power, cooling, space), and upgrade projects. Eliminating these hidden costs makes the SaaS TCO comparison far more favorable.

Why this answer

Option B is correct because the total cost of ownership (TCO) for on-premises software includes not just the licensing fee but also hardware acquisition, IT staff for maintenance, periodic upgrade costs, and physical facility expenses. By moving to a SaaS model, the company eliminates these variable costs, making the $5,000 per seat subscription a more accurate comparison against the fully-loaded on-premises TCO, which often exceeds the $50,000 license alone.

Exam trap

Cisco often tests the misconception that only direct licensing costs matter, ignoring the broader TCO components like hardware, staff, and facilities that make on-premises solutions more expensive than they appear.

How to eliminate wrong answers

Option A is wrong because it ignores the hidden costs of on-premises infrastructure (hardware, maintenance, upgrades, facilities) that are part of the true TCO, leading to an incomplete financial comparison. Option C is wrong because while internet dependency is a risk, it is not a direct financial benefit of the SaaS option; the question asks for additional financial benefits, not risks or drawbacks. Option D is wrong because vendor market capitalization is a measure of financial stability, not a direct cost or benefit in TCO calculation; it does not affect the per-seat cost comparison.

Full explanation →

105

MCQmedium

A retail company wants to build a recommendation engine that suggests products to customers based on their browsing history. The team has ML expertise but wants to use Google's pre-built ML infrastructure to train and deploy models at scale without managing compute resources. Which Google Cloud service should they use?

A.BigQuery ML

B.Vertex AI

C.Cloud AI Platform Notebooks (now Vertex AI Workbench)

D.Cloud Dataflow

AnswerB

Vertex AI is Google's unified ML platform with managed training (GPU/TPU clusters), AutoML, model registry, feature store, and serving endpoints. Teams bring ML expertise; Vertex AI handles infrastructure.

Why this answer

Vertex AI is the correct choice because it provides a fully managed, unified ML platform that handles the entire ML workflow—from data preparation and training to deployment and monitoring—without requiring the team to manage underlying compute infrastructure. It integrates with Google Cloud's pre-built ML infrastructure, including distributed training, AutoML, and custom model serving, making it ideal for building and scaling a recommendation engine.

Exam trap

Cisco often tests the distinction between a managed ML platform (Vertex AI) and individual tools like BigQuery ML or Dataflow, trapping candidates who confuse data processing or SQL-based ML with end-to-end model deployment and infrastructure management.

How to eliminate wrong answers

Option A is wrong because BigQuery ML is designed for creating and executing machine learning models directly in BigQuery using SQL, which is suitable for simple, in-database ML but lacks the flexibility and infrastructure for custom model training, deployment, and scaling needed for a recommendation engine. Option C is wrong because Cloud AI Platform Notebooks (now Vertex AI Workbench) is a tool for creating and managing Jupyter notebooks for exploratory data analysis and model development, not a managed service for training and deploying models at scale without managing compute resources. Option D is wrong because Cloud Dataflow is a fully managed service for stream and batch data processing, not an ML platform; it can be used for data preprocessing but does not provide model training or deployment capabilities.

Full explanation →

106

MCQmedium

A developer is building a real-time collaborative document editing application (similar to Google Docs). Users must see each other's edits instantly. Which data consistency model is required for this use case, and what is the implication for the database choice?

A.Eventual consistency is acceptable because users will eventually see each other's edits after a short delay, and this enables higher performance

B.Strong consistency or real-time synchronization is required so all users see the same document state simultaneously; this rules out eventually consistent NoSQL stores and pushes toward strongly consistent databases or specialized collaboration protocols

C.Consistency doesn't matter for this use case because each user edits different parts of the document

D.This workload requires a relational database because only SQL can handle concurrent user edits correctly

AnswerB

Real-time collaboration requires that edits are applied in a consistent order visible to all users simultaneously. Eventually consistent databases (like Cassandra in default mode) would show different users different states of the document. This workload requires either strongly consistent storage or specialized real-time sync protocols (Operational Transformation, CRDTs) that handle concurrent edits correctly.

Why this answer

Option B is correct because real-time collaborative editing requires all users to see the same document state simultaneously, which demands strong consistency or real-time synchronization. This rules out eventually consistent NoSQL stores (e.g., Amazon DynamoDB in default mode) and pushes toward strongly consistent databases (e.g., Google Cloud Spanner, CockroachDB) or specialized collaboration protocols like Operational Transformation (OT) or Conflict-Free Replicated Data Types (CRDTs) that provide convergence guarantees.

Exam trap

Google Cloud often tests the misconception that eventual consistency is sufficient for real-time applications, but the trap here is that users expect instant, conflict-free updates, which only strong consistency or specialized synchronization protocols can guarantee.

How to eliminate wrong answers

Option A is wrong because eventual consistency introduces a delay that can cause users to see conflicting or stale document states, breaking the real-time collaboration experience required for a Google Docs-like application. Option C is wrong because users often edit overlapping sections (e.g., the same paragraph or sentence), and without a consistency model, concurrent edits would lead to lost updates or document corruption. Option D is wrong because relational databases are not the only solution; strongly consistent NoSQL databases (e.g., Google Cloud Firestore in strong consistency mode) or specialized CRDT-based systems can handle concurrent edits correctly without requiring SQL.

Full explanation →

107

Drag & Dropmedium

Drag and drop the steps to set up a Cloud NAT for private Compute Engine instances to access the internet in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

The setup requires a VPC, Cloud Router, NAT gateway, appropriate firewall rules, and verification.

Full explanation →

108

MCQmedium

A software team deploys microservices using containers and wants Google Cloud to automatically manage the scaling, self-healing, and rollout of their containerized applications. They don't want to provision or manage underlying virtual machines. Which Google Cloud service best meets this need?

A.Compute Engine, Google Cloud's virtual machine service

B.Google Kubernetes Engine (GKE), which manages containerized applications with automatic scaling, self-healing, and rolling updates

C.Cloud Storage, for storing container images and serving them to instances

D.Cloud CDN, which distributes containerized applications globally

AnswerB

GKE is the managed Kubernetes service that handles all container orchestration. Teams describe their desired application state, and GKE automatically handles scheduling, health monitoring, auto-scaling, and rolling updates across the container fleet.

Why this answer

Google Kubernetes Engine (GKE) is the correct choice because it provides a managed Kubernetes environment that automates scaling, self-healing (e.g., automatic pod restarts and node repair), and rollout management (e.g., rolling updates and rollbacks) for containerized applications. This meets the requirement of not provisioning or managing underlying virtual machines, as GKE abstracts the node infrastructure.

Exam trap

The trap here is that candidates may confuse Compute Engine (IaaS) with a managed container service, or assume Cloud Storage or Cloud CDN can orchestrate containers, when only GKE provides the automated lifecycle management described.

How to eliminate wrong answers

Option A is wrong because Compute Engine is an Infrastructure-as-a-Service (IaaS) offering that requires manual provisioning and management of virtual machines, not automatic scaling, self-healing, or rollout of containers. Option C is wrong because Cloud Storage is an object storage service for storing container images (e.g., via Artifact Registry integration), but it does not manage scaling, self-healing, or rollout of applications. Option D is wrong because Cloud CDN is a content delivery network that caches and distributes content globally, not a compute or orchestration service for managing containerized workloads.

Full explanation →

109

MCQeasy

A business leader asks: 'What is the difference between a data center region and an availability zone in Google Cloud?' Which explanation is most accurate?

A.A region is a single data center building; an availability zone is a floor within that building

B.A region is a geographic area containing multiple independent zones; each zone is a distinct facility with independent power, cooling, and networking — failures in one zone don't affect other zones in the region

C.A region is equivalent to an availability zone; both terms refer to a single data center

D.An availability zone is larger than a region and spans multiple geographic areas for global redundancy

AnswerB

This is the correct definition. GCP regions (e.g., us-central1) contain multiple zones (a, b, c, d). Each zone is independent infrastructure. A zonal failure (power outage, cooling failure) doesn't propagate to other zones. Customers deploy across multiple zones within a region for high availability against zone-level failures.

Why this answer

Option B is correct because in Google Cloud, a region is a specific geographic location composed of multiple zones, where each zone is an independent data center with its own power, cooling, and networking infrastructure. This isolation ensures that failures within one zone do not impact other zones in the same region, providing high availability and fault tolerance for applications.

Exam trap

The trap here is confusing the hierarchical relationship between regions and zones, leading candidates to incorrectly think a region is a single data center or that zones are larger than regions, which Google Cloud often tests by presenting false equivalencies or reversed sizes.

How to eliminate wrong answers

Option A is wrong because a region is not a single data center building; it is a collection of multiple independent zones, each of which is a separate facility. Option C is wrong because a region and an availability zone are not equivalent; a region contains multiple zones, and each zone is a distinct data center within that region. Option D is wrong because an availability zone is smaller than a region and does not span multiple geographic areas; it is confined to a single region, while regions themselves are separate geographic areas.

Full explanation →

110

MCQmedium

A business intelligence team wants to create interactive dashboards and reports from their BigQuery data without writing code. They need to share reports with stakeholders who don't have GCP accounts. Which Google Cloud tool is most appropriate?

A.Vertex AI Workbench

B.Looker Studio (formerly Data Studio)

C.Cloud Dataprep by Trifacta

D.BigQuery Studio

AnswerB

Looker Studio is Google's free BI dashboarding tool with native BigQuery integration. Reports can be shared via link with stakeholders who have no GCP accounts.

Why this answer

Looker Studio (formerly Data Studio) is the correct choice because it is a no-code, drag-and-drop business intelligence tool that connects directly to BigQuery, enabling the creation of interactive dashboards and reports. It also supports sharing reports via public links or embedded views, allowing stakeholders without GCP accounts to access them without needing IAM permissions.

Exam trap

Cisco often tests the distinction between data preparation tools (Cloud Dataprep), ML development environments (Vertex AI Workbench), and BI/reporting tools (Looker Studio), trapping candidates who confuse 'no-code dashboards' with SQL-focused interfaces like BigQuery Studio.

How to eliminate wrong answers

Option A is wrong because Vertex AI Workbench is a Jupyter-based environment for building and deploying machine learning models, not for creating no-code dashboards or sharing reports with external stakeholders. Option C is wrong because Cloud Dataprep by Trifacta is a data preparation and cleaning tool, not a dashboarding or reporting solution; it focuses on transforming raw data rather than visualizing it interactively. Option D is wrong because BigQuery Studio is a unified interface for writing SQL queries and exploring data within BigQuery, but it does not provide native no-code dashboard creation or the ability to share reports with users who lack GCP accounts.

Full explanation →

111

MCQhard

A company needs to run containerized workloads but wants to avoid managing Kubernetes cluster infrastructure (node pools, cluster upgrades, node autoscaling) entirely. They want to simply deploy container images and have Google Cloud manage all underlying infrastructure automatically. Which Google Cloud product best fits this fully managed container execution requirement?

A.Google Kubernetes Engine (GKE) Standard mode, where the team manages node pools and cluster configuration

B.Cloud Run, which executes container images on fully managed serverless infrastructure with automatic scaling and no cluster or node management

C.Compute Engine with a startup script that pulls and runs the container image from Artifact Registry

D.App Engine Flexible, which runs containers on managed virtual machines

AnswerB

Cloud Run is the answer. Developers provide a container image; Cloud Run handles all infrastructure: no node pools, no cluster upgrades, no capacity planning. It scales automatically from zero to thousands of instances based on request traffic. It's the most infrastructure-free container execution option on Google Cloud.

Why this answer

Cloud Run is the correct choice because it provides a fully managed serverless platform that executes container images without any cluster or node management. It automatically handles scaling, infrastructure provisioning, and maintenance, aligning perfectly with the requirement to avoid managing Kubernetes cluster infrastructure entirely.

Exam trap

The trap here is that candidates may confuse App Engine Flexible with a fully managed container service, but it still requires managing VM instances and does not provide the same serverless abstraction as Cloud Run.

How to eliminate wrong answers

Option A is wrong because GKE Standard mode requires the team to manage node pools, cluster upgrades, and node autoscaling, which contradicts the requirement to avoid managing Kubernetes cluster infrastructure. Option C is wrong because Compute Engine with a startup script still requires managing virtual machine instances, including patching, scaling, and lifecycle, which is not fully managed container execution. Option D is wrong because App Engine Flexible runs containers on managed virtual machines but still requires managing the underlying VM instances and does not provide the same level of automatic scaling and infrastructure abstraction as Cloud Run.

Full explanation →

112

MCQmedium

What is the key difference between a virtual machine (VM) and a container in terms of how they package and run applications?

A.VMs run on physical hardware; containers run in the cloud.

B.VMs include a full guest OS; containers share the host OS kernel and contain only the application and its dependencies.

C.Containers are less secure than VMs because they share hardware.

D.VMs are only for Linux applications; containers support all operating systems.

AnswerB

This is the fundamental difference. VMs carry a full OS (gigabytes), making them slower to start and heavier. Containers share the host kernel (megabytes) and start in seconds.

Why this answer

The key difference is that a virtual machine (VM) includes a full guest operating system (OS) running on top of a hypervisor, which virtualizes the underlying hardware. In contrast, a container packages only the application and its dependencies (libraries, binaries, configuration files) and shares the host OS kernel via the container runtime (e.g., Docker, containerd). This makes containers lightweight and faster to start, as they avoid the overhead of a separate OS instance.

Exam trap

Google Cloud often tests the misconception that containers are simply 'lightweight VMs' or that the difference is about location (cloud vs. on-prem), when the actual distinction is the presence or absence of a guest OS and kernel sharing.

How to eliminate wrong answers

Option A is wrong because VMs do not inherently run on physical hardware; they run on a hypervisor that abstracts the physical hardware, and containers can run on physical hardware, in the cloud, or on-premises — location is not the defining difference. Option C is wrong because containers share the host OS kernel, not the hardware directly, and security depends on isolation mechanisms (e.g., cgroups, namespaces, seccomp); a misconfigured container can be less secure, but VMs provide stronger isolation via a separate kernel, so the blanket statement 'containers are less secure because they share hardware' is technically inaccurate. Option D is wrong because VMs support multiple operating systems (Windows, Linux, etc.) and containers primarily run on Linux or Windows with kernel support; containers do not support all operating systems — for example, a Linux container cannot run natively on a Windows host without a Linux VM.

Full explanation →

113

MCQhard

A CISO is evaluating Google Cloud's security posture and asks about independent third-party validation of Google's security practices. Which types of certifications and audit reports most directly provide this independent assurance?

A.Google's internal security policies and self-assessment reports published on its website

B.Third-party audit certifications such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP, which independently verify that Google's security controls meet defined international and industry standards

C.Google's Bug Bounty program, which shows that the public can report security vulnerabilities

D.Customer testimonials from large enterprises that use Google Cloud for sensitive workloads

AnswerB

These certifications are the gold standard for independent assurance. ISO 27001 and SOC 2 Type II involve rigorous independent audits. PCI DSS is required for payment data handling. FedRAMP provides US government-validated cloud security. A CISO can review these certifications as credible evidence that Google's security controls have been independently verified.

Why this answer

Option B is correct because independent third-party validation of Google Cloud's security posture is most directly provided by certifications and audit reports such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP. These are issued by accredited external auditors who verify that Google's security controls, processes, and infrastructure meet rigorous, internationally recognized standards. This gives customers objective assurance beyond Google's own claims.

Exam trap

Google Cloud often tests the distinction between internal self-assessments or informal programs (like bug bounties or testimonials) and formal, independent third-party audit certifications that provide legally defensible assurance of security controls.

How to eliminate wrong answers

Option A is wrong because internal security policies and self-assessment reports are not independent; they lack external verification and are considered first-party attestations, not third-party validation. Option C is wrong because the Bug Bounty program is a vulnerability disclosure mechanism that encourages ethical hacking, but it does not provide a systematic, audited certification of overall security controls or compliance with standards like ISO 27001 or SOC 2. Option D is wrong because customer testimonials, while valuable for reputation, are anecdotal and not a formal, audited certification; they do not constitute independent third-party validation of security practices.

Full explanation →

114

Multi-Selectmedium

Which TWO of the following are key benefits of cloud technology that are transforming business operations?

Select 2 answers

A.Physical security of data centers

B.Elasticity to automatically scale resources up and down

C.Access to managed services that reduce operational overhead

D.Data locality to keep data within national borders

E.Ability to purchase reserved instances for predictable workloads

AnswersB, C

Elasticity allows businesses to handle variable demand without manual intervention.

Why this answer

Option B is correct because cloud elasticity allows resources to automatically scale up or down based on demand, eliminating over-provisioning and underutilization. This dynamic adjustment is a key transformation driver, enabling businesses to handle variable workloads efficiently without manual intervention.

Exam trap

Google Cloud often tests the distinction between 'elasticity' (dynamic, automatic scaling) and 'reserved instances' (a pricing model for predictable capacity), leading candidates to mistakenly select reserved instances as a transformative benefit when it is merely a cost optimization tactic.

Full explanation →

115

MCQeasy

A telecommunications company wants to launch new 5G services faster than its competitors. Which cloud characteristic most directly accelerates its ability to bring new services to market quickly?

A.On-demand provisioning that allows infrastructure to be deployed in minutes rather than waiting months for hardware procurement and installation

B.The ability to store large amounts of customer call records in the cloud at lower cost

C.Cloud providers' global data center network ensures low latency for all customer calls

D.Managed cloud databases that eliminate the need for database administrators

AnswerA

On-demand self-service is the cloud characteristic that most directly removes the hardware procurement bottleneck. By provisioning infrastructure in minutes, telecoms can test, iterate, and launch new services at a pace impossible with traditional infrastructure cycles.

Why this answer

On-demand provisioning allows the company to spin up virtual servers, networks, and storage in minutes via APIs, eliminating the months-long lead time required for traditional hardware procurement and installation. This directly reduces the time-to-market for new 5G services, as infrastructure can be scaled and configured on the fly to support rapid deployment and testing.

Exam trap

Google Cloud often tests the distinction between operational benefits (cost, latency, management) and the specific agility benefit of rapid provisioning, leading candidates to confuse a general cloud advantage with the one that directly accelerates time-to-market.

How to eliminate wrong answers

Option B is wrong because storing call records at lower cost addresses data retention and compliance, not the speed of launching new services. Option C is wrong because low latency for customer calls is a performance benefit for existing services, not a factor that accelerates the initial deployment of new services. Option D is wrong because managed databases reduce administrative overhead but do not directly impact the speed of provisioning the core infrastructure needed to launch a new service.

Full explanation →

116

MCQmedium

A company's security team wants to detect and remediate public exposure of Cloud SQL instances. Which service should they use?

A.Cloud Armor

B.Security Command Center

C.Cloud Data Loss Prevention (DLP)

D.VPC Service Controls

AnswerB

Security Command Center can find misconfigurations like public Cloud SQL instances.

Why this answer

Security Command Center (SCC) is the correct service because it provides centralized visibility and monitoring of Google Cloud resources, including the ability to detect and alert on public exposure of Cloud SQL instances. SCC's built-in vulnerability and threat detection findings, such as 'Public SQL instance,' directly identify misconfigured Cloud SQL instances that are accessible from the internet, enabling the security team to remediate the exposure.

Exam trap

The trap here is that candidates often confuse services that enforce security (like VPC Service Controls or Cloud Armor) with services that detect and alert on misconfigurations, leading them to pick a tool that blocks or filters traffic rather than one that provides visibility and detection.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) and DDoS protection service that operates at the edge of Google Cloud, protecting HTTP(S) load-balanced applications, not detecting or remediating public exposure of Cloud SQL instances. Option C is wrong because Cloud Data Loss Prevention (DLP) is a service for inspecting, classifying, and de-identifying sensitive data within content, not for detecting network-level exposure of Cloud SQL instances. Option D is wrong because VPC Service Controls is a security perimeter service that prevents data exfiltration from managed services by defining perimeters around VPC networks, but it does not actively detect or alert on public exposure of Cloud SQL instances; it enforces access boundaries but does not provide visibility into existing public configurations.

Full explanation →

117

MCQeasy

A startup wants to launch a new mobile app without investing heavily in physical servers. They need to pay only for what they use and scale quickly as user base grows. What cloud characteristic best supports this?

A.Global infrastructure for low latency

B.High reliability and uptime SLAs

C.Pay-as-you-go pricing model

D.Built-in security and compliance

AnswerC

Pay-as-you-go allows startups to avoid large upfront investments and scale costs with usage.

Why this answer

Option C is correct because the pay-as-you-go pricing model, also known as operational expenditure (OpEx) pricing, directly addresses the startup's need to avoid heavy upfront investment in physical servers and only pay for consumed resources. This model enables elastic scaling, allowing the app to automatically provision and de-provision compute resources (e.g., via AWS Auto Scaling or Azure Scale Sets) as the user base grows, aligning cost with actual usage.

Exam trap

Google Cloud often tests the distinction between 'scalability' (ability to grow) and 'elasticity' (ability to grow and shrink automatically based on demand), and the trap here is that candidates may confuse the need for rapid scaling with the need for a specific pricing model, incorrectly selecting global infrastructure (Option A) because they associate 'scale quickly' with geographic distribution rather than cost-efficient resource provisioning.

How to eliminate wrong answers

Option A is wrong because global infrastructure for low latency, while beneficial for performance, does not address the financial constraint of avoiding heavy upfront server investment or the need to pay only for what is used. Option B is wrong because high reliability and uptime SLAs (e.g., 99.99% availability) ensure service continuity but do not provide the cost flexibility or pay-per-use billing that the startup requires. Option D is wrong because built-in security and compliance features (e.g., encryption at rest, SOC 2 certifications) are critical for data protection but are unrelated to the startup's specific need for a consumption-based pricing model to minimize initial capital expenditure.

Full explanation →

118

MCQmedium

A company uses Cloud Load Balancing to distribute traffic to Compute Engine VMs. They want to protect against SQL injection and cross-site scripting attacks. Which service should they enable?

A.Identity-Aware Proxy (IAP)

B.Cloud Armor

C.Cloud CDN

D.VPC Service Controls

AnswerB

Cloud Armor includes WAF rules to block common web attacks.

Why this answer

Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP/S traffic for malicious patterns, including SQL injection and cross-site scripting (XSS) signatures. It integrates directly with Cloud Load Balancing to filter requests before they reach backend Compute Engine VMs, using pre-configured rules from the ModSecurity Core Rule Set (CRS) to block these common OWASP Top 10 threats.

Exam trap

The trap here is that candidates confuse Identity-Aware Proxy (IAP) with a security filter for application-layer attacks, but IAP only authenticates and authorizes users, not inspects traffic for malicious payloads like SQL injection or XSS.

How to eliminate wrong answers

Option A is wrong because Identity-Aware Proxy (IAP) controls access based on user identity and context (e.g., OAuth, device state), but it does not inspect HTTP request payloads for attack patterns like SQL injection or XSS. Option C is wrong because Cloud CDN caches content at edge locations to improve latency and reduce load, but it does not provide a WAF or inspect traffic for malicious payloads. Option D is wrong because VPC Service Controls create a security perimeter around Google Cloud APIs and services (e.g., preventing data exfiltration via VPC peering), but they do not filter application-layer attacks like SQL injection or XSS.

Full explanation →

119

MCQmedium

A healthcare company must store PHI in Cloud Storage. They require encryption at rest and in transit, and need to comply with HIPAA. Which combination of Google Cloud features should they implement?

A.Cloud Storage with SSE-C, HTTP for in-transit, and enable HIPAA compliance flag.

B.Use Cloud Storage with CSEK and disable public access.

C.Cloud Storage with SSE-GCP and use HTTPS, sign BAA with Google.

D.Use Cloud Storage with CMEK and use VPN for transit.

AnswerC

SSE-GCP provides encryption at rest, HTTPS provides encryption in transit, and a BAA is required for HIPAA compliance.

Why this answer

Option C is correct because Cloud Storage with server-side encryption (SSE-GCP) provides encryption at rest by default, HTTPS ensures encryption in transit, and signing a Business Associate Agreement (BAA) with Google is a mandatory contractual requirement for HIPAA compliance. This combination satisfies all stated requirements: encryption at rest, encryption in transit, and HIPAA compliance.

Exam trap

The trap here is that candidates often confuse encryption mechanisms (SSE-C, CSEK, CMEK, SSE-GCP) with HIPAA compliance requirements, mistakenly thinking that any encryption method plus disabling public access or using a VPN is sufficient, when in fact a signed BAA is the non-negotiable contractual requirement for HIPAA compliance with Google Cloud.

How to eliminate wrong answers

Option A is wrong because SSE-C (Server-Side Encryption with Customer-Provided Keys) is a valid encryption-at-rest option, but HTTP does not encrypt data in transit, and there is no 'HIPAA compliance flag' to enable in Cloud Storage—HIPAA compliance requires a signed BAA. Option B is wrong because CSEK (Customer-Supplied Encryption Keys) is a valid encryption-at-rest method, but disabling public access alone does not ensure encryption in transit (HTTPS is required) and does not address HIPAA compliance (a signed BAA is needed). Option D is wrong because CMEK (Customer-Managed Encryption Keys) provides encryption at rest, but using a VPN for transit does not guarantee HTTPS for Cloud Storage access; Cloud Storage requires HTTPS for encryption in transit, and a VPN alone does not satisfy the HIPAA requirement for a signed BAA.

Full explanation →

120

MCQeasy

A startup wants to deploy a web application globally and expects traffic to be unpredictable — sometimes very low, sometimes very high. Which cloud characteristic ensures the startup only pays for the compute resources it actually uses?

A.Resource pooling, which allows the startup to share physical hardware with other tenants

B.Measured service / pay-per-use pricing, where the startup is billed only for actual resource consumption with no payment for idle capacity

C.Broad network access, which allows the application to be reached from any device globally

D.On-demand self-service, which allows the startup to provision resources through a web interface without calling a sales team

AnswerB

Measured service is the NIST cloud characteristic that directly answers this. The startup is metered — billed for actual CPU, memory, network, and storage consumed. During low-traffic periods, bills are low. During spikes, costs scale up. No capacity is pre-purchased and wasted.

Why this answer

Option B is correct because the measured service / pay-per-use pricing model of cloud computing ensures that the startup is billed only for the compute resources it actually consumes, such as CPU hours, memory, or storage, with no charges for idle capacity. This directly addresses the need to handle unpredictable traffic spikes without incurring costs for unused resources during low-traffic periods. In Google Cloud, this is implemented through per-second billing for compute instances and autoscaling, which dynamically adjusts resources based on demand.

Exam trap

Google Cloud often tests the distinction between the 'what' (e.g., resource pooling, broad network access) and the 'why it matters for cost' (measured service), leading candidates to confuse a general cloud characteristic with the specific billing model that addresses pay-for-use.

How to eliminate wrong answers

Option A is wrong because resource pooling refers to the cloud provider's ability to serve multiple tenants from the same physical hardware using virtualization, but it does not directly determine billing based on actual usage; it is about multi-tenancy and efficiency, not cost proportionality. Option C is wrong because broad network access describes the ability to access cloud services over the network via standard protocols (e.g., HTTP/HTTPS) from any device, but it has no relation to billing models or paying only for resources used. Option D is wrong because on-demand self-service allows users to provision resources automatically without human interaction, but it does not define the pricing model; it enables rapid provisioning but does not guarantee pay-per-use billing.

Full explanation →

121

Multi-Selecteasy

Which TWO features are part of Cloud Data Loss Prevention (Cloud DLP)?

Select 2 answers

A.Classification of sensitive data such as credit card numbers

B.De-identification of data through masking, tokenization, and encryption

C.Network vulnerability scanning

D.Removal of malware from uploaded files

E.Creation of IAM policies

AnswersA, B

Cloud DLP can detect and classify sensitive data types.

Why this answer

Cloud DLP is specifically designed to inspect, classify, and protect sensitive data. Option A is correct because Cloud DLP uses over 150 built-in infoType detectors to automatically identify sensitive data types, such as credit card numbers (matching Luhn algorithm and PAN format), Social Security numbers, and passport numbers, enabling organizations to understand where their sensitive data resides.

Exam trap

Google Cloud often tests the distinction between data-level security (Cloud DLP) and infrastructure-level security (vulnerability scanning, malware removal, IAM) to see if candidates confuse Cloud DLP's content inspection capabilities with broader security services.

Full explanation →

122

MCQeasy

Which term best describes when an organization uses cloud-based tools (video conferencing, cloud document collaboration, project management platforms) to enable employees to work productively from any location?

A.Outsourcing — moving work to contractors in lower-cost locations.

B.Cloud-enabled distributed work / remote work — employees collaborate productively from any location using cloud tools.

C.Digital transformation — the company is changing its business model.

D.Automation — replacing human work with AI and robotics.

AnswerB

Cloud collaboration tools (Google Workspace, Meet, Drive) enable geographically distributed teams to work as effectively as co-located ones. Cloud is the infrastructure layer enabling this fundamental work model shift.

Why this answer

Option B is correct because the scenario explicitly describes employees using cloud-based tools (video conferencing, cloud document collaboration, project management platforms) to work productively from any location. This is the definition of cloud-enabled distributed work or remote work, where cloud infrastructure provides the connectivity, storage, and collaboration capabilities that decouple work from a fixed physical office. The key enabler is the cloud's ability to deliver real-time synchronization and access to shared resources over the internet, which is the core technical mechanism here.

Exam trap

Google Cloud often tests the distinction between 'cloud-enabled distributed work' and 'digital transformation' by making candidates think any use of cloud technology automatically qualifies as a business model change, when in fact remote work is a specific operational model, not a transformation of the core business.

How to eliminate wrong answers

Option A is wrong because outsourcing involves contracting work to external parties in lower-cost locations, not enabling existing employees to work from any location using cloud tools. Option C is wrong because digital transformation refers to a fundamental change in a company's business model or processes using digital technology, which is broader and not specifically about location-independent work. Option D is wrong because automation involves replacing human tasks with AI or robotic processes, not enabling human collaboration and productivity from remote locations via cloud tools.

Full explanation →

123

MCQeasy

Which Google Cloud service provides a centralized view of an application's performance metrics, logs, and traces — enabling teams to monitor system health, set up alerts, and diagnose issues from a single platform?

A.Cloud Security Command Center

B.Cloud Monitoring (part of Google Cloud's operations suite)

C.BigQuery

D.Cloud Asset Inventory

AnswerB

Cloud Monitoring provides metrics dashboards, alerting, uptime checks, and integration with Cloud Logging and Cloud Trace — the central operational observability platform.

Why this answer

Cloud Monitoring (part of Google Cloud's operations suite) is the correct answer because it provides a unified platform for collecting and visualizing metrics, logs, and traces from applications and infrastructure. It enables teams to set up alerting policies, create dashboards, and diagnose performance issues using a single interface, integrating with services like Cloud Logging and Cloud Trace for end-to-end observability.

Exam trap

Google Cloud often tests the distinction between security-focused services and operations-focused services, so the trap here is that candidates might confuse Cloud Security Command Center (a security tool) with a monitoring solution because both provide 'visibility' into cloud resources.

How to eliminate wrong answers

Option A is wrong because Cloud Security Command Center is a security and risk management service that provides visibility into threats and vulnerabilities, not application performance metrics, logs, or traces. Option C is wrong because BigQuery is a serverless data warehouse for analytics over large datasets, not a monitoring or observability tool for real-time application performance. Option D is wrong because Cloud Asset Inventory is used to track and manage cloud resources and their metadata, not to monitor application performance or collect logs and traces.

Full explanation →

124

MCQmedium

A SRE team wants to alert when their service is consuming error budget faster than expected, rather than alerting only when the SLO threshold is crossed. Which Cloud Monitoring alerting strategy supports this approach?

A.Threshold alerting — alert when error rate exceeds 0.1%.

B.SLO burn rate alerting — alert when error budget is being consumed faster than the measurement window allows.

C.Uptime check alerting — alert when health checks fail.

D.Log-based alerting — alert when specific error messages appear in logs.

AnswerB

Burn rate alerting detects when errors are occurring at a rate that will exhaust the error budget before period end. This enables proactive response before the SLO is violated.

Why this answer

B is correct because SLO burn rate alerting is specifically designed to detect when error budget is being consumed faster than the measurement window allows, enabling proactive alerts before the SLO threshold is breached. This approach uses a burn rate (e.g., 2x, 10x) to trigger alerts when the error budget depletion rate exceeds a predefined multiple of the expected rate, allowing the team to respond early. It directly addresses the requirement of alerting on error budget consumption speed rather than waiting for a hard SLO violation.

Exam trap

The trap here is that candidates confuse threshold alerting on a static error rate with SLO burn rate alerting, mistakenly thinking a fixed percentage threshold (like 0.1%) is sufficient to catch fast error budget consumption, when in fact burn rate alerting is the only method that measures consumption velocity relative to the SLO window.

How to eliminate wrong answers

Option A is wrong because threshold alerting on a static error rate (e.g., 0.1%) does not account for the error budget consumption rate over time; it only triggers when a fixed percentage is exceeded, which may be too late or too early depending on traffic volume. Option C is wrong because uptime check alerting only monitors synthetic health checks (e.g., HTTP 200 responses) and does not measure error budget consumption or SLO compliance, making it irrelevant to the scenario. Option D is wrong because log-based alerting reacts to specific error messages in logs, which is a reactive, pattern-matching approach that does not track error budget burn rate or SLO adherence.

Full explanation →

125

MCQeasy

A non-technical manager asks what a 'virtual machine' is and how it differs from the physical servers the company used to run in its own data center. Which explanation is most accurate and accessible?

A.A virtual machine is a web-based application that runs in a browser and replaces traditional desktop software

B.A virtual machine is a complete software-defined computer that runs on shared physical hardware, providing the same capabilities as a dedicated server but created and managed through software in minutes

C.A virtual machine is a physical server located in the cloud provider's data center that is reserved exclusively for one customer

D.A virtual machine is a type of database that stores data virtually rather than on physical disk

AnswerB

This accurately describes a VM: it behaves like a physical server (has CPU, memory, OS, storage) but exists as software running on shared hardware. The key management advantage is that it can be provisioned, modified, and terminated through software, unlike physical servers which require manual hardware work.

Why this answer

Option B is correct because a virtual machine (VM) is a software-based emulation of a physical computer that runs on shared physical hardware via a hypervisor. It provides the same capabilities as a dedicated server (CPU, memory, storage, networking) but can be provisioned, cloned, and managed in minutes through software, which is the core difference from traditional on-premises physical servers that require manual setup and are tied to specific hardware.

Exam trap

The trap here is that Cisco often tests the misconception that 'virtual' means 'web-based' or 'in the cloud as a service,' leading candidates to confuse VMs with SaaS applications or dedicated physical servers, when the key differentiator is the hypervisor-based abstraction of hardware.

How to eliminate wrong answers

Option A is wrong because a virtual machine is not a web-based application running in a browser; that describes a web app or SaaS, not a VM. Option C is wrong because a virtual machine is not a physical server reserved exclusively for one customer; that describes a dedicated physical host or bare-metal server, while VMs share underlying physical hardware with other tenants via a hypervisor. Option D is wrong because a virtual machine is not a type of database; databases store data, while VMs are complete computing environments that can host databases or any other software.

Full explanation →

126

Multi-Selecteasy

Which THREE of the following are best practices for managing operations in Google Cloud? (Choose THREE.)

Select 3 answers

A.Set up budget alerts to monitor costs

B.Implement infrastructure as code using Deployment Manager or Terraform

C.Enable Cloud Audit Logs for security and compliance

D.Use Cloud Logging to store all logs indefinitely to ensure compliance

E.Use a single project for all workloads to simplify management

AnswersA, B, C

Budget alerts prevent unexpected charges.

Why this answer

Setting up budget alerts in Google Cloud allows you to monitor costs proactively by triggering notifications when spending exceeds defined thresholds. This is a fundamental operational best practice to avoid unexpected bills and maintain financial control over your cloud resources.

Exam trap

The trap here is that candidates often confuse 'storing logs indefinitely' with a compliance requirement, but Google Cloud best practices emphasize cost-effective log retention policies and using log exports for long-term storage rather than keeping logs in Cloud Logging forever.

Full explanation →

127

MCQeasy

What is virtualization in the context of cloud computing, and why is it fundamental to how cloud providers deliver services?

A.Virtualization is the process of converting physical servers into digital images for backup purposes.

B.Virtualization abstracts physical hardware into multiple isolated virtual machines, enabling many customers to share physical infrastructure efficiently and securely.

C.Virtualization is a networking technique that routes internet traffic more efficiently.

D.Virtualization is a backup strategy where data is stored in multiple geographic locations.

AnswerB

A hypervisor divides physical hardware into isolated VMs. Cloud providers run thousands of customer VMs on shared physical servers — the foundation of cloud economics and multi-tenancy.

Why this answer

Virtualization is fundamental to cloud computing because it decouples the operating system and applications from the underlying physical hardware through a hypervisor (e.g., VMware ESXi, KVM, Hyper-V). This abstraction allows a single physical server to host multiple isolated virtual machines (VMs), each with its own guest OS, enabling cloud providers to achieve high resource utilization, multi-tenancy, and rapid provisioning. Without virtualization, providers would be limited to one OS per physical server, drastically reducing efficiency and scalability.

Exam trap

Cisco often tests the misconception that virtualization is only about backup or networking, so candidates mistakenly pick options that describe tangential technologies (disk imaging, traffic routing, or geo-replication) instead of the core abstraction of physical hardware into multiple isolated environments.

How to eliminate wrong answers

Option A is wrong because virtualization is not merely converting physical servers into digital images for backup; that describes disk imaging or backup processes, not the core abstraction of hardware into multiple VMs. Option C is wrong because virtualization is not a networking technique for routing traffic; that describes technologies like SDN or routing protocols (e.g., BGP, OSPF), not the hypervisor-based abstraction of compute resources. Option D is wrong because virtualization is not a backup strategy for geographic data replication; that describes disaster recovery or geo-redundancy, not the foundational multi-tenant resource sharing enabled by hypervisors.

Full explanation →

128

MCQmedium

A company runs a mission-critical application that must be available 24/7. They want to ensure that if a Google Cloud region becomes unavailable (e.g., due to a natural disaster), the application automatically continues to serve users from another region. Which architecture pattern achieves this?

A.Deploy in a single region with a Managed Instance Group using 3 availability zones.

B.Deploy the application in multiple regions with a Global Load Balancer for automated failover.

C.Enable Cloud Armor on the load balancer to protect against regional failures.

D.Use Cloud Storage multi-region buckets for application data.

AnswerB

Multi-region deployment with a Global HTTP(S) Load Balancer provides geographic redundancy. If one region fails, the GLB automatically routes to healthy regions — protecting against regional outages.

Why this answer

Option B is correct because deploying the application in multiple regions behind a Global Load Balancer (GLB) enables automated failover. The GLB uses health checks to detect regional failures and routes traffic only to healthy backends, ensuring continuous availability even if an entire region goes down. This aligns with the requirement for a multi-region active-passive or active-active architecture for disaster recovery.

Exam trap

The trap here is that candidates confuse zonal redundancy (Option A) with regional redundancy, mistakenly believing that three zones in one region provide the same disaster recovery protection as multiple regions, but a regional failure (e.g., earthquake, power grid collapse) can take down all zones simultaneously.

How to eliminate wrong answers

Option A is wrong because deploying in a single region with three availability zones protects against zonal failures (e.g., a single datacenter outage) but does not protect against a full regional failure, such as a natural disaster affecting the entire region. Option C is wrong because Cloud Armor is a web application firewall (WAF) and DDoS protection service; it does not provide failover or regional redundancy. Option D is wrong because Cloud Storage multi-region buckets provide geo-redundant object storage but do not automatically failover compute or application logic; the application itself must be deployed in multiple regions with a load balancer to serve traffic.

Full explanation →

129

MCQmedium

A company's cloud spending suddenly spikes by 300% for one week before returning to normal. The cloud team investigates and finds a developer accidentally left a large cluster of VMs running over the weekend. Which cloud financial management practice most effectively prevents this type of unexpected cost spike?

A.Requiring all cloud resource creation to go through a central IT approval process to prevent accidental VM creation

B.Setting Cloud Billing budget alerts that notify stakeholders when spending approaches defined thresholds, enabling early detection and response to abnormal spending patterns

C.Reviewing cloud bills at the end of each month to identify cost anomalies and address them retroactively

D.Using Reserved Instances for all VM workloads to reduce per-hour costs, making accidental long-running VMs less expensive

AnswerB

Budget alerts are the direct preventive control. A budget alert at 150% of normal daily spending would have triggered early Saturday morning, prompting investigation. This gives the team time to act before a full weekend of over-spending accumulates. Budget alerts with escalating thresholds (50%, 80%, 100%, 150%) are a best practice.

Why this answer

Option B is correct because Cloud Billing budget alerts provide real-time notifications when spending exceeds defined thresholds, enabling the cloud team to detect and respond to the 300% spike immediately rather than after the fact. This proactive monitoring directly addresses the root cause—unexpected resource usage—by alerting stakeholders while the VMs are still running, allowing them to shut down the cluster and prevent further cost accumulation.

Exam trap

Google Cloud often tests the distinction between proactive prevention (alerts) and reactive cost optimization (Reserved Instances or monthly reviews), leading candidates to mistakenly choose D because they focus on reducing cost per unit rather than preventing the unexpected usage itself.

How to eliminate wrong answers

Option A is wrong because requiring central IT approval for resource creation introduces a bottleneck that slows down development agility and does not prevent a developer from leaving VMs running; it only controls creation, not runtime duration. Option C is wrong because reviewing bills at the end of each month is a retroactive practice that cannot prevent the cost spike—by the time the bill is reviewed, the 300% increase has already been incurred, making it a detection method rather than a prevention method. Option D is wrong because Reserved Instances reduce per-hour costs but do not prevent the unexpected spike; even at a lower rate, leaving a large cluster running for a full weekend would still result in a significant cost increase, and the practice does not address the behavioral or monitoring gap.

Full explanation →

130

Multi-Selecteasy

An e-commerce platform uses Compute Engine instances in a managed instance group behind a Cloud Load Balancer. During a flash sale, the load balancer reports increased error rates. The operations team suspects the instances are overwhelmed. Which two steps should they take to troubleshoot the issue? (Choose TWO.)

Select 2 answers

A.Switch to a Network Load Balancer for higher throughput.

B.Increase the size of the instance group without investigation.

C.Enable HTTP health checks on the load balancer.

D.Check the CPU utilization of the instance group in Cloud Monitoring.

E.Review the load balancer logs in Cloud Logging for error messages.

AnswersD, E

High CPU utilization may indicate that instances are overloaded, confirming the suspicion.

Why this answer

Option D is correct because checking CPU utilization in Cloud Monitoring directly reveals whether the instance group is resource-constrained. High CPU utilization indicates that the instances are overwhelmed, which aligns with the increased error rates reported by the load balancer. This metric is a primary indicator of compute capacity issues and helps validate the team's suspicion before taking corrective action.

Exam trap

The trap here is that candidates may confuse switching load balancer types (Option A) with a performance fix, when in fact the issue is backend capacity, not frontend protocol handling.

Full explanation →

131

MCQhard

An architect explains that her cloud application uses a 'loosely coupled architecture.' She contrasts it with a tightly coupled on-premises system where all components run in a single process. What is the primary operational benefit of loose coupling in a cloud environment?

A.Loosely coupled applications are always faster because messages are passed in memory rather than over the network

B.Loose coupling allows individual components to fail, scale, or be updated independently without cascading failures to the entire system

C.Loosely coupled architectures require less developer expertise and are easier to build than monolithic applications

D.Loose coupling reduces cloud costs because fewer network calls are made between services

AnswerB

This is the primary operational benefit. When components communicate through queues and APIs rather than direct coupling, a failure in one component doesn't automatically bring down others. Each component can also scale independently based on its own load, and teams can deploy updates without coordinating a system-wide release.

Why this answer

In a loosely coupled architecture, components communicate via well-defined interfaces (e.g., REST APIs, message queues) and are deployed as independent services. This means a failure in one component does not propagate to others, and each component can be scaled or updated without affecting the rest of the system. This isolation is the primary operational benefit in a cloud environment, enabling high availability and continuous delivery.

Exam trap

Cisco often tests the misconception that 'loose coupling' implies faster performance or lower cost, when in fact the primary benefit is operational independence and fault isolation, not raw speed or expense.

How to eliminate wrong answers

Option A is wrong because loose coupling typically involves network calls (e.g., HTTP, AMQP) between services, which are slower than in-memory calls; the statement incorrectly claims messages are passed in memory. Option C is wrong because loosely coupled architectures (e.g., microservices) require significant developer expertise in areas like service discovery, distributed tracing, and eventual consistency, making them harder to build than monolithic applications. Option D is wrong because loose coupling often increases the number of network calls between services, which can increase latency and data transfer costs, not reduce them.

Full explanation →

132

MCQhard

A company's risk management team wants to understand Google Cloud's approach to supply chain security — specifically, how Google ensures that the hardware and firmware running in its data centers have not been tampered with. Which Google security initiative addresses hardware supply chain integrity?

A.Google uses third-party antivirus software to scan all hardware components for tampering before installation

B.Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance

C.Google relies on hardware manufacturers' security certifications to ensure supply chain integrity

D.Google encrypts all hardware components with AES-256 to prevent tampering

AnswerB

Titan is Google's hardware root of trust for supply chain security. It generates a cryptographic identity for the machine, verifies boot firmware hasn't been tampered with (preventing firmware attacks), and provides attestation that can be verified throughout the machine's lifecycle. This is a core component of Google's defense-in-depth security architecture.

Why this answer

Option B is correct because Google's Titan security chip is a dedicated hardware root of trust that cryptographically verifies the boot firmware integrity and machine identity at every startup. This ensures that only Google-signed firmware runs on servers, preventing tampering during manufacturing, shipping, or deployment. Titan provides a hardware-anchored attestation chain that validates the entire supply chain from chip fabrication to rack installation.

Exam trap

The trap here is that candidates often confuse supply chain security with data protection mechanisms (like encryption) or rely on third-party certifications, missing that Google's proprietary hardware root of trust (Titan) is the specific initiative for hardware integrity.

How to eliminate wrong answers

Option A is wrong because Google does not use third-party antivirus software to scan hardware components; antivirus software operates at the OS level and cannot verify hardware or firmware integrity at the supply chain level. Option C is wrong because Google does not rely solely on hardware manufacturers' security certifications; instead, Google implements its own hardware security controls like Titan to independently verify integrity, as manufacturer certifications can be compromised or insufficient. Option D is wrong because AES-256 encryption protects data at rest or in transit, not hardware components themselves; encrypting hardware components would not prevent tampering with firmware or the physical device.

Full explanation →

133

MCQeasy

A company's on-premises IT team spends 70% of their time on routine maintenance tasks: patching servers, replacing failed hardware, and upgrading storage. After migrating to Google Cloud managed services, which operational outcome should they expect?

A.The IT team will need to hire more staff to manage additional cloud infrastructure.

B.The IT team can redirect time from maintenance to higher-value activities like innovation and feature development.

C.The IT team will still perform the same tasks but remotely via the Cloud Console.

D.The IT team will be fully automated out of their roles by Google's AI.

AnswerB

Google handles patching, hardware, and infrastructure management for managed services. The IT team's time shifts from undifferentiated maintenance to strategic, business-value work.

Why this answer

By migrating to Google Cloud managed services like Compute Engine with sole-tenant nodes or fully managed services such as Cloud SQL and Google Kubernetes Engine, the cloud provider handles routine maintenance tasks (patching, hardware replacement, storage upgrades). This frees the IT team from approximately 70% of their previous workload, allowing them to focus on higher-value activities like application innovation, feature development, and optimizing cloud architecture. Option B correctly identifies this shift from operational overhead to strategic work.

Exam trap

The trap here is that candidates may assume cloud migration simply shifts the same tasks to a remote console (Option C), failing to recognize that managed services fundamentally offload maintenance responsibilities to the cloud provider, enabling a shift in team focus.

How to eliminate wrong answers

Option A is wrong because managed services reduce the need for staff to manage physical infrastructure; Google Cloud handles hardware lifecycle and patching, so the team does not need to hire more staff. Option C is wrong because with managed services, the IT team no longer performs the same maintenance tasks (e.g., patching servers or replacing failed hardware) even remotely; those responsibilities are offloaded to Google. Option D is wrong because while automation reduces manual toil, the IT team's roles evolve to focus on architecture, security, and development, not full elimination; Google Cloud's AI assists but does not replace human oversight for design and governance.

Full explanation →

134

MCQmedium

A company is evaluating Google Cloud and wants to know: what is Access Transparency, and how does it benefit customers with stringent governance requirements?

A.Access Transparency shows customers which Google Cloud services are available in their region.

B.Access Transparency logs when Google Cloud personnel access customer content, providing an audit trail for governance.

C.Access Transparency is a feature that makes all customer data visible to Google for quality improvement.

D.Access Transparency provides customers with real-time dashboards of their application's security vulnerabilities.

AnswerB

Access Transparency near-real-time logs capture: what Google personnel accessed, why (business justification), and when — giving enterprises visibility and audit evidence for sovereign data governance requirements.

Why this answer

Access Transparency logs are a Google Cloud feature that provides customers with near real-time logs whenever Google personnel access their data. This creates a detailed audit trail, which is essential for customers with stringent governance or compliance requirements, as it allows them to monitor and verify that access is only for authorized purposes.

Exam trap

Cisco often tests the distinction between 'logging access' and 'providing visibility into data' — the trap here is confusing Access Transparency (an audit log of Google personnel actions) with a feature that exposes or shares customer data with Google.

How to eliminate wrong answers

Option A is wrong because Access Transparency does not show which Google Cloud services are available in a region; that is the function of the Google Cloud region and service listing pages. Option C is wrong because Access Transparency does not make customer data visible to Google for quality improvement; it logs when Google personnel access data, and customers must opt in to share data for quality improvement through separate programs. Option D is wrong because Access Transparency does not provide real-time dashboards of security vulnerabilities; that is the role of services like Security Command Center or Web Security Scanner.

Full explanation →

135

Multi-Selectmedium

A company is designing a disaster recovery plan for its critical application running on Google Kubernetes Engine (GKE) in us-central1. The application uses Cloud SQL (MySQL) as its database. Which TWO actions should the company take to achieve a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 1 hour in the event of a regional outage? (Choose two.)

Select 2 answers

A.Use Cloud SQL's automated backups with a backup schedule every 4 hours.

B.Store container images in a regional registry in the same region.

C.Configure Cloud SQL for cross-region replication using a read replica in a different region.

D.Deploy a GKE cluster in a different region and use Multi-cluster Ingress to route traffic.

E.Use Cloud CDN to cache static content.

AnswersC, D

Provides near real-time replication for RPO <5 minutes.

Why this answer

Option C is correct because Cloud SQL cross-region replication using a read replica in a different region provides asynchronous replication with a typical lag of under 5 minutes, enabling an RPO of less than 5 minutes. In a regional outage, you can promote the read replica to a primary instance in the other region, achieving an RTO of under 1 hour by failing over the application's database connection.

Exam trap

Google Cloud often tests the distinction between backup-based recovery (which has higher RPO due to fixed intervals) and continuous replication (which can achieve near-zero RPO), leading candidates to mistakenly choose automated backups for low RPO requirements.

Full explanation →

136

MCQmedium

A company is moving its financial reporting application to Google Cloud. The CFO asks: 'If Google Cloud experiences a data breach and our financial data is exposed, who is financially liable?' How should the cloud architect answer this question?

A.Google Cloud bears full financial liability for all data breaches involving customer data on its platform

B.Liability depends on where the breach originated: Google is responsible for failures in its infrastructure security; the customer is responsible for breaches resulting from misconfiguration, application vulnerabilities, or inadequate access controls in areas under their responsibility

C.The customer bears all liability for any breach because they chose to use cloud services

D.No party is liable because data breaches in cloud are force majeure events similar to natural disasters

AnswerB

This accurately describes the shared responsibility reality. If Google's physical security or hypervisor is breached, Google bears responsibility. If a misconfigured IAM policy exposes data (customer responsibility), the customer bears the consequences. The customer should also have cyber insurance to manage residual risk.

Why this answer

Option B is correct because the Google Cloud Shared Responsibility Model explicitly delineates liability: Google is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor, network controls), while the customer is responsible for security in the cloud (e.g., IAM policies, application code, data encryption). In a breach, liability is determined by where the failure occurred—if Google’s infrastructure (e.g., GKE node isolation) fails, Google bears liability; if the customer misconfigures a Cloud Storage bucket or leaves a Compute Engine firewall open, the customer bears liability. This aligns with the CFO’s question about financial liability, which is not absolute but contingent on the breach’s origin.

Exam trap

The trap here is that candidates assume Google Cloud automatically assumes all liability for any data breach, ignoring the Shared Responsibility Model’s clear division of accountability based on the breach’s origin (infrastructure vs. customer-managed layers).

How to eliminate wrong answers

Option A is wrong because Google Cloud does not bear full financial liability; the Shared Responsibility Model assigns liability based on the breach’s origin, and customers retain responsibility for their own configurations, applications, and access controls. Option C is wrong because the customer does not bear all liability; Google is liable for breaches caused by failures in its infrastructure security (e.g., hypervisor escapes, physical data center breaches). Option D is wrong because data breaches are not force majeure events; they are foreseeable risks addressed in Google Cloud’s SLA and contractual terms, and liability is governed by the Cloud Terms of Service, not natural disaster clauses.

Full explanation →

137

MCQmedium

An organization runs its entire infrastructure on a single public cloud provider (Google Cloud). All applications, data, and services live in Google Cloud's infrastructure. Which deployment model describes this?

A.Private cloud

B.Public cloud

C.Hybrid cloud

D.Community cloud

AnswerB

Public cloud means all infrastructure is provided by and located in a third-party provider's (Google's) facilities, shared with other customers but logically isolated. Using only Google Cloud is a public cloud deployment.

Why this answer

Option B is correct because the organization is using a single public cloud provider, Google Cloud, which delivers computing resources over the public internet on a pay-as-you-go basis. In a public cloud deployment, the infrastructure is owned and operated by the cloud provider and shared across multiple tenants, which matches the scenario where all applications, data, and services reside in Google Cloud's infrastructure.

Exam trap

Cisco often tests the misconception that using a single public cloud provider is a 'private cloud' because the organization has exclusive use of that provider's resources, but the key distinction is that the provider's infrastructure is still shared among multiple customers, making it a public cloud deployment.

How to eliminate wrong answers

Option A is wrong because a private cloud is dedicated to a single organization and is typically hosted on-premises or in a single-tenant environment, not on a shared public cloud provider like Google Cloud. Option C is wrong because a hybrid cloud requires a combination of at least two distinct deployment models (e.g., public and private) that are interconnected, whereas the scenario describes all infrastructure on a single public cloud. Option D is wrong because a community cloud is shared by several organizations with common concerns (e.g., compliance or security requirements) and is not a single public cloud provider used exclusively by one organization.

Full explanation →

138

MCQhard

A company's monolithic application is difficult to update because any change requires testing and redeploying the entire application, causing multi-hour downtime during updates. The team is considering a microservices architecture. What is the primary benefit of microservices in this context?

A.Microservices always cost less than monolithic applications to run.

B.Each service can be updated and deployed independently, enabling teams to release changes faster with lower risk and without full-application downtime.

C.Microservices eliminate the need for testing because each service is small enough to be bug-free.

D.Microservices allow applications to run on any hardware without modification.

AnswerB

Independent deployability is the core microservices benefit for the described problem. Updating service A doesn't require redeploying services B, C, D — dramatically reducing deployment risk and duration.

Why this answer

Microservices architecture decomposes a monolithic application into small, independently deployable services. Each service can be updated, scaled, and deployed without affecting other services. This eliminates the 'entire-application-redeploy' problem — updating the payment service doesn't require redeploying the catalog or user management services.

Cloud platforms support microservices with containers (GKE), serverless functions (Cloud Run), and managed messaging (Pub/Sub) for service communication.

Full explanation →

139

Multi-Selectmedium

A company wants to connect its on-premises network to Google Cloud for consistent low-latency access to resources. They also need to use the same network policies across multiple projects. Which two Google Cloud products should they use?

Select 2 answers

A.Cloud Interconnect

B.Shared VPC

C.Cloud NAT

D.Cloud VPN

E.VPC Network Peering

AnswersA, B

Cloud Interconnect provides a dedicated, high-bandwidth connection with lower latency than VPN.

Why this answer

Cloud Interconnect provides dedicated, low-latency, and consistent connectivity between an on-premises network and Google Cloud, bypassing the public internet. Shared VPC allows the company to centrally define and apply network policies (e.g., firewall rules, routes) across multiple projects from a single host project, ensuring uniform policy enforcement.

Exam trap

Google Cloud often tests the distinction between connectivity products (Cloud Interconnect vs. Cloud VPN) and policy-sharing mechanisms (Shared VPC vs. VPC Network Peering), where candidates mistakenly choose VPC Network Peering for cross-project policy management, not realizing it only connects VPCs without centralizing policies.

Full explanation →

140

MCQeasy

A company's security team wants to control which resources on the internet can communicate with their virtual machines in Google Cloud. Which fundamental cloud networking concept provides this control?

A.VPC firewall rules that control inbound and outbound network traffic to VMs based on IP ranges, protocols, and ports

B.Cloud IAM policies that grant or deny permissions for external systems to access VM resources

C.Cloud Storage bucket policies that restrict access to VM storage volumes

D.DNS records that determine which internet addresses can resolve the VM's hostname

AnswerA

VPC firewall rules are the correct answer. They are stateful, software-defined firewalls applied to VM network interfaces in Google Cloud VPCs. Rules specify what traffic is allowed or denied based on source/destination IPs, protocols, and ports — providing precise control over which internet resources can communicate with the VMs.

Why this answer

Option A is correct because VPC firewall rules are the fundamental cloud networking construct that controls network traffic to and from virtual machine instances in Google Cloud. These rules operate at the network layer, filtering traffic based on source/destination IP ranges, protocols (e.g., TCP, UDP, ICMP), and port numbers, thereby governing which internet resources can communicate with the VMs.

Exam trap

Cisco often tests the distinction between network-layer controls (firewall rules) and identity/access management (IAM), tempting candidates to choose IAM policies because they sound like 'control' over access, but IAM does not filter network traffic at the packet level.

How to eliminate wrong answers

Option B is wrong because Cloud IAM policies control identity-based permissions for who can perform actions on cloud resources (e.g., who can create VMs), not network-level traffic filtering between internet resources and VMs. Option C is wrong because Cloud Storage bucket policies govern access to objects in Cloud Storage, not to VM storage volumes; VM storage is handled by persistent disks or local SSDs, which are not controlled by bucket policies. Option D is wrong because DNS records resolve hostnames to IP addresses but do not enforce any access control or filtering of network traffic; they merely provide name resolution.

Full explanation →

141

MCQeasy

A company is building a new application that needs to send transactional emails (order confirmations, password resets, account notifications) to customers. Google Cloud does not provide a native SMTP email service. Which approach is standard for sending transactional emails from Google Cloud applications?

A.Using Cloud Storage to store email templates and delivering them directly to customers' inboxes

B.Integrating a third-party transactional email service (such as SendGrid, Mailgun, or Postmark) via API from the Cloud Run or Cloud Functions application

C.Running a self-managed SMTP server on a Compute Engine VM and configuring MX records to deliver email

D.Using Gmail directly by authenticating the application with a corporate Gmail account and sending through Gmail SMTP

AnswerB

This is the standard pattern. Applications hosted on Cloud Run or Cloud Functions call third-party email service APIs to send transactional emails. These services provide the SMTP infrastructure, deliverability management, and analytics that transactional email requires.

Why this answer

Option B is correct because Google Cloud does not offer a native SMTP service for sending transactional emails. The standard approach is to integrate a third-party transactional email service (e.g., SendGrid, Mailgun, Postmark) via API from serverless compute services like Cloud Run or Cloud Functions. These services handle deliverability, reputation, and compliance with email standards (SPF, DKIM, DMARC) that are critical for transactional email.

Exam trap

The trap here is that candidates may assume Google Cloud provides a native SMTP service (like AWS SES) or that Gmail SMTP can be repurposed for application use, but Google Cloud explicitly lacks this service, and Gmail's SMTP is restricted to personal use and low-volume sending.

How to eliminate wrong answers

Option A is wrong because Cloud Storage is an object storage service for storing files, not an email delivery mechanism; it cannot send emails or interact with SMTP/MX protocols. Option C is wrong because running a self-managed SMTP server on Compute Engine is complex, requires managing IP reputation, reverse DNS, and SMTP authentication, and is not a standard or recommended approach for transactional email in Google Cloud. Option D is wrong because using Gmail SMTP from an application violates Gmail's Terms of Service (which prohibit automated bulk or transactional email) and has strict sending limits (e.g., 500 recipients per day for a free account), making it unsuitable for production transactional email.

Full explanation →

142

MCQmedium

A logistics company needs to send millions of shipment status updates per day from IoT tracking devices to backend systems for processing and storage. The solution must decouple the tracking devices from the backend and handle traffic spikes without losing messages. Which Google Cloud product best fits this asynchronous messaging requirement?

A.Cloud SQL, to store each tracking update as a row in a relational database as it arrives

B.Cloud Pub/Sub, Google's fully managed messaging service that decouples producers from consumers and handles massive message volumes reliably

C.Cloud Storage, to have each device upload a file containing its status update

D.Cloud Load Balancing, to distribute incoming tracking requests evenly across backend servers

AnswerB

Pub/Sub is purpose-built for this pattern. IoT devices publish messages to a Pub/Sub topic; backend systems subscribe and process at their own rate. Pub/Sub buffers messages during spikes, guarantees at-least-once delivery, and scales to millions of messages per second without configuration changes.

Why this answer

Cloud Pub/Sub is the correct choice because it is a fully managed, asynchronous messaging service designed to decouple producers (IoT devices) from consumers (backend systems). It can handle millions of messages per second, provides at-least-once delivery, and buffers messages during traffic spikes, ensuring no data loss without requiring the backend to be always available.

Exam trap

Cisco often tests the distinction between decoupling (asynchronous messaging) and load distribution (synchronous traffic management), so the trap here is confusing Cloud Load Balancing's ability to distribute requests with Pub/Sub's ability to buffer and decouple, leading candidates to pick D when they see 'traffic spikes' and 'distribute' in the question.

How to eliminate wrong answers

Option A is wrong because Cloud SQL is a relational database that requires synchronous writes and cannot decouple producers from consumers; it would become a bottleneck under high throughput and cannot buffer messages during spikes. Option C is wrong because Cloud Storage is an object storage service, not a messaging system; having each device upload a file introduces latency, lacks real-time streaming, and does not provide the decoupling or ordered message delivery needed for status updates. Option D is wrong because Cloud Load Balancing distributes incoming traffic across backend instances but does not decouple producers from consumers or provide message buffering; it operates at the network layer and cannot handle asynchronous, event-driven messaging.

Full explanation →

143

MCQmedium

A startup is building a gaming application where players must see each other's moves in real time. The database storing game state must guarantee that all players see the same state simultaneously. Which consistency requirement does this impose and why does it matter for database selection?

A.Eventual consistency is sufficient; the game can show slightly stale state to some players without impact on gameplay

B.Strong consistency is required so all players simultaneously read the same current game state; eventual consistency would create conflicting game states visible to different players

C.Consistency doesn't matter for gaming databases because games update state so frequently that any inconsistency resolves within milliseconds

D.The game should avoid databases entirely and use local storage on each player's device to ensure fast, consistent state access

AnswerB

This is correct. Strong consistency guarantees that after a write (player moves), all subsequent reads from any client see that write. This ensures all players operate on the same view of game state. Cloud Spanner's external consistency or Firestore's strongly consistent reads serve this requirement.

Why this answer

B is correct because real-time multiplayer gaming requires strong consistency to ensure all players see the identical game state simultaneously. In a GCDL context, this means the database must support ACID transactions or linearizable reads (e.g., using Google Cloud Spanner or a strongly consistent NoSQL system like Cloud Firestore in strong consistency mode). Eventual consistency would allow different players to observe different board positions, breaking the game's core requirement of a shared, current state.

Exam trap

Cisco often tests the misconception that eventual consistency is 'good enough' for real-time applications, but the trap is that gaming state requires a single, globally agreed view—eventual consistency introduces windows of divergence that break the core gameplay contract.

How to eliminate wrong answers

Option A is wrong because eventual consistency allows stale reads, which would let players see different game states (e.g., one player sees a move that another hasn't yet), causing conflicts and breaking real-time gameplay. Option C is wrong because consistency is critical in gaming databases; high update frequency does not resolve inconsistency—it can actually exacerbate it, leading to race conditions and state divergence. Option D is wrong because using only local storage on each device eliminates a shared authoritative state, making it impossible to synchronize moves across players and violating the requirement for a single source of truth.

Full explanation →

144

MCQmedium

A company architect is explaining cloud network connectivity options to executives. She distinguishes between using the public internet to connect to cloud services versus using a dedicated private connection. What is the primary advantage of a dedicated private connection over the public internet for enterprise workloads?

A.Dedicated connections are always free, while public internet connections incur data transfer charges

B.Dedicated private connections provide consistent, predictable bandwidth and lower latency by bypassing public internet congestion and variable routing

C.Dedicated connections provide stronger encryption because the public internet uses no encryption

D.Public internet connections have higher bandwidth limits than dedicated connections

AnswerB

This is the primary advantage. By using a private circuit that doesn't traverse the public internet, enterprises get guaranteed bandwidth, predictable latency, and a more reliable connection — critical for applications like database replication, real-time analytics, or mission-critical transactional workloads.

Why this answer

A dedicated private connection, such as AWS Direct Connect or Azure ExpressRoute, provides consistent, predictable bandwidth and lower latency because it bypasses the public internet's variable routing and congestion. This is critical for enterprise workloads that require stable performance for real-time applications, large data transfers, or hybrid cloud architectures. The public internet introduces jitter, packet loss, and unpredictable latency due to shared infrastructure and best-effort routing.

Exam trap

Google Cloud often tests the misconception that dedicated connections are inherently more secure due to encryption, but the real advantage is network isolation and performance predictability, not encryption strength.

How to eliminate wrong answers

Option A is wrong because dedicated private connections are not free; they incur recurring costs for port hours, data transfer, and cross-connects, while public internet data transfer charges are typically lower or included in standard bandwidth plans. Option C is wrong because the public internet does use encryption (e.g., TLS/SSL, IPsec VPNs), and dedicated connections do not inherently provide stronger encryption—they rely on the same encryption protocols if needed, but their primary security benefit is isolation from the public internet, not encryption strength. Option D is wrong because public internet connections generally have higher bandwidth limits (e.g., multi-gigabit via broadband or fiber) compared to dedicated connections, which are provisioned at specific, often lower, committed rates (e.g., 1 Gbps, 10 Gbps) and require scaling via additional circuits.

Full explanation →

145

MCQeasy

A cloud team wants to understand their current Google Cloud resource inventory — specifically, which VMs are running in each region, their machine types, and whether they have public IP addresses. Which approach most efficiently provides this across all projects?

A.Log into each Google Cloud project individually through the Console and manually record VM details in a spreadsheet

B.Use Cloud Asset Inventory to run a single org-wide query that returns all VM instances, their regions, machine types, and network configurations across all projects

C.Check the Cloud Billing reports, which list all resources that have incurred charges by resource type

D.Enable VPC flow logs in each project to capture VM network activity

AnswerB

Cloud Asset Inventory is purpose-built for this. A single asset search for 'compute.googleapis.com/Instance' resources across the entire organization returns the complete VM inventory with all attributes (region, machine type, IP configuration) in seconds.

Why this answer

Cloud Asset Inventory provides a single, unified API to query resources across all projects in an organization. By using the `gcloud asset search-all-resources` command with the `--asset-types=compute.googleapis.com/Instance` filter, you can retrieve all VM instances along with their regions, machine types, and network configurations (including public IP addresses) in one operation, without needing to access each project individually.

Exam trap

The trap here is that candidates may confuse Cloud Billing reports (cost-focused) or VPC flow logs (traffic-focused) with inventory tools, or assume manual per-project inspection is acceptable, when Cloud Asset Inventory is the only option designed for cross-project resource discovery at scale.

How to eliminate wrong answers

Option A is wrong because manually logging into each project and recording details in a spreadsheet is inefficient, error-prone, and does not scale across many projects, defeating the purpose of automation in cloud operations. Option C is wrong because Cloud Billing reports show cost data aggregated by resource type, not the granular per-VM details like machine type, region, or public IP address; they are designed for cost analysis, not inventory management. Option D is wrong because VPC flow logs capture network traffic metadata (e.g., source/destination IPs, ports) but do not provide a static inventory of VM instances, their machine types, or whether they have public IP addresses; they are used for network monitoring and security analysis, not resource discovery.

Full explanation →

146

MCQhard

A CISO is designing an identity strategy for Google Cloud that follows Zero Trust principles. She proposes that no long-lived credentials (API keys, service account keys) should be used for any automated workloads. What Google Cloud mechanism replaces service account keys for authenticating workloads running on Google Cloud infrastructure?

A.Using long-lived API keys stored in Secret Manager instead of environment variables — the keys are the same but stored more securely

B.Attaching a service account to the Compute Engine VM or GKE workload, allowing the workload to obtain short-lived access tokens from the metadata server automatically — no key files required

C.Rotating service account keys every 24 hours to minimize the exposure window

D.Using OAuth 2.0 user accounts instead of service accounts for all automated workloads

AnswerB

This is the correct Zero Trust-aligned approach. A service account is attached to the VM or GKE pod. The workload calls the metadata server (169.254.169.254) to get a short-lived (1-hour) access token automatically. No key file is created, stored, or managed — eliminating the key compromise risk entirely. Workload Identity in GKE extends this to Kubernetes service accounts.

Why this answer

Option B is correct because Google Cloud's default service account attached to Compute Engine VMs or GKE nodes uses the metadata server to automatically obtain short-lived OAuth 2.0 access tokens (typically valid for 1 hour). This eliminates the need for any long-lived key files, aligning with Zero Trust principles by reducing credential exposure and enabling automatic rotation.

Exam trap

Cisco often tests the misconception that rotating keys or storing them securely (e.g., in Secret Manager) is sufficient for Zero Trust, when the core principle is to eliminate long-lived credentials entirely by using metadata-server-based token generation.

How to eliminate wrong answers

Option A is wrong because it still relies on long-lived API keys (even if stored in Secret Manager), which violates the Zero Trust requirement of no long-lived credentials. Option C is wrong because rotating service account keys every 24 hours still uses long-lived key files that can be exfiltrated and reused within that window, failing to eliminate the underlying risk. Option D is wrong because OAuth 2.0 user accounts are designed for interactive human users, not automated workloads, and would require storing user credentials or refresh tokens, which introduces security and manageability issues.

Full explanation →

147

MCQmedium

A company wants to build an application that can understand and respond to natural language queries from customers (e.g., a customer support chatbot). Which Google Cloud capability should they use?

A.Cloud Vision API

B.Dialogflow CX or Vertex AI Conversation

C.BigQuery ML

D.Cloud Translation API

AnswerB

Dialogflow CX is Google's advanced conversational AI platform for building NLU-powered chatbots and virtual agents. It understands customer intent and manages multi-turn conversations across channels.

Why this answer

Dialogflow CX and Vertex AI Conversation are Google Cloud's purpose-built services for building conversational interfaces, including chatbots that understand natural language. They leverage natural language understanding (NLU) models to parse user intents and entities, enabling the application to respond appropriately to customer queries. This makes them the correct choice for a customer support chatbot.

Exam trap

Cisco often tests the distinction between general-purpose ML services (like Vision API or Translation API) and specialized conversational AI services (like Dialogflow), leading candidates to pick a service that sounds related but is actually for a different modality.

How to eliminate wrong answers

Option A is wrong because Cloud Vision API is designed for image and video analysis (e.g., object detection, OCR), not for processing natural language text or speech. Option C is wrong because BigQuery ML is used for running machine learning models on structured data stored in BigQuery, not for building conversational agents or understanding natural language queries. Option D is wrong because Cloud Translation API only translates text between languages; it does not provide intent recognition, entity extraction, or dialogue management needed for a chatbot.

Full explanation →

148

MCQhard

An architect proposes using a 'private cloud' deployment model for a company that wants cloud-like capabilities but is prohibited from using public cloud due to data residency regulations. What is a key advantage of private cloud compared to public cloud, and what is a significant trade-off?

A.Advantage: private cloud is always cheaper than public cloud. Trade-off: private cloud provides less storage capacity

B.Advantage: full control over data residency, security posture, and compliance configuration. Trade-off: organization bears full cost of infrastructure, loses public cloud's scale economics, and has limited elasticity compared to public cloud's vast resource pools

C.Advantage: private cloud provides automatic scaling to unlimited capacity. Trade-off: private cloud requires purchasing hardware every time capacity is needed

D.Advantage: private cloud services are managed by the cloud provider, reducing operational burden. Trade-off: customers cannot customize private cloud configurations

AnswerB

This captures both sides accurately. Private cloud satisfies regulatory requirements for data control and residency. But the organization must fund all infrastructure, skilled operations staff, and hardware refresh — at costs that rarely match public cloud's shared-scale economics. Elasticity is limited to what the organization has built, not global resource pools.

Why this answer

Option B is correct because a private cloud gives the organization exclusive control over data residency, security, and compliance, which is essential when regulations prohibit public cloud use. The trade-off is that the organization must bear the full capital and operational costs of the infrastructure, losing the scale economics and near-infinite elasticity of public cloud providers like AWS, Azure, or GCP.

Exam trap

Cisco often tests the misconception that private cloud is always cheaper or that it provides unlimited elasticity, when in fact the key differentiator is control over compliance and data residency, with the trade-off being higher cost and limited scalability.

How to eliminate wrong answers

Option A is wrong because private cloud is not always cheaper than public cloud; in fact, it often has higher upfront capital expenditure and ongoing operational costs, and storage capacity is not inherently less—private clouds can be scaled with additional hardware. Option C is wrong because private clouds do not provide automatic scaling to unlimited capacity; their elasticity is bounded by the organization's own hardware resources, and scaling requires procurement and deployment of additional physical infrastructure, not just purchasing hardware every time. Option D is wrong because private cloud services are typically managed by the organization's own IT team, not the cloud provider, and customers have full customization control over configurations, which is a key advantage, not a trade-off.

Full explanation →

149

MCQmedium

A healthcare company needs to run a large batch processing job that analyzes patient records using Apache Spark, transforming data from Cloud Storage and writing results to BigQuery. The job runs once daily and requires a large cluster that should exist only during the job. Which Google Cloud product best handles this ephemeral large-batch Spark workload?

A.Cloud Dataflow, for running the Apache Spark code as a streaming pipeline

B.Cloud Dataproc, which runs managed Apache Spark clusters that can be created for the job and deleted on completion — paying only during the processing window

C.Compute Engine VMs, by manually installing Apache Spark on a cluster of VMs each day before the job

D.BigQuery, by running the Spark transformation directly within BigQuery's execution engine

AnswerB

Dataproc is the correct choice for managed Apache Spark. The ephemeral cluster pattern (create cluster → run Spark job → delete cluster) is the recommended cost-optimization approach for batch jobs. The cluster exists only while needed, minimizing cost.

Why this answer

Cloud Dataproc is the correct choice because it provides managed Apache Spark clusters that can be created on demand for the batch job and automatically deleted upon completion, ensuring you only pay for the processing time. This ephemeral cluster model perfectly matches the requirement of a large cluster that exists only during the daily job, without manual infrastructure management.

Exam trap

Cisco often tests the distinction between managed services that run native Spark (Dataproc) versus those that use different execution engines (Dataflow, BigQuery), leading candidates to confuse Dataflow's ability to run batch pipelines with running Spark code directly.

How to eliminate wrong answers

Option A is wrong because Cloud Dataflow is designed for Apache Beam pipelines, not native Apache Spark code; it cannot directly run Spark transformations and is optimized for streaming, not ephemeral batch clusters. Option C is wrong because manually installing Apache Spark on Compute Engine VMs each day is operationally complex, error-prone, and contradicts the managed, ephemeral requirement; it also incurs costs for idle VMs if not carefully managed. Option D is wrong because BigQuery does not run Apache Spark transformations; it uses SQL-based queries and its own execution engine, not Spark, so it cannot execute Spark code directly.

Full explanation →

150

MCQeasy

A startup's web application is being targeted by a denial-of-service attack that is flooding its servers with millions of fake requests per second. Which Google Cloud product provides automatic DDoS protection for the application?

A.Cloud Storage, by distributing the static content of the application across multiple storage regions

B.Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application

C.Cloud IAM, by revoking permissions for the IP addresses generating attack traffic

D.Cloud Monitoring, by alerting the team so they can manually scale up servers to absorb the attack

AnswerB

Cloud Armor is Google Cloud's DDoS mitigation and WAF service. It integrates with Google's global load balancers to absorb volumetric attacks at the edge before they reach backend servers. Its Adaptive Protection feature automatically detects and responds to DDoS patterns in real time.

Why this answer

Cloud Armor is the correct answer because it is Google Cloud's managed DDoS protection and Web Application Firewall (WAF) service. It uses Google's global infrastructure to absorb and filter volumetric attacks (e.g., SYN floods, UDP reflection attacks) at the edge, before traffic reaches the application. It integrates with Cloud Load Balancing to inspect and drop malicious requests based on pre-configured or adaptive rules.

Exam trap

Cisco often tests the misconception that any 'cloud' service (like Cloud Storage or Cloud Monitoring) can handle DDoS by distributing or alerting, when in fact only a dedicated WAF/edge security service like Cloud Armor provides automatic, inline mitigation at the network perimeter.

How to eliminate wrong answers

Option A is wrong because Cloud Storage is an object storage service for static content, not a DDoS protection mechanism; distributing content across regions does not mitigate the flood of fake requests hitting the application servers. Option C is wrong because Cloud IAM manages identity and access permissions for users and service accounts, not network-layer traffic filtering; revoking IP permissions is not designed for real-time DDoS mitigation and cannot handle millions of spoofed source IPs. Option D is wrong because Cloud Monitoring provides observability and alerting, not automated mitigation; manually scaling servers is ineffective against a massive volumetric attack and contradicts the need for automatic protection.

Full explanation →

Google Cloud Digital Leader (GCDL) — Questions 76–150