Google Cloud Digital Leader GCDL Questions 376–450 | Page 6/7

376

MCQhard

A healthcare provider wants to use AI to analyze unstructured medical records — scanned documents with handwritten notes and printed text — to extract diagnosis codes for billing. Which combination of Google Cloud AI products most directly addresses this document understanding use case?

A.BigQuery ML and Looker Studio, to analyze and visualize the extracted diagnosis codes

B.Document AI and Vision API, which together handle OCR, layout understanding, and information extraction from scanned documents with handwritten and printed text

C.Vertex AI Pipelines and Cloud Dataflow, to orchestrate machine learning training jobs on document data

D.Cloud Translation API and Natural Language API, to translate and analyze the text content of medical records

AnswerB

Document AI is Google's specialized service for intelligent document processing — it handles complex documents with mixed handwritten and printed content, extracts structured fields, and has specialized healthcare parsers. Vision API provides foundational OCR capabilities. Together they address the document understanding pipeline from raw scan to extracted structured data.

Why this answer

Option B is correct because Document AI is purpose-built for extracting structured information (like diagnosis codes) from unstructured documents, including both handwritten and printed text, using OCR and layout understanding. The Vision API complements this by providing advanced OCR capabilities for scanned images, together forming a direct solution for the healthcare provider's document understanding use case.

Exam trap

The trap here is that candidates may confuse general-purpose AI services (like Translation API or Natural Language API) with specialized document understanding tools, or assume that any ML pipeline tool (like Vertex AI Pipelines) can directly extract data from scanned documents without OCR and layout analysis.

How to eliminate wrong answers

Option A is wrong because BigQuery ML and Looker Studio are analytics and visualization tools, not designed for OCR or information extraction from scanned documents; they would require already-extracted data. Option C is wrong because Vertex AI Pipelines and Cloud Dataflow orchestrate ML training and data processing pipelines, not direct document understanding or extraction from scanned medical records. Option D is wrong because Cloud Translation API and Natural Language API handle translation and text analysis, but they lack OCR capabilities for handwritten notes and cannot extract structured diagnosis codes from scanned documents.

Full explanation →

377

MCQhard

A company's SRE team sets an SLO of 99.5% monthly availability for a non-critical internal tool. A business stakeholder argues the target should be 99.99%. The SRE team pushes back. Which SRE argument best supports keeping the 99.5% target?

A.Higher SLOs are always more expensive to achieve and the company cannot afford cloud infrastructure that provides 99.99% availability

B.For a non-critical internal tool, 99.99% reliability requires disproportionate engineering investment (redundancy, 24/7 on-call, chaos testing) compared to its business value; 99.5% matches the actual reliability need while preserving engineering capacity for higher-value work

C.Google Cloud cannot provide 99.99% availability for any service, so the SLO must be kept lower

D.The team should set 99.5% now and plan to increase it to 99.99% next quarter when the tool becomes more popular

AnswerB

This is the SRE argument. Reliability is not free — achieving 99.99% requires architectural complexity, 24/7 on-call readiness, and ongoing reliability engineering. For an internal tool, this investment would consume engineering time that could build features users value more. The SLO should match what the business actually needs, not maximize reliability for its own sake.

Why this answer

Option B correctly applies the SRE principle of aligning SLOs with business value. For a non-critical internal tool, the cost of achieving 99.99% availability—including redundant infrastructure, 24/7 on-call rotations, and chaos engineering—far exceeds the marginal benefit over 99.5%. This preserves engineering capacity for higher-value work, which is a core tenet of Google's SRE approach to error budgets and cost-benefit analysis.

Exam trap

Google Cloud often tests the misconception that higher SLOs are always better or that cloud providers universally guarantee high availability, when the correct SRE approach is to set SLOs based on the actual user experience and business impact, not arbitrary targets.

How to eliminate wrong answers

Option A is wrong because it incorrectly assumes higher SLOs are always more expensive; the real issue is disproportionate cost relative to business value, not absolute affordability. Option C is wrong because Google Cloud does offer services with 99.99% availability (e.g., Cloud Spanner multi-region configurations), so the statement is factually incorrect. Option D is wrong because it suggests a planned future increase without justification; SLOs should be set based on current reliability needs and error budget policy, not arbitrary future popularity.

Full explanation →

378

MCQmedium

What is the difference between RTO (Recovery Time Objective) and RPO (Recovery Point Objective) in disaster recovery planning?

A.RTO is the time to back up data; RPO is the time to restore it.

B.RTO is the maximum acceptable downtime duration; RPO is the maximum acceptable data loss measured in time.

C.RTO and RPO are both measured in bytes — the maximum data that can be lost during recovery.

D.RTO is the number of replicas required; RPO is the geographic distance between backup sites.

AnswerB

RTO: 'How long can we be down?' RPO: 'How much data can we afford to lose?' These two objectives drive backup frequency and recovery architecture design.

Why this answer

Option B is correct because RTO (Recovery Time Objective) defines the maximum acceptable duration of downtime after a disaster, while RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time (e.g., the age of the last backup). These are key metrics in disaster recovery planning that directly influence the choice of backup frequency, replication strategy, and failover architecture in cloud environments like GCDL.

Exam trap

Google Cloud often tests the distinction between time-based and data-based metrics, trapping candidates who confuse RTO with backup duration or RPO with recovery speed, especially when options mix units like bytes or geographic distance.

How to eliminate wrong answers

Option A is wrong because RTO is not the time to back up data; it is the target time to restore service after a disaster, and RPO is not the time to restore data but the maximum acceptable data loss window (e.g., how far back in time recovery can go). Option C is wrong because RTO and RPO are measured in time (seconds, minutes, hours), not in bytes; data loss in bytes is a separate metric (e.g., maximum tolerable data loss in volume). Option D is wrong because RTO is not the number of replicas required; replica count is a design decision influenced by RTO/RPO but not the definition, and RPO is not geographic distance; distance affects latency and replication lag but is not the objective itself.

Full explanation →

379

Multi-Selectmedium

Which TWO statements correctly describe Cloud Run scaling behavior?

Select 2 answers

A.The maximum number of instances can be set to 'default' which is unlimited.

B.You can set a minimum number of instances to ensure zero cold starts.

C.You can define a target concurrency to control how many requests each container instance handles.

D.The number of container instances can be scaled to zero when there is no traffic.

E.Autoscaling uses CPU and memory utilization to make decisions.

AnswersC, D

Container concurrency setting controls the maximum number of concurrent requests per instance.

Why this answer

Option C is correct because Cloud Run allows you to set a target concurrency (the number of simultaneous requests a single container instance can handle). This is a key scaling parameter that controls how many requests are routed to each instance before Cloud Run spins up additional instances. By default, concurrency is set to 80, but you can adjust it up to 1000 or set it to 1 for sequential processing.

Exam trap

Google Cloud often tests the misconception that Cloud Run uses CPU or memory utilization for autoscaling, when in fact it uses request concurrency as the primary metric, and candidates may incorrectly select Option E because they associate autoscaling with resource metrics from other services.

Full explanation →

380

MCQhard

A company is evaluating whether to adopt a multi-cloud strategy (using two or more cloud providers for different workloads). An engineer lists the following arguments: (1) resilience against a single cloud provider outage, (2) negotiating leverage on pricing, (3) using best-of-breed services from each provider. A cloud architect cautions that multi-cloud also introduces significant challenges. What is the most significant operational challenge of a multi-cloud approach?

A.Multi-cloud requires purchasing separate hardware for each cloud provider's environment

B.Significantly increased operational complexity: teams need expertise in multiple providers' tools, security models, and APIs, while governance, monitoring, and cost management must span inconsistent environments

C.Cloud providers refuse to allow customers to use competing providers simultaneously

D.Multi-cloud makes it impossible to use any managed services because applications must be portable across providers

AnswerB

This is the primary challenge. Every cloud provider has different services, CLIs, IAM systems, networking models, pricing, and monitoring tools. Maintaining expertise and governance across multiple providers dramatically increases the operational burden and requires larger, more specialized teams. The benefits must be weighed against this real cost.

Why this answer

Option B is correct because multi-cloud environments inherently increase operational complexity. Teams must master distinct APIs, security models (e.g., IAM policies differ between AWS and GCP), monitoring tools (e.g., CloudWatch vs. Cloud Monitoring), and cost management consoles.

Governance and compliance must be enforced consistently across heterogeneous platforms, which often requires custom tooling or third-party solutions, making day-to-day operations significantly more challenging than a single-cloud approach.

Exam trap

The trap here is that candidates may underestimate operational complexity and instead focus on perceived hardware or vendor lock-in issues, but the GCDL exam emphasizes that managing multiple distinct cloud environments is the primary operational challenge.

How to eliminate wrong answers

Option A is wrong because multi-cloud does not require purchasing separate hardware; cloud providers abstract the underlying infrastructure, and customers interact via APIs and virtualized resources. Option C is wrong because cloud providers do not prohibit customers from using competing providers; multi-cloud is a common and supported architecture. Option D is wrong because multi-cloud does not make managed services impossible; applications can use provider-specific managed services (e.g., GCP Cloud SQL, AWS RDS) while abstracting portability via containers or service meshes, though portability is not a strict requirement.

Full explanation →

381

MCQeasy

A cloud architect is reviewing logs from a production incident. She wants to search all log entries across multiple Google Cloud projects for error messages containing a specific string. Which Google Cloud product enables centralized log searching and analysis across an entire organization?

A.Cloud Monitoring, which provides metric dashboards and alerting

B.Cloud Logging, which centralizes logs from all Google Cloud services and projects and supports powerful filtering and search queries across an organization

C.BigQuery, by exporting logs to a dataset and running SQL queries to find matching error entries

D.Cloud Trace, which provides distributed request tracing for latency analysis

AnswerB

Cloud Logging is the correct answer. It aggregates logs from all sources (Compute Engine, Cloud Run, GKE, App Engine, etc.) across all projects into a centralized store. Its query language allows searching for specific text strings, error levels, time ranges, and resource attributes across the entire organization.

Why this answer

Cloud Logging (formerly Stackdriver Logging) is the Google Cloud service designed to ingest, store, and analyze log data from all Google Cloud services and projects. It supports centralized log aggregation across an entire organization via aggregated sinks and the Logs Explorer, enabling powerful filtering and search queries (e.g., using the `textPayload` or `jsonPayload` fields) to find specific error strings across multiple projects without needing to export data elsewhere.

Exam trap

Google Cloud often tests the distinction between native log search (Cloud Logging) and log export/analysis (BigQuery), tempting candidates to choose BigQuery because they know SQL, but the question specifically asks for a product that enables centralized searching without requiring an export step.

How to eliminate wrong answers

Option A is wrong because Cloud Monitoring focuses on metrics, dashboards, and alerting based on time-series data, not on searching raw log entries for specific error strings. Option C is wrong because while BigQuery can query exported logs via SQL, it is not a native centralized log search tool; it requires an additional export step and does not provide real-time log searching across the organization without manual setup. Option D is wrong because Cloud Trace is designed for distributed request tracing and latency analysis, not for searching log entries for error messages.

Full explanation →

382

MCQhard

A financial services firm's board asks the CTO to quantify the business value of the company's three-year cloud transformation program. The CTO presents metrics including: 40% faster product launches, 60% reduction in unplanned downtime, and 25% reduction in infrastructure cost. Which framework best describes what these metrics collectively represent?

A.Return on investment calculated purely from infrastructure cost reduction

B.A balanced view of transformation value spanning speed-to-market, operational resilience, and cost efficiency — collectively representing total business value delivered

C.A technical benchmark comparing on-premises versus cloud infrastructure performance

D.Compliance metrics demonstrating that the transformation met regulatory requirements

AnswerB

This is the correct framing. Digital transformation creates value across multiple dimensions simultaneously. Speed (40% faster launches) creates revenue opportunities; reliability (60% less downtime) protects existing revenue; cost efficiency (25% savings) improves margins. Together they capture the full picture.

Why this answer

Option B is correct because the three metrics collectively provide a balanced view of business value from a cloud transformation: speed-to-market (40% faster product launches), operational resilience (60% reduction in unplanned downtime), and cost efficiency (25% reduction in infrastructure cost). This aligns with the GCDL framework's emphasis on measuring total business value beyond just financial ROI, capturing how cloud enables agility, reliability, and cost optimization simultaneously.

Exam trap

Cisco often tests the misconception that cloud transformation value is purely financial (like ROI from cost savings), when in fact the GCDL framework requires a balanced view including speed, resilience, and cost — candidates who focus only on cost reduction will incorrectly choose Option A.

How to eliminate wrong answers

Option A is wrong because it incorrectly narrows the value to only infrastructure cost reduction, ignoring the significant business impacts of faster product launches and reduced downtime, which are core to cloud transformation benefits. Option C is wrong because these metrics are not technical benchmarks comparing on-premises vs. cloud performance (e.g., latency, throughput, or IOPS); they are business outcome metrics that measure transformation value, not raw infrastructure comparisons. Option D is wrong because none of the metrics address compliance or regulatory requirements (e.g., GDPR, SOC 2, or PCI DSS); they focus on operational and financial outcomes, not adherence to standards.

Full explanation →

383

MCQhard

A company runs a multi-tenant SaaS application on Google Cloud where each customer's data must be strictly isolated from other customers'. A security architect is evaluating approaches: (A) logical isolation using application-level tenant IDs in a shared database, (B) IAM-based separation using separate service accounts per tenant, or (C) infrastructure-level isolation with separate Google Cloud projects per tenant. Which approach provides the strongest isolation guarantee?

A.Logical isolation using application-level tenant IDs, because it is the most cost-efficient and sufficient for regulated workloads

B.Separate Google Cloud projects per tenant, which provides the strongest isolation: separate IAM boundaries, separate resource namespaces, separate audit logs, and no shared database instances with other tenants

C.IAM-based separation using separate service accounts per tenant within a shared project, because IAM provides cryptographically enforced access control

D.All three approaches provide equivalent isolation because Google Cloud's hypervisor ensures complete tenant separation at the hardware level

AnswerB

Project-level isolation is the gold standard for multi-tenant isolation. Each project is a completely independent security boundary. Separate IAM means no privilege escalation between tenants. Separate databases mean no shared infrastructure where bugs could leak data. Separate audit logs make compliance reporting per-tenant straightforward.

Why this answer

Option B is correct because separate Google Cloud projects provide the strongest isolation guarantee by creating independent IAM boundaries, resource namespaces, audit logs, and network configurations. This approach ensures that no shared database instances or other resources exist between tenants, eliminating any risk of cross-tenant data leakage through application bugs or misconfigurations. In contrast, logical isolation (A) relies on application-level tenant IDs which can be bypassed by software vulnerabilities, and IAM-based separation (C) still shares the underlying project infrastructure, including the same database and network.

Exam trap

Cisco often tests the misconception that logical isolation (e.g., tenant IDs) or IAM alone is sufficient for multi-tenant data separation, when in reality only infrastructure-level isolation (separate projects) provides the strongest guarantee against cross-tenant data breaches in a shared cloud environment.

How to eliminate wrong answers

Option A is wrong because logical isolation using application-level tenant IDs in a shared database does not provide strong isolation; it is vulnerable to SQL injection, application bugs, or misconfigured queries that could expose one tenant's data to another, and it is not sufficient for regulated workloads that require strict data separation. Option C is wrong because IAM-based separation using separate service accounts per tenant within a shared project still shares the same resource namespace, database instances, and audit logs, meaning a compromised service account or a misconfigured IAM policy could allow cross-tenant access, and IAM does not enforce data-level isolation. Option D is wrong because Google Cloud's hypervisor ensures VM-level isolation but does not provide tenant separation for shared services like Cloud SQL, Cloud Storage, or application-level data; the hypervisor does not isolate data within a shared database or application layer.

Full explanation →

384

MCQmedium

A developer deploys a Cloud Function with the command shown. The function needs to process a file upload that typically takes 2 minutes. What is the most likely issue?

A.The memory allocation might be too low if the file is large

B.The runtime python39 is not available

C.The function cannot be triggered by HTTP

D.The timeout is too short for processing a 2-minute upload

AnswerA

256 MB may not be enough for file processing; consider increasing memory.

Why this answer

Option A is correct because the command shown does not specify a memory allocation, so the Cloud Function defaults to 256 MB. If the file being uploaded is large, this low memory can cause the function to run out of memory and fail, even if the timeout is sufficient. Processing a file upload often requires loading the file into memory, making memory a critical resource.

Exam trap

Google Cloud often tests the distinction between explicit and default configurations; the trap here is that candidates see '2-minute upload' and immediately assume timeout is the issue, overlooking that memory is a more subtle and common bottleneck when no memory flag is set.

How to eliminate wrong answers

Option B is wrong because python39 is a valid runtime in Google Cloud Functions, so it is available. Option C is wrong because Cloud Functions can be triggered by HTTP requests, and the command shown deploys an HTTP-triggered function (the default trigger type). Option D is wrong because the default timeout for Cloud Functions is 60 seconds, but it can be set up to 540 seconds (9 minutes) via the --timeout flag; the command does not set a custom timeout, so the default 60 seconds would be too short for a 2-minute upload, but the question asks for the 'most likely' issue, and memory is a more common and subtle problem than timeout, which is explicitly configurable and would cause a clear timeout error.

Full explanation →

385

MCQhard

A multinational corporation must comply with data residency requirements that prohibit storing data outside specific geographic regions. They plan to use BigQuery for analytics. How can Google Cloud help enforce this requirement?

A.Use Cloud Audit Logs to detect and alert on cross-region data storage

B.Use Cloud Data Loss Prevention to redact cross-region data

C.Use VPC Service Controls to block access to BigQuery APIs from other regions

D.Use BigQuery’s location parameter to set dataset location and enforce via Organization Policy

AnswerD

BigQuery datasets are location-scoped, and Organization Policies like gcp.resourceLocations can restrict allowed locations.

Why this answer

Option D is correct because BigQuery datasets are created with a specific location parameter (e.g., `us-central1` or `EU`), and Google Cloud Organization Policies can be used to restrict where datasets can be created. By defining a constraint like `constraints/bigquery.locationRestriction`, administrators can enforce that datasets must reside only in approved geographic regions, preventing any data from being stored outside those boundaries. This directly addresses data residency requirements without relying on detection or blocking mechanisms that don't control storage location.

Exam trap

Google Cloud often tests the misconception that VPC Service Controls can enforce data residency by blocking cross-region API calls, but in reality, VPC Service Controls control network access, not where data is physically stored, making it ineffective for this requirement.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs only record actions after they occur; they cannot prevent data from being stored in a prohibited region, only alert on it after the fact, which fails to enforce a proactive residency requirement. Option B is wrong because Cloud Data Loss Prevention (DLP) is designed to inspect and redact sensitive data (e.g., PII) within content, not to control or restrict the geographic location where data is stored. Option C is wrong because VPC Service Controls block API access from specified networks or identities, but they do not restrict the physical location of data storage; a dataset could still be created in a non-compliant region if the API call originates from an allowed network.

Full explanation →

386

MCQeasy

A company classifies its data into four sensitivity levels: Public, Internal, Confidential, and Restricted. Which type of data would typically be classified as 'Restricted' and require the highest level of security controls?

A.Public press releases and marketing materials published on the company website.

B.Customer Social Security Numbers, payment card numbers, and employee health records.

C.Internal meeting notes and project status reports shared among employees.

D.Product roadmap documents shared only with the product team.

AnswerB

SSNs (PII), payment cards (PCI DSS), and health records (HIPAA PHI) are Restricted data — subject to strict regulations, requiring maximum security controls and access restrictions.

Why this answer

Option B is correct because Restricted data, under Google Cloud's data classification framework, includes personally identifiable information (PII) such as Social Security Numbers, payment card numbers (PCI DSS), and protected health information (PHI). These require the highest security controls, including encryption at rest and in transit, strict IAM policies, and Data Loss Prevention (DLP) API scanning to prevent unauthorized access or leakage.

Exam trap

Google Cloud often tests the distinction between Confidential and Restricted data, where candidates mistakenly assume that any sensitive business document (like a product roadmap) qualifies as Restricted, but Restricted is reserved for data with legal or regulatory compliance requirements (e.g., PII, PHI, PCI).

How to eliminate wrong answers

Option A is wrong because public press releases and marketing materials are classified as Public data, which requires no access controls and is intended for unrestricted distribution. Option C is wrong because internal meeting notes and project status reports are typically classified as Internal data, which may require basic access controls but not the highest security level. Option D is wrong because product roadmap documents shared only with the product team are typically Confidential data, which requires access restrictions but not the stringent controls (e.g., encryption, DLP, audit logging) mandated for Restricted data.

Full explanation →

387

MCQeasy

A streaming media company (similar to Netflix or Spotify) uses AI to analyze a user's viewing or listening history and serve personalized content recommendations. Without cloud-scale compute and ML, this personalization would be impossible at scale. What business outcome does this AI-powered personalization primarily drive?

A.Reduced server costs due to more efficient content caching.

B.Increased user engagement and retention through relevant content discovery, driving higher subscription revenue.

C.Elimination of human content curators who previously selected recommendations manually.

D.Reduction in content licensing costs because the AI selects cheaper content to recommend.

AnswerB

Personalization improves content discovery → users find more they like → they consume more and stay longer → lower churn and higher LTV. This is the direct revenue impact of AI-powered recommendation engines.

Why this answer

AI-powered personalization at cloud scale directly increases user engagement by surfacing relevant content, which improves retention and drives subscription revenue. Without cloud-scale compute and ML, the real-time analysis of viewing history and collaborative filtering needed for personalized recommendations would be computationally infeasible for millions of users.

Exam trap

Google Cloud often tests the misconception that AI's primary business value is cost reduction (e.g., cheaper content or fewer employees), when in fact the core driver is revenue growth through improved user engagement and retention.

How to eliminate wrong answers

Option A is wrong because AI personalization does not primarily reduce server costs; in fact, it often increases compute load for inference, and content caching efficiency is a separate infrastructure concern unrelated to recommendation algorithms. Option C is wrong because AI personalization augments, not eliminates, human curators; many platforms still rely on human editorial judgment for quality control and to avoid filter bubbles, and the goal is not cost reduction through job elimination. Option D is wrong because AI personalization aims to recommend content the user will enjoy, not to minimize licensing costs; recommending cheaper content would degrade user experience and engagement, undermining the primary business outcome.

Full explanation →

388

MCQeasy

A hospital network wants to improve patient outcomes by sharing medical records across its 12 hospitals so that any physician can access a patient's complete history. Currently, each hospital has its own isolated system. Which cloud characteristic is most relevant to enabling this cross-hospital data sharing?

A.Cloud elasticity, which allows the hospital to scale up server capacity during peak admission periods

B.Cloud's ubiquitous network access, enabling a secure shared data platform accessible to authorized physicians across all 12 hospital locations through standard internet connectivity

C.Cloud's pay-per-use billing model, which reduces the cost of medical record storage

D.Cloud resource pooling, which allows multiple hospitals to share physical compute resources

AnswerB

Ubiquitous network access (one of NIST's cloud characteristics) is directly applicable. A shared cloud-hosted medical records platform makes patient data accessible to authorized physicians from any hospital location — exactly solving the isolated system problem.

Why this answer

Ubiquitous network access is the cloud characteristic that ensures a secure, shared data platform is accessible to authorized physicians across all 12 hospital locations via standard internet connectivity. This enables seamless cross-hospital data sharing without requiring each hospital to maintain its own isolated system, as the cloud provides consistent network-based access to the centralized medical records.

Exam trap

Google Cloud often tests the distinction between 'resource pooling' (multi-tenancy of infrastructure) and 'ubiquitous network access' (broad network reachability), leading candidates to incorrectly choose resource pooling when the question focuses on cross-location data sharing rather than shared hardware.

How to eliminate wrong answers

Option A is wrong because cloud elasticity addresses scaling compute resources during peak demand, not enabling cross-location data sharing. Option C is wrong because pay-per-use billing reduces storage costs but does not provide the network accessibility needed for sharing records across hospitals. Option D is wrong because resource pooling allows multi-tenancy of physical hardware but does not inherently enable secure, authorized access to a shared data platform from multiple locations.

Full explanation →

389

MCQeasy

A company's web service has a Service Level Objective (SLO) of 99.9% monthly availability. In a 30-day month, how many minutes of downtime are allowed before the SLO is violated?

A.~4.3 minutes

B.~43.2 minutes

C.~7.2 hours

D.~8.6 hours

AnswerB

99.9% availability = 0.1% downtime. In a 30-day month (43,200 minutes), 0.1% = 43.2 minutes of allowed downtime — the classic 'three nines' error budget.

Why this answer

The SLO of 99.9% monthly availability means the service can be unavailable for 0.1% of the total monthly time. In a 30-day month, total minutes are 30 × 24 × 60 = 43,200 minutes. 0.1% of 43,200 minutes is 43.2 minutes, so option B is correct.

Exam trap

The trap here is that candidates often confuse 99.9% with 99.99% (four nines) and incorrectly calculate ~4.3 minutes, or they mistakenly compute 0.1% of 30 days in hours (0.072 hours) and then misread it as 7.2 hours.

How to eliminate wrong answers

Option A is wrong because ~4.3 minutes corresponds to 99.99% availability (0.01% of 43,200 minutes), not 99.9%. Option C is wrong because ~7.2 hours (432 minutes) corresponds to 99% availability (1% of 43,200 minutes). Option D is wrong because ~8.6 hours (516 minutes) is not a standard SLO calculation; it might arise from miscomputing 0.1% of 30 days in hours (0.1% of 720 hours = 0.72 hours, not 8.6 hours).

Full explanation →

390

MCQmedium

Refer to the exhibit. A security engineer applies this IAM policy. What is the effect?

A.Access is allowed only from the IP address 203.0.113.1.

B.Access is allowed only to resources tagged with 'production'.

C.Access is allowed only with two-factor authentication.

D.Access is allowed only during business hours.

AnswerA

The condition 'request.host' evaluates the source IP address.

Why this answer

The IAM policy shown in the exhibit includes a condition block that uses the `ipAddress` condition key with the `IpAddress` operator set to `203.0.113.1`. This restricts access to only requests originating from that specific IP address. All other conditions or permissions in the policy are effectively overridden by this explicit allow condition, meaning access is denied from any other IP address.

Exam trap

Google Cloud often tests the distinction between a condition that allows only a specific IP versus a condition that allows access only to a specific resource tag or time window, leading candidates to confuse the condition key used (e.g., `ipAddress` vs. `resource.labels`).

How to eliminate wrong answers

Option B is wrong because the policy does not include any condition referencing resource tags (e.g., `resource.labels` or `resource.tag`); it only uses an IP address condition. Option C is wrong because there is no condition for two-factor authentication (e.g., `gcp:multiFactorAuth` or `authn` context); the policy only checks the source IP. Option D is wrong because the policy lacks any time-based condition (e.g., `request.time` or `DateTime`); it does not restrict access to business hours.

Full explanation →

391

MCQmedium

A company's application experiences traffic spikes every weekday morning when employees log in at 9 AM. The team wants their infrastructure to automatically handle these spikes without manual intervention and without over-provisioning resources all day. Which Google Cloud capability addresses this?

A.Purchase reserved capacity for peak load and configure it to be active only on weekdays.

B.Configure autoscaling on the application's infrastructure to automatically scale up for load and scale down during off-peak hours.

C.Deploy additional VMs manually each weekday morning and terminate them at night.

D.Use Cloud Monitoring to send an email alert when CPU exceeds 80% so the team can manually scale.

AnswerB

Autoscaling monitors metrics (CPU, requests, custom) and automatically adds instances during the morning spike. Scheduled autoscaling can proactively scale before 9 AM. Resources scale down when load decreases.

Why this answer

Option B is correct because Google Cloud's managed instance groups (MIGs) with autoscaling can automatically adjust the number of VM instances based on load metrics (e.g., CPU utilization, requests per second). This handles the 9 AM traffic spike without manual intervention and avoids over-provisioning during off-peak hours by scaling down when demand decreases.

Exam trap

The trap here is that candidates confuse 'reserved capacity' (a billing commitment) with 'autoscaling' (an operational scaling mechanism), or they think manual or alert-based actions satisfy the 'automatic' requirement, but Cisco specifically tests the distinction between automated scaling policies and manual or notification-driven processes.

How to eliminate wrong answers

Option A is wrong because reserved capacity (committed use discounts) is a pricing model for consistent, long-term usage, not a mechanism to dynamically activate resources only on weekdays; it does not automatically handle spikes. Option C is wrong because manually deploying and terminating VMs each weekday contradicts the requirement for 'automatic' handling without manual intervention. Option D is wrong because Cloud Monitoring alerts require human action to scale, which is not automatic and introduces delay, failing the 'without manual intervention' requirement.

Full explanation →

392

MCQhard

A multinational retail company has an on-premises infrastructure with a mix of Windows and Linux servers. They are planning to migrate their e-commerce platform to Google Cloud to take advantage of scalability and reduce latency. The platform consists of a web frontend (Apache), a backend API (Node.js), and a MySQL database. They want to minimize downtime during the migration. They have a limited budget and need a solution that is cost-effective and quick to implement. The IT team has experience with containers but prefers to avoid managing Kubernetes. Which approach should they take?

A.Use Compute Engine for the web frontend, Cloud Functions for the backend API, and Cloud Spanner for the database.

B.Lift and shift all components to Compute Engine with an autoscaling managed instance group, and migrate the database to Cloud SQL.

C.Containerize all components using GKE, use Cloud SQL for the database, and deploy using a CI/CD pipeline.

D.Migrate the frontend to App Engine Standard, the backend to Cloud Run, and the database to Cloud SQL with read replicas.

AnswerD

App Engine and Cloud Run are serverless, reducing operational overhead. Cloud SQL provides a managed MySQL database with read replicas. This minimizes changes and downtime, fits container experience, and avoids Kubernetes.

Why this answer

Option D is correct because it combines fully managed, serverless services (App Engine Standard for the web frontend and Cloud Run for the backend API) with Cloud SQL for the database, which meets the requirements of minimizing downtime, being cost-effective, and avoiding Kubernetes management. App Engine Standard and Cloud Run automatically scale to zero when not in use, reducing costs, and Cloud SQL with read replicas provides high availability and low-latency reads without complex orchestration. This approach also allows for a gradual migration with minimal disruption, as the existing code can be adapted with minimal changes.

Exam trap

The trap here is that candidates often assume containerization (GKE) is always the best path for modernizing applications, but the question explicitly states the team prefers to avoid managing Kubernetes, making serverless options like App Engine and Cloud Run the correct choice despite their perceived limitations.

How to eliminate wrong answers

Option A is wrong because Cloud Functions is designed for event-driven, short-lived workloads and is not suitable for a persistent backend API that handles synchronous HTTP requests, leading to cold start latency and potential timeouts; Cloud Spanner is a globally distributed, strongly consistent database that is overkill and expensive for a single-region e-commerce platform, especially given the limited budget. Option B is wrong because a lift-and-shift to Compute Engine with managed instance groups does not fully leverage Google Cloud's managed services, resulting in higher operational overhead for patching, scaling, and maintenance, and it does not minimize downtime as effectively as serverless options; it also fails to address the preference to avoid managing Kubernetes. Option C is wrong because GKE requires managing a Kubernetes cluster, which the team explicitly wants to avoid, and while it offers container orchestration, it introduces complexity and cost that are not justified given the limited budget and the simpler serverless alternatives available.

Full explanation →

393

MCQmedium

Refer to the exhibit. What level of access does this IAM policy grant to the members?

A.Permission to create new objects and read existing ones.

B.Full control over objects including create, read, update, and delete.

C.Full control over the bucket including listing and deleting.

D.Read-only access to objects in the bucket.

AnswerD

roles/storage.objectViewer grants read access to objects.

Why this answer

The IAM policy shown grants the `s3:GetObject` action, which provides read-only access to objects in the bucket. It does not include any write or delete permissions, so members can only read existing objects. This matches option D.

Exam trap

Google Cloud often tests the distinction between object-level and bucket-level permissions, tricking candidates into thinking `s3:GetObject` alone allows listing or full control.

How to eliminate wrong answers

Option A is wrong because it includes 'create new objects,' which requires `s3:PutObject` — not present in the policy. Option B is wrong because full control (create, read, update, delete) would require actions like `s3:PutObject`, `s3:DeleteObject`, and `s3:GetObject` — only `s3:GetObject` is granted. Option C is wrong because full bucket control, including listing and deleting, would need `s3:ListBucket` and `s3:DeleteBucket` — neither is in the policy.

Full explanation →

394

MCQmedium

A development team uses Cloud Build to automatically build, test, and create container images whenever code is pushed to their repository. The resulting Docker images need to be stored securely and made available to their GKE deployment pipelines. Which Google Cloud service stores and manages these container images?

A.Cloud Storage bucket with a `containers/` folder.

B.Artifact Registry

C.Cloud SQL — storing build artifacts in a relational database.

D.Cloud Source Repositories — the code repository stores both source code and container images.

AnswerB

Artifact Registry stores Docker images, Helm charts, and other build artifacts. Cloud Build pushes images here; GKE and Cloud Run pull from here during deployment. It also performs vulnerability scanning.

Why this answer

Artifact Registry is the correct service because it is a fully managed, private container registry designed to store, manage, and secure Docker images and other artifacts. It integrates natively with Cloud Build for pushing images and with GKE for pulling them, supporting vulnerability scanning and IAM-based access control.

Exam trap

The trap here is that candidates confuse Cloud Storage (a generic object store) with a container registry, not realizing that container images require a registry API and metadata management that Artifact Registry provides.

How to eliminate wrong answers

Option A is wrong because Cloud Storage is an object store for arbitrary files, not a container registry; it lacks native Docker Registry API v2 support, image layer deduplication, and vulnerability scanning. Option C is wrong because Cloud SQL is a relational database service for structured data, not designed to store binary container images or serve them via the Docker protocol. Option D is wrong because Cloud Source Repositories is a Git repository hosting service for source code only; it cannot store or serve container images, which require a registry API.

Full explanation →

395

MCQeasy

A traditional newspaper company is seeing declining print subscriptions and wants to transform its business model. Which cloud capability most directly enables the company to reach new digital audiences and create personalized content experiences at scale?

A.Replacing all physical printing equipment with equivalent virtual machines in the cloud

B.Using cloud analytics and content delivery networks to personalize articles for each reader and distribute content globally in real time

C.Storing archived newspaper editions in cloud object storage to reduce on-premises storage costs

D.Training existing journalists to use cloud-based email and word processing tools

AnswerB

This is true digital transformation — using cloud-native capabilities (big data, CDN, ML-driven personalization) to create entirely new customer experiences and revenue models that weren't possible with physical media.

Why this answer

Option B is correct because cloud analytics and content delivery networks (CDNs) directly enable the newspaper to analyze reader behavior and preferences at scale, then deliver personalized content globally with low latency. This combination allows the company to reach new digital audiences and create tailored experiences that drive engagement and subscription growth, which is the core of transforming a print business to a digital-first model.

Exam trap

Google Cloud often tests the misconception that any cloud migration (like moving storage or VMs) constitutes digital transformation, when in fact the key is using cloud-native services (analytics + CDN) to enable new business capabilities like personalization and global reach.

How to eliminate wrong answers

Option A is wrong because replacing physical printing equipment with virtual machines in the cloud does not address reaching digital audiences or personalizing content; it merely shifts the same print production process to a virtual environment, which is irrelevant to digital transformation. Option C is wrong because storing archived editions in cloud object storage only reduces on-premises storage costs and does not enable real-time content personalization or global distribution to new audiences. Option D is wrong because training journalists to use cloud-based email and word processing tools improves internal productivity but does not provide the analytics or content delivery infrastructure needed to reach new digital audiences or create personalized experiences at scale.

Full explanation →

396

MCQeasy

A company needs to send messages between different microservices in a decoupled way. When one service publishes an event, multiple downstream services should receive and process it independently. Which Google Cloud service enables this publish-subscribe messaging pattern?

A.Cloud Tasks

B.Cloud Pub/Sub

C.Cloud Scheduler

D.Eventarc

AnswerB

Pub/Sub supports multiple subscriptions per topic, allowing many services to independently receive every published message. It's the GCP-native pub-sub messaging backbone for event-driven architectures.

Why this answer

Cloud Pub/Sub is the correct choice because it is Google Cloud's fully managed, asynchronous messaging service designed specifically for the publish-subscribe pattern. It allows a publisher service to emit events to a topic, and multiple subscriber services can independently pull or push those messages from that topic, ensuring decoupled and reliable communication.

Exam trap

The trap here is that candidates may confuse Eventarc (which handles event ingestion from Google sources) with Cloud Pub/Sub (the core messaging backbone), or mistakenly think Cloud Tasks or Cloud Scheduler can serve as a general pub/sub system when they are designed for different use cases like task queuing and scheduled jobs.

How to eliminate wrong answers

Option A is wrong because Cloud Tasks is a task queue service for managing the execution of discrete tasks (like HTTP requests) with retry logic, not a pub/sub messaging system for broadcasting events to multiple independent subscribers. Option C is wrong because Cloud Scheduler is a cron job service for scheduling single, recurring tasks or HTTP calls at specified times, not for real-time event-driven messaging between services. Option D is wrong because Eventarc is a service for routing events from Google Cloud sources (e.g., Cloud Storage, BigQuery) to targets via CloudEvents, but it relies on Cloud Pub/Sub as its underlying transport and is not the core pub/sub messaging service itself.

Full explanation →

397

MCQmedium

A retail company uses Google Cloud to run an online store. They have a security requirement that all API calls to Cloud Storage must come from the company's on-premises network only. Which Google Cloud security feature should they implement?

A.IAM conditions with source IP constraint

B.VPC Service Controls

C.Cloud Armor

D.Identity-Aware Proxy (IAP)

AnswerB

VPC Service Controls create perimeters to limit access to services like Cloud Storage from approved VPCs or IP ranges.

Why this answer

VPC Service Controls allow you to define perimeters that restrict access to Google Cloud services from specified VPC networks or IP ranges. Cloud Armor is for DDoS and WAF. IAM conditions are for attribute-based access control within a policy.

Identity-Aware Proxy protects web applications, not storage APIs.

Full explanation →

398

MCQeasy

A company's employees use Google Workspace for email, documents, and collaboration. The IT team wants to require all employees to use a physical security key (like a YubiKey) as their second authentication factor when signing in — eliminating phishing-vulnerable SMS and authenticator app codes. Which Google Workspace security capability supports this requirement?

A.Google Workspace Advanced Protection Program, which enforces hardware security key requirements for high-risk users

B.Google Workspace 2-Step Verification policy configured to require hardware security keys (FIDO2/WebAuthn) for all employees, making it impossible to sign in without a physical key

C.Google Cloud Identity-Aware Proxy, which enforces hardware key authentication for all Google Workspace apps

D.Cloud Armor, which blocks sign-in attempts that don't come from corporate IP addresses, eliminating the need for 2FA

AnswerB

Google Workspace administrators can configure the 2SV enrollment and method requirements in the Admin Console. Setting the policy to require security keys (and disabling other 2SV methods) enforces hardware key use organization-wide. Hardware keys are phishing-resistant because they cryptographically verify the site they're authenticating to.

Why this answer

Option B is correct because Google Workspace's 2-Step Verification policy allows administrators to enforce the use of hardware security keys (FIDO2/WebAuthn) as the sole second factor. This policy can be configured to require a physical security key for all employees, effectively blocking sign-ins that use SMS or authenticator app codes, which are vulnerable to phishing. The policy directly meets the IT team's requirement to eliminate phishing-vulnerable authentication methods.

Exam trap

Google Cloud often tests the distinction between a user-level program (Advanced Protection Program) and an organization-wide policy (2-Step Verification policy), leading candidates to choose Option A because it mentions hardware security keys, but they miss that it is not a blanket enforcement for all employees.

How to eliminate wrong answers

Option A is wrong because the Advanced Protection Program is designed for high-risk users (e.g., executives, IT admins) and enforces hardware security keys, but it is not a policy that can be applied to all employees by default; it requires manual enrollment per user. Option C is wrong because Cloud Identity-Aware Proxy (IAP) controls access to applications based on identity and context, but it does not enforce hardware key authentication for Google Workspace apps themselves; it is used for securing access to custom or cloud-hosted apps behind a load balancer. Option D is wrong because Cloud Armor is a web application firewall and DDoS protection service that filters traffic based on IP addresses or other criteria, but it does not enforce multi-factor authentication or eliminate the need for 2FA; it cannot replace a second authentication factor.

Full explanation →

399

Multi-Selecthard

A data analyst runs the above query on Google BigQuery. Which TWO statements correctly describe how cloud technology is transforming business in this scenario?

Select 2 answers

A.The results are delivered in real-time as data is ingested

B.The query required dedicated GPU clusters

C.The ability to analyze petabytes of data without provisioning servers

D.The cloud provider automatically encrypts data at rest and in transit

E.The pay-per-query model reduces costs compared to maintaining an on-premises data warehouse

AnswersC, E

BigQuery is a serverless data warehouse, eliminating the need for hardware management.

Why this answer

Option C is correct because Google BigQuery is a serverless data warehouse that automatically scales to handle petabytes of data without requiring users to provision or manage any servers. This eliminates the operational overhead of capacity planning and infrastructure management, directly demonstrating how cloud technology abstracts physical hardware and enables on-demand analytics at massive scale.

Exam trap

Google Cloud often tests the misconception that 'serverless' means 'real-time' or that cloud analytics require specialized hardware like GPUs, when in fact serverless services like BigQuery abstract infrastructure entirely and use distributed CPU-based compute for analytical workloads.

Full explanation →

400

Multi-Selecteasy

A company stores sensitive customer data in Cloud Storage buckets. The security team wants to ensure that only authorized users can access the data, and access is logged for audit. Which two practices should they implement? (Choose two.)

Select 2 answers

A.Use Storage Transfer Service to replicate data to a secured bucket.

B.Apply IAM conditions to restrict access based on user attributes like IP address or time of day.

C.Use Cloud Audit Logs to record all access attempts.

D.Set up Private Google Access to restrict access to the bucket.

E.Enable default encryption on all buckets using CMEK.

AnswersB, C

IAM conditions allow fine-grained access control based on attributes, enhancing security.

Why this answer

Option B is correct because IAM conditions allow fine-grained, attribute-based access control, such as restricting access to Cloud Storage buckets based on the requester's IP address or time of day, ensuring only authorized users can access the data under specific contexts. Option C is correct because Cloud Audit Logs record all access attempts (including successful and denied requests) to the bucket, providing the necessary audit trail for security and compliance.

Exam trap

Google Cloud often tests the distinction between data protection (encryption) and access control (IAM), leading candidates to mistakenly choose encryption options like CMEK when the question asks about restricting access and logging.

Full explanation →

401

MCQhard

Refer to the exhibit. A DevOps engineer notices that the alert fires even when there is only a single 5-second spike of errors that lasts for one minute. What is the most likely cause?

A.The trigger count is set to 1, so a single minute of high rate fires the alert

B.The alignment period is too short (60s)

C.The threshold value (5) is too low

D.The trigger count is set to 2, so two consecutive periods are needed

AnswerA

With trigger count 1, any single period above threshold triggers the alert.

Why this answer

Option C is correct because the trigger count is 1, meaning the alert fires after just one alignment period (1 minute) with a rate above threshold. A single 5-second spike can cause a high rate during that minute, triggering the alert. Option A is incorrect because the alignment period is 60s, which is appropriate.

Option B is incorrect because the threshold value is set, but the question is about the trigger firing on a single spike. Option D is incorrect because the trigger count is 1, not 2.

Full explanation →

402

MCQmedium

A DevOps team wants to adopt GitOps practices for managing their Google Cloud infrastructure. Which combination of tools and practices defines a GitOps approach to cloud infrastructure management?

A.Manually applying Terraform changes from engineers' local machines and documenting changes in a shared wiki

B.Storing all infrastructure as code (Terraform or Config Connector) in a Git repository, using pull requests for all changes, and automated CI/CD pipelines that apply changes and detect drift from the declared state

C.Using the Google Cloud Console to make infrastructure changes and exporting the configuration to Git after each change

D.GitOps only applies to application code deployment, not to cloud infrastructure management

AnswerB

This is GitOps. Git repo as truth: ✓. Pull request process for changes: ✓ (provides review, approval, audit trail). Automated reconciliation: ✓ (CI/CD applies changes and detects drift). This pattern makes infrastructure management reproducible, auditable, and collaborative.

Why this answer

Option B is correct because GitOps is defined by using a Git repository as the single source of truth for declarative infrastructure, with pull requests driving changes and automated CI/CD pipelines reconciling the actual state with the declared state. This approach enforces version control, auditability, and drift detection, which are core to managing Google Cloud infrastructure at scale with tools like Terraform or Config Connector.

Exam trap

The trap here is that candidates may confuse GitOps with simply storing code in Git (Option A) or think it only applies to applications (Option D), when in fact GitOps requires automated reconciliation and pull-request-driven workflows for infrastructure as code.

How to eliminate wrong answers

Option A is wrong because manually applying Terraform changes from local machines bypasses version control and automation, violating the GitOps principle of using Git as the single source of truth and eliminating audit trails and drift detection. Option C is wrong because making changes via the Google Cloud Console and exporting to Git afterward is a reactive, post-hoc approach that does not enforce declarative state management or prevent configuration drift, and it lacks the pull-request-based change workflow central to GitOps. Option D is wrong because GitOps is explicitly applicable to cloud infrastructure management, not just application code deployment; tools like Terraform and Config Connector are designed to manage infrastructure declaratively via Git-driven workflows.

Full explanation →

403

MCQhard

A multinational corporation uses Cloud Identity-Aware Proxy (IAP) to secure access to applications. They notice that some users outside the corporate network can still reach the applications. What is the most likely misconfiguration?

A.IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.

B.The firewall rules allow ingress from 0.0.0.0/0.

C.IAP is not enabled on the backend service.

D.The OAuth 2.0 client ID is misconfigured.

AnswerA

allUsers includes unauthenticated users, allowing anyone to access the application.

Why this answer

Option A is correct because setting IAP to 'allUsers' allows unauthenticated access from any user on the internet, bypassing IAP's authentication and authorization checks. IAP should be configured with 'allAuthenticatedUsers' or a more specific set of principals to enforce identity verification before granting access to the application.

Exam trap

Google Cloud often tests the distinction between 'allUsers' (anyone, including unauthenticated users) and 'allAuthenticatedUsers' (any authenticated Google identity), which is a common source of confusion for candidates who assume IAP always requires authentication regardless of the IAM setting.

How to eliminate wrong answers

Option B is wrong because firewall rules allowing ingress from 0.0.0.0/0 are not the root cause; IAP works by intercepting requests at the Google Cloud load balancer level, and firewall rules do not affect IAP's authentication enforcement. Option C is wrong because if IAP were not enabled on the backend service, no IAP authentication would occur at all, but the question states that some users can still reach the applications, implying IAP is partially working. Option D is wrong because a misconfigured OAuth 2.0 client ID would cause authentication failures for all users, not allow some external users to bypass IAP.

Full explanation →

404

MCQhard

An organization's digital transformation initiative is failing to deliver expected outcomes despite significant cloud technology investment. A review reveals that business units operate in silos, processes remain unchanged, and employees resist new ways of working. Which factor is most likely the root cause of the failure?

A.The organization chose the wrong cloud provider for its technical workloads

B.The cloud services selected are not technically advanced enough to deliver transformation outcomes

C.Insufficient change management, cultural resistance, and siloed operations are preventing the organization from realizing technology benefits

D.The organization is spending too much on cloud services, leaving insufficient budget for transformation

AnswerC

This is the root cause. Digital transformation requires aligning people, processes, and technology. When the human and organizational dimensions are neglected, even the best technology investments fail to produce outcomes. Change management and breaking down silos are prerequisites for transformation success.

Why this answer

Option C is correct because the failure stems from organizational and cultural factors—siloed operations, unchanged processes, and employee resistance—which are classic symptoms of inadequate change management. Cloud technology alone cannot drive transformation; it must be paired with process reengineering and cultural adoption. The GCDL framework emphasizes that digital transformation is as much about people and processes as it is about technology.

Exam trap

Google Cloud often tests the misconception that technology selection or budget is the primary driver of transformation success, when in reality, organizational change management and cultural alignment are the critical enablers.

How to eliminate wrong answers

Option A is wrong because choosing a different cloud provider would not address the root cause of siloed operations, unchanged processes, or cultural resistance; the technical workloads are not the issue here. Option B is wrong because the problem is not the technical sophistication of the cloud services—even advanced services like AWS Lambda or Azure Functions cannot overcome organizational inertia or lack of process change. Option D is wrong because the budget allocation is not the root cause; the organization has already invested significantly in cloud technology, but the failure is due to how it is adopted and integrated, not the amount spent.

Full explanation →

405

MCQmedium

A manufacturing company wants to improve product quality by analyzing sensor data from 10,000 factory machines in real-time to detect defects before they occur. Previously, this was impossible due to the massive compute requirements. Which cloud capability makes this feasible?

A.Cloud storage allowing all sensor data to be stored cheaply.

B.On-demand access to massive compute resources and AI/ML services for real-time data processing.

C.Cloud-based email and collaboration tools for factory staff.

D.Migration of the company's ERP system to the cloud.

AnswerB

Cloud's elastic compute and managed ML services allow the company to process 10,000 machines' sensor streams simultaneously using resources that would be unaffordable to own, enabling real-time predictive quality control.

Why this answer

Option B is correct because the core challenge is the massive compute requirement for real-time analysis of 10,000 machines' sensor data. Cloud providers offer on-demand access to elastic compute resources (e.g., AWS EC2 Auto Scaling, Azure VM Scale Sets) and AI/ML services (e.g., AWS SageMaker, Azure Machine Learning) that can scale horizontally to process streaming data in near real-time, enabling defect prediction that was previously infeasible with on-premises fixed-capacity infrastructure.

Exam trap

Cisco often tests the misconception that 'storage solves everything' or that generic cloud services (like email or ERP migration) are sufficient, when the specific bottleneck is compute and AI processing power for real-time analytics.

How to eliminate wrong answers

Option A is wrong because while cloud storage (e.g., Amazon S3, Azure Blob Storage) provides cheap, scalable storage for sensor data, it does not address the compute-intensive requirement for real-time processing and defect detection; storing data alone cannot analyze it. Option C is wrong because cloud-based email and collaboration tools (e.g., Microsoft 365, Google Workspace) are productivity applications unrelated to high-throughput sensor data processing or machine learning inference. Option D is wrong because migrating an ERP system to the cloud (e.g., SAP on AWS) improves business process management and data centralization but does not provide the specialized compute and AI/ML services needed for real-time sensor analytics.

Full explanation →

406

MCQmedium

A company uses Google Cloud and has a compliance requirement to store certain data only within the European Union and ensure it cannot be accessed from outside the EU, even by Google operations personnel. Which Google Cloud offering specifically addresses this level of data sovereignty?

A.Selecting EU regions for all resources in the Cloud Console.

B.Sovereign Controls offerings (e.g., T-Systems Sovereign Cloud) or Assured Workloads with data residency and personnel access controls.

C.VPC Service Controls — they prevent data from leaving the VPC boundary.

D.Cloud Armor — it blocks requests originating from outside the EU.

AnswerB

Sovereign Controls provide the strictest sovereignty: EU-only data residency enforced contractually, local support operations model restricting Google personnel access, and audit controls — meeting the highest regulatory standards.

Why this answer

Option B is correct because Sovereign Controls offerings (such as T-Systems Sovereign Cloud) and Assured Workloads with data residency and personnel access controls are specifically designed to meet strict data sovereignty requirements. These solutions ensure that data remains within the EU and that Google operations personnel cannot access it, addressing both geographic storage and access restrictions mandated by compliance frameworks like GDPR.

Exam trap

The trap here is that candidates often confuse geographic storage (selecting EU regions) with full data sovereignty, failing to realize that personnel access controls are required to prevent internal Google staff from accessing data from outside the EU.

How to eliminate wrong answers

Option A is wrong because simply selecting EU regions for resources ensures data is stored in the EU, but it does not prevent Google operations personnel from accessing the data from outside the EU, as Google retains administrative access. Option C is wrong because VPC Service Controls restrict data exfiltration by creating security perimeters around VPC resources, but they do not enforce geographic data residency or block access by Google personnel; they focus on preventing unauthorized data movement within Google Cloud. Option D is wrong because Cloud Armor is a web application firewall that filters incoming traffic based on IP addresses or geographic regions, but it does not control data storage location or restrict access by internal Google operations staff; it only blocks external requests at the network edge.

Full explanation →

407

MCQmedium

A CISO asks why Google Cloud's security model is described as a 'defense-in-depth' approach. Which explanation best describes this concept in the context of Google Cloud's infrastructure security?

A.Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data

B.Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system

C.Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary

D.Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure

AnswerB

This correctly describes defense in depth. Google's infrastructure security has independent layers: secure physical facilities, Titan security chips for hardware attestation, hypervisor isolation between tenants, encrypted network traffic, and IAM at the application layer. An attacker must bypass all relevant layers simultaneously — dramatically harder than defeating a single control.

Why this answer

Option B is correct because Google Cloud's defense-in-depth model implements security at multiple independent layers: physical security (e.g., tamper-evident cages), hardware attestation (e.g., Titan chips verifying boot integrity), network encryption (e.g., mTLS between all services), hypervisor isolation (e.g., gVisor or KVM-based sandboxing), and application-level IAM (e.g., Cloud IAM policies). This layered approach ensures that if an attacker bypasses one layer, other layers remain intact to protect the system, aligning with the core principle of defense in depth.

Exam trap

The trap here is that candidates often confuse defense in depth with a single strong control (like encryption) or a perimeter-only approach, failing to recognize that Google Cloud's model requires multiple independent layers that each provide a distinct security function.

How to eliminate wrong answers

Option A is wrong because defense in depth is not about a single encryption algorithm; it relies on multiple overlapping controls, not a single strong mechanism. Option C is wrong because defense in depth extends beyond the network perimeter to include internal controls like hypervisor isolation and IAM, not just a strong outer boundary. Option D is wrong because Google Cloud's shared responsibility model means Google secures the infrastructure (physical, hardware, network, hypervisor), while customers secure their data and access; defense in depth applies to Google's layers, not solely customer responsibility.

Full explanation →

408

MCQmedium

An organization uses Google Cloud Identity and Access Management (IAM). A new employee is a data engineer who needs to read BigQuery datasets and run queries but should NOT be able to create new datasets, delete tables, or modify IAM policies. Which IAM role should be assigned?

A.`roles/bigquery.admin`

B.`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries)

C.`roles/viewer` (project-level Viewer)

D.`roles/bigquery.dataEditor`

AnswerB

dataViewer grants read-only access to datasets. jobUser allows creating and running query jobs. Together they provide read + query capability without write, delete, or admin access.

Why this answer

Option B is correct because the `roles/bigquery.dataViewer` role grants read access to BigQuery datasets and their contents, while `roles/bigquery.jobUser` allows the user to run query jobs. Together, they satisfy the requirement to read datasets and run queries without permitting dataset creation, table deletion, or IAM policy modification.

Exam trap

The trap here is that candidates often assume the project-level `roles/viewer` (Option C) is sufficient for running queries, but it lacks the `bigquery.jobs.create` permission, causing query execution to fail even though the user can see the data.

How to eliminate wrong answers

Option A is wrong because `roles/bigquery.admin` grants full administrative control over BigQuery resources, including creating and deleting datasets, tables, and modifying IAM policies, which exceeds the required permissions. Option C is wrong because the project-level `roles/viewer` role provides read-only access to all resources in the project, but it does not include the `bigquery.jobs.create` permission needed to run queries, so the user would be unable to execute query jobs. Option D is wrong because `roles/bigquery.dataEditor` allows editing existing datasets and tables (e.g., inserting, updating, deleting data), but it does not include the `bigquery.jobs.create` permission for running queries, and it still permits modifications that the user should not be allowed to perform.

Full explanation →

409

MCQmedium

An SRE team has a monthly error budget of 43 minutes (99.9% SLO). In the first week of the month, a deployment causes a 50-minute outage. What should the SRE team do for the remainder of the month, and why?

A.Immediately deploy a hotfix to restore features that were rolled back during the outage.

B.Freeze feature deployments for the rest of the month, focus on reliability improvements, and investigate the deployment process that caused the outage.

C.Negotiate with stakeholders to increase the SLO to 99.5% to get more error budget.

D.Continue deploying features normally — the outage was a one-time event and won't happen again.

AnswerB

Budget exhausted = feature freeze. SRE teams use budget exhaustion as a signal to pause new features and focus on root cause analysis and reliability improvements before resuming velocity.

Why this answer

The team has already consumed more than the entire monthly error budget (50 minutes used vs. 43 minutes allowed). To avoid violating the 99.9% SLO for the rest of the month, they must freeze feature deployments and focus on reliability improvements. This is a core SRE practice: when the error budget is exhausted, the team shifts from feature velocity to stability, investigating the root cause and hardening the deployment process.

Exam trap

Cisco often tests the misconception that you can 'negotiate' or 'increase' the SLO to fix an error budget deficit, but increasing the SLO actually tightens the budget, and the correct response is to halt feature deployments until the next budget window.

How to eliminate wrong answers

Option A is wrong because deploying a hotfix to restore rolled-back features would introduce further change risk when the error budget is already negative, potentially causing additional downtime and SLO violations. Option C is wrong because negotiating to increase the SLO to 99.5% (which actually reduces the error budget to ~21.6 minutes per month) would make the situation worse, not better; the team needs more error budget, not less. Option D is wrong because continuing normal deployments ignores the fact that the error budget is exhausted; treating a 50-minute outage as a one-time event is a common fallacy that ignores the statistical reality of SLOs and the need to preserve remaining budget for unforeseen incidents.

Full explanation →

410

MCQmedium

A retail company experiences huge traffic spikes during Black Friday and slow periods otherwise. They want to avoid over-provisioning servers and reduce costs. Which cloud feature directly addresses this need?

A.Auto-scaling based on CPU utilization

B.Purchasing committed use discounts

C.Load balancing across regions

D.Manual scaling with reserve instances

AnswerA

Auto-scaling automatically adjusts compute resources to match demand, reducing waste.

Why this answer

Auto-scaling based on CPU utilization dynamically adjusts the number of server instances in response to real-time demand. During Black Friday traffic spikes, it automatically adds capacity, and during slow periods, it scales down to reduce costs. This directly addresses the need to avoid over-provisioning while maintaining performance.

Exam trap

Google Cloud often tests the misconception that load balancing alone solves capacity issues, but candidates must recognize that load balancing distributes existing traffic and does not add or remove servers—only auto-scaling handles dynamic provisioning.

How to eliminate wrong answers

Option B is wrong because purchasing committed use discounts requires a long-term commitment to a fixed amount of resources, which does not help with dynamic traffic spikes and can lead to over-provisioning during slow periods. Option C is wrong because load balancing across regions distributes traffic but does not automatically adjust the total number of servers; it works best with auto-scaling but alone cannot prevent over-provisioning. Option D is wrong because manual scaling with reserved instances requires human intervention to add or remove capacity, which is too slow to handle sudden Black Friday spikes and still involves upfront commitment that wastes resources during slow times.

Full explanation →

411

MCQmedium

A company's application stores sensitive customer information in Cloud Storage. A security audit finds that one bucket has 'allUsers' access granted (making it publicly accessible on the internet). The security team wants to prevent this from happening in the future. Which control prevents public access from being granted to Cloud Storage buckets?

A.Enable Cloud Armor on all Cloud Storage buckets to block public internet access

B.Apply the 'storage.publicAccessPrevention' organization policy constraint, which prevents allUsers and allAuthenticatedUsers from being granted in Cloud Storage IAM policies organization-wide

C.Enable VPC Service Controls around Cloud Storage to prevent public internet access

D.Configure Cloud Monitoring to alert the security team when a bucket is made public so they can revert it

AnswerB

Public Access Prevention is the correct control. Applied as an org policy, it makes it impossible to grant allUsers or allAuthenticatedUsers access to any bucket in the organization. Attempts to set such policies are rejected by the API. This is the definitive preventive control for accidental public bucket exposure.

Why this answer

Option B is correct because the 'storage.publicAccessPrevention' organization policy constraint is a Google Cloud IAM constraint that, when enforced at the organization, folder, or project level, prevents any IAM policy binding that grants access to 'allUsers' or 'allAuthenticatedUsers' on Cloud Storage buckets. This is a preventive control that blocks the action before it can occur, directly addressing the security team's requirement to prevent public access from being granted in the future.

Exam trap

Google Cloud often tests the distinction between preventive, detective, and corrective controls, and the trap here is that candidates confuse VPC Service Controls (which restrict network-level access) with IAM policy controls (which govern identity-based access), leading them to choose option C instead of the correct preventive IAM constraint.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) and DDoS protection service for HTTP(S) load balancers, not a service that can be applied to Cloud Storage buckets or block IAM-based public access. Option C is wrong because VPC Service Controls create a security perimeter around Google Cloud services to prevent data exfiltration over the internet, but they do not prevent a bucket from being made publicly accessible via IAM policy changes; they restrict access from outside the perimeter but do not block the 'allUsers' grant itself. Option D is wrong because Cloud Monitoring alerts are a detective control, not a preventive control; they notify the team after the public access has already been granted, which does not prevent the incident from happening.

Full explanation →

412

MCQmedium

A Virtual Private Cloud (VPC) in Google Cloud provides network isolation. What does 'network isolation' mean in this context, and why is it important?

A.Network isolation means the VPC blocks all internet access — resources cannot communicate with external services.

B.VPC provides a logically isolated private network where resources are separated from other customers' networks by default, preventing unauthorized cross-customer traffic.

C.Network isolation means all traffic within the VPC is automatically encrypted.

D.A VPC requires dedicated physical hardware separate from other customers to ensure isolation.

AnswerB

VPCs create private network boundaries. Customer A's VMs and customer B's VMs cannot see each other's network traffic even though they share physical infrastructure — logical isolation is enforced at the network layer.

Why this answer

Option B is correct because a Google Cloud VPC provides a logically isolated private network within the shared Google Cloud infrastructure. This isolation ensures that resources in one customer's VPC cannot directly communicate with resources in another customer's VPC by default, preventing unauthorized cross-customer traffic. This is achieved through software-defined networking (SDN) constructs like virtual firewalls and routing tables, not through physical separation.

Exam trap

Cisco often tests the misconception that 'network isolation' implies physical separation or automatic encryption, leading candidates to choose options D or C, when in fact it refers to logical isolation via software-defined networking.

How to eliminate wrong answers

Option A is wrong because network isolation does not block all internet access; VPCs can be configured with Cloud NAT, external IP addresses, or VPNs to allow controlled outbound or inbound internet connectivity. Option C is wrong because network isolation does not automatically encrypt traffic; encryption requires additional measures like TLS/SSL or VPC Flow Logs with encryption at rest, and traffic within a VPC is not encrypted by default. Option D is wrong because a VPC does not require dedicated physical hardware; it uses logical isolation via software-defined networking on shared physical infrastructure, as per Google Cloud's multi-tenant design.

Full explanation →

413

MCQmedium

A company runs a web application on Compute Engine instances behind a managed instance group with autoscaling based on CPU utilization. After a marketing campaign, traffic spikes and the autoscaler adds instances quickly, but the application becomes slow. What is the most likely cause?

A.Autoscaler uses CPU utilization but the application is memory-bound

B.Instances are in different zones causing inter-zone latency

C.Autoscaling cooldown period is too short

D.Health check interval is too long

AnswerA

If the application is memory-bound, adding instances based on CPU does not help; the bottleneck remains memory.

Why this answer

The autoscaler adds instances based on CPU utilization, but if the application is memory-bound, adding more instances does not alleviate memory pressure. Each new instance still runs the same memory-intensive workload, so CPU may remain low while memory is exhausted, causing slowdowns. The autoscaler fails to address the actual bottleneck, leading to poor performance despite scaling out.

Exam trap

The trap here is that candidates assume CPU utilization is always the correct metric for scaling, but the question tests the understanding that autoscaling only works well when the chosen metric matches the actual bottleneck of the application.

How to eliminate wrong answers

Option B is wrong because managed instance groups with autoscaling can span multiple zones, but inter-zone latency within the same region is negligible (typically <1ms) and would not cause significant slowdowns. Option C is wrong because a cooldown period that is too short would cause the autoscaler to add instances too aggressively, not make the application slow; it might lead to over-provisioning or thrashing, but not directly to performance degradation. Option D is wrong because a health check interval that is too long delays detection of unhealthy instances, but does not cause the application to become slow; it affects availability, not performance under load.

Full explanation →

414

MCQeasy

A large online retailer operates a microservices-based e-commerce platform on Google Kubernetes Engine (GKE) across multiple zones. The application consists of several stateless services that handle customer traffic, inventory, and order processing. Recently, the company migrated its relational database to Cloud Spanner to achieve global scalability and strong consistency. After the migration, during peak shopping periods (e.g., Black Friday), the application experiences significant performance degradation. The operations team monitors CPU utilization of the pods and finds it consistently below 60% even under heavy load. However, Cloud Spanner metrics show high query latency and increased number of transactions waiting for lock conflicts. The team suspects that the bottleneck is now the database, not the compute. The application is designed to scale horizontally by adding more pod replicas. The team wants to ensure that scaling decisions are based on the actual performance bottleneck. What should they do?

A.Scale the GKE cluster to use larger node instances.

B.Increase the CPU request limit for the pods to allow higher CPU usage.

C.Reduce the number of pods to decrease Spanner load.

D.Modify the Horizontal Pod Autoscaler (HPA) to scale based on a custom metric that reflects Cloud Spanner query latency.

AnswerD

This aligns scaling with the actual bottleneck, increasing pods when Spanner latency rises.

Why this answer

Option D is correct because the Horizontal Pod Autoscaler (HPA) can be configured to scale based on custom metrics, such as Cloud Spanner query latency. Since the bottleneck is the database, scaling pods based on CPU utilization (which remains low) would not resolve the issue; instead, scaling based on Spanner latency ensures that the application adds replicas only when the database can handle more connections, reducing lock contention and improving overall performance.

Exam trap

Google Cloud often tests the misconception that CPU utilization is always the correct metric for scaling, but in this scenario, the bottleneck is the database, so candidates must recognize that custom metrics (like Spanner latency) are needed to scale the application appropriately.

How to eliminate wrong answers

Option A is wrong because scaling the GKE cluster to use larger node instances increases compute resources, but the bottleneck is the database (Cloud Spanner), not CPU or memory; larger nodes would not reduce Spanner query latency or lock conflicts. Option B is wrong because increasing the CPU request limit for pods does not address the database bottleneck; it would allow pods to consume more CPU, but CPU utilization is already below 60%, so this change would not improve Spanner performance and could waste resources. Option C is wrong because reducing the number of pods would decrease the load on Spanner, but it would also reduce the application's ability to handle customer traffic, potentially causing service degradation; the goal is to scale based on the actual bottleneck, not to arbitrarily reduce capacity.

Full explanation →

415

MCQeasy

A team uses Terraform to create a VPC as shown. They now need to add a Compute Engine instance in the subnet. Which of the following correctly references the subnet?

A.Set `network = google_compute_subnetwork.subnet.self_link`

B.Set `subnetwork = google_compute_subnetwork.subnet.self_link`

C.Set `subnetwork = google_compute_subnetwork.subnet.name`

D.Set `network = google_compute_network.vpc.name` and `subnetwork = google_compute_network.vpc.self_link`

AnswerB

self_link provides the full URL needed.

Why this answer

Option B is correct because when adding a Compute Engine instance to a subnet in Terraform, you must use the `subnetwork` argument (not `network`) and reference the subnet's `self_link` attribute. The `google_compute_subnetwork` resource's `self_link` provides the full URI required by the instance resource to attach to the correct subnet within the VPC.

Exam trap

Google Cloud often tests the distinction between `network` and `subnetwork` arguments, and the trap here is that candidates confuse the subnet's `name` attribute with its `self_link`, or mistakenly think the `network` argument can accept a subnet reference.

How to eliminate wrong answers

Option A is wrong because it sets `network = google_compute_subnetwork.subnet.self_link`, but the `network` argument expects a VPC network resource (e.g., `google_compute_network.vpc.self_link`), not a subnet self_link; this would cause a configuration error. Option C is wrong because `subnetwork = google_compute_subnetwork.subnet.name` uses only the subnet name, but the instance resource requires the full self_link URI to uniquely identify the subnet across projects or regions. Option D is wrong because it sets `network = google_compute_network.vpc.name` (which is a string name, not a self_link) and `subnetwork = google_compute_network.vpc.self_link` (which is a VPC self_link, not a subnet self_link); both arguments are incorrectly assigned, leading to a mismatch.

Full explanation →

416

Multi-Selecteasy

A company wants to monitor the health and performance of their applications running on Google Cloud. Which two Google Cloud services should they use together for comprehensive observability?

Select 2 answers

A.Cloud Monitoring

B.Cloud Profiler

C.Cloud Logging

D.Cloud Debugger

E.Cloud Trace

AnswersA, C

Cloud Monitoring is the primary service for metrics, uptime checks, and alerting.

Why this answer

Cloud Monitoring and Cloud Logging together form the core of Google Cloud's observability stack. Cloud Monitoring collects metrics, uptime checks, and alerting policies, while Cloud Logging ingests, stores, and analyzes log data. Combined, they provide the metrics, logs, and alerting needed to comprehensively monitor application health and performance.

Exam trap

Google Cloud often tests the distinction between observability services (Monitoring + Logging) and specialized tools (Profiler, Debugger, Trace), leading candidates to select all five options or mix debugging/profiling tools with core monitoring.

Full explanation →

417

Multi-Selectmedium

A financial services company must comply with strict data residency regulations. Which TWO cloud features help meet compliance requirements?

Select 2 answers

A.Data location controls

B.Open source software

C.Public internet access

D.Single data center footprint

E.Customer-managed encryption keys

AnswersA, E

Enables specifying where data is stored to comply with residency laws.

Why this answer

Data location controls (Option A) allow administrators to explicitly restrict where data is stored and processed, ensuring compliance with data residency regulations that mandate data remain within specific geographic boundaries. Customer-managed encryption keys (Option E) enable the organization to control who has access to the encryption keys, ensuring that even if data is stored in a cloud provider's infrastructure, the provider cannot decrypt it without the customer's permission, which is critical for meeting regulatory requirements.

Exam trap

Google Cloud often tests the misconception that any single data center footprint automatically satisfies data residency, when in fact compliance requires explicit location controls and encryption key management, not just physical location.

Full explanation →

418

MCQmedium

A DevOps team wants to automate their software build, test, and deployment process on Google Cloud. They need a service that triggers automatically when code is pushed to a repository, builds container images, runs tests, and deploys to production. Which Google Cloud product orchestrates this CI/CD pipeline?

A.Cloud Composer, Google Cloud's managed Apache Airflow service

B.Cloud Build, Google Cloud's managed CI/CD service that triggers on code pushes, builds images, runs tests, and deploys automatically

C.Cloud Scheduler, which triggers periodic jobs on a cron schedule

D.Eventarc, which routes events from Google Cloud services to Cloud Run functions

AnswerB

Cloud Build is the correct answer. It natively integrates with source repositories, executes multi-step build pipelines (test, build, deploy), builds container images, and deploys to Cloud Run, GKE, or App Engine. It's the primary Google Cloud CI/CD service.

Why this answer

Cloud Build is Google Cloud's managed CI/CD service that directly supports the described workflow: it can be triggered automatically by code pushes to a repository (e.g., Cloud Source Repositories, GitHub, Bitbucket), then execute a series of steps defined in a build configuration file (cloudbuild.yaml) to build container images, run tests, and deploy to production environments such as Google Kubernetes Engine, Cloud Run, or Compute Engine. This makes it the correct choice for orchestrating the entire CI/CD pipeline.

Exam trap

Google Cloud often tests the distinction between event-driven orchestration (Cloud Build) and general-purpose workflow schedulers (Cloud Composer) or event routers (Eventarc), leading candidates to confuse a CI/CD pipeline tool with a scheduling or event-routing service.

How to eliminate wrong answers

Option A is wrong because Cloud Composer is a managed Apache Airflow service designed for workflow orchestration and scheduling of complex pipelines, not for CI/CD triggered by code pushes; it lacks native integration for building container images or deploying to production as part of a code-push event. Option C is wrong because Cloud Scheduler is a cron-based job scheduler that triggers tasks on a time-based schedule, not on code repository events, and it does not provide CI/CD capabilities like building, testing, or deploying. Option D is wrong because Eventarc is an event routing service that delivers events from Google Cloud sources to targets like Cloud Run, but it does not itself build images, run tests, or deploy applications; it is a transport layer, not a CI/CD orchestrator.

Full explanation →

419

MCQeasy

A business wants to reduce the time to market for new features by enabling developers to provision infrastructure without waiting for IT. Which cloud attribute supports this?

A.Disaster recovery

B.Broad network access

C.High availability

D.On-demand self-service

AnswerD

Self-service enables instant resource provisioning without IT intervention.

Why this answer

On-demand self-service (Option D) is the correct answer because it allows developers to provision infrastructure automatically without requiring human interaction from IT. This cloud attribute, defined by NIST SP 800-145, enables users to unilaterally provision computing resources as needed, directly reducing time to market by eliminating manual approval and setup delays.

Exam trap

Google Cloud often tests the distinction between 'on-demand self-service' and 'broad network access' by presenting scenarios where remote access is confused with automated provisioning, leading candidates to incorrectly choose broad network access.

How to eliminate wrong answers

Option A is wrong because disaster recovery focuses on restoring services after failures, not on enabling rapid provisioning for new features. Option B is wrong because broad network access refers to resource availability over the network via standard protocols (e.g., HTTPS, SSH), not the ability to self-provision infrastructure. Option C is wrong because high availability ensures uptime and fault tolerance through redundancy, but does not address the self-service provisioning workflow that accelerates feature delivery.

Full explanation →

420

Multi-Selecthard

A business is considering moving to Google Cloud to accelerate innovation. Which THREE factors contribute to faster innovation in the cloud?

Select 3 answers

A.Access to advanced technologies like AI

B.Global scale for experiments

C.Longer procurement cycles

D.Rapid prototyping with managed services

E.Dedicated physical servers

AnswersA, B, D

Cloud provides cutting-edge AI/ML services without building from scratch.

Why this answer

Option A is correct because Google Cloud provides access to advanced technologies like AI/ML services (e.g., Vertex AI, AutoML, and pre-trained APIs) that would be costly and complex to build on-premises. These services allow businesses to integrate intelligent features into applications without deep expertise, accelerating innovation by reducing development time and enabling experimentation with cutting-edge capabilities.

Exam trap

Google Cloud often tests the misconception that 'dedicated physical servers' or 'longer procurement cycles' are benefits of cloud, when in fact they are inhibitors to innovation that cloud specifically eliminates.

Full explanation →

421

MCQeasy

A developer wants to run a small piece of code that resizes images whenever a new image is uploaded to Cloud Storage. The code runs for less than a second and should only be triggered by the upload event. No always-on server is needed. Which Google Cloud service is ideal?

A.A Compute Engine VM that runs continuously, checking for new uploads every minute.

B.Cloud Functions triggered by Cloud Storage object creation events.

C.Cloud Run with a permanent container that listens for uploads.

D.BigQuery scheduled query that processes new uploads daily.

AnswerB

Cloud Functions natively integrates with Cloud Storage events. A function is invoked automatically for each new upload, resizes the image, and terminates — no always-on server needed.

Why this answer

Cloud Functions is the ideal serverless compute service for event-driven, short-lived tasks like image resizing triggered by Cloud Storage uploads. It automatically scales to zero when idle, charges only for execution time (sub-second in this case), and natively binds to Cloud Storage object creation events via the `google.storage.object.finalize` trigger, eliminating the need for any always-on infrastructure.

Exam trap

Google Cloud often tests the distinction between event-driven serverless (Cloud Functions) and container-based serverless (Cloud Run), where candidates mistakenly choose Cloud Run because it 'can run code' without realizing it requires an HTTP endpoint and cannot be directly triggered by Cloud Storage events without an intermediary like Eventarc.

How to eliminate wrong answers

Option A is wrong because a continuously running Compute Engine VM is overkill and cost-inefficient for a sub-second task; it requires manual polling or a custom listener, defeating the serverless, event-driven requirement. Option C is wrong because Cloud Run with a permanent container implies a continuously running service that listens for uploads, which contradicts the 'no always-on server' requirement and incurs idle costs; Cloud Run is designed for HTTP requests, not direct event triggers from Cloud Storage. Option D is wrong because BigQuery scheduled queries are for batch analytics on data already in BigQuery, not for real-time event-driven image processing triggered by Cloud Storage uploads.

Full explanation →

422

MCQmedium

A company uses service accounts to allow their application running on a Compute Engine VM to access Cloud Storage. Which is the most secure way to configure this service account access?

A.Download the service account key JSON file and store it in the application's source code repository.

B.Attach the service account to the Compute Engine VM; the application obtains credentials automatically via the metadata server with no key files needed.

C.Grant all users the Storage Admin role so the application can access Cloud Storage through their credentials.

D.Create a shared service account key file accessible to all VMs via a Cloud Storage bucket.

AnswerB

VM-attached service accounts provide credentials automatically via the GCE metadata server. No key files are created or stored. ADC discovers these credentials automatically.

Why this answer

Option B is correct because attaching a service account to a Compute Engine VM allows the application to automatically obtain short-lived OAuth 2.0 access tokens from the instance metadata server (http://169.254.169.254). This eliminates the need to download, store, or manage any long-lived service account key files, which are a significant security risk. The metadata server provides credentials that are automatically rotated and scoped to the service account's IAM roles, making this the most secure method for accessing Cloud Storage from a VM.

Exam trap

Cisco often tests the misconception that storing keys in a repository or bucket is acceptable for automation, but the trap here is that any long-lived key file, even if stored in a bucket, is less secure than the automatic, short-lived credentials provided by the Compute Engine metadata server.

How to eliminate wrong answers

Option A is wrong because storing a service account key JSON file in the application's source code repository exposes the private key to anyone with repository access, violating the principle of least privilege and creating a persistent credential that can be leaked. Option C is wrong because granting all users the Storage Admin role is a gross over-privilege that violates the principle of least privilege and does not provide a service account for the application; it relies on user credentials which are not designed for automated workloads and introduces unnecessary security exposure. Option D is wrong because placing a shared service account key file in a Cloud Storage bucket still requires managing long-lived private keys, and any VM or user with read access to that bucket can exfiltrate the key, negating the security benefits of using service accounts on Compute Engine.

Full explanation →

423

MCQeasy

A company has a stateful application running on Compute Engine. They want to scale horizontally while preserving state. Which configuration should they use?

A.Use Cloud Run with volumes.

B.Unmanaged instance group.

C.Managed instance group with stateful configuration.

D.Managed instance group with autoscaling and no stateful configuration.

AnswerC

Stateful MIGs preserve instance names, disks, and metadata, allowing horizontal scaling while maintaining state.

Why this answer

Option C is correct because a managed instance group (MIG) with stateful configuration preserves instance-specific state (such as disks, hostnames, and metadata) across autohealing and rolling updates. This allows the stateful application to scale horizontally while maintaining its persistent data, as each instance retains its unique state even when the group is resized or instances are recreated.

Exam trap

The trap here is that candidates often assume all managed instance groups automatically preserve state, but without explicit stateful configuration, MIGs treat instances as ephemeral and will delete persistent disks on instance deletion or during rolling updates.

How to eliminate wrong answers

Option A is wrong because Cloud Run is a serverless platform designed for stateless containers; while it supports volumes, they are ephemeral or read-only (e.g., Cloud Storage FUSE or NFS), and Cloud Run does not natively preserve instance-level state across scaling events or container restarts. Option B is wrong because an unmanaged instance group does not provide autohealing, autoscaling, or stateful configuration; it requires manual management and cannot automatically preserve state during horizontal scaling. Option D is wrong because a managed instance group with autoscaling and no stateful configuration treats all instances as stateless; when instances are terminated or recreated, any local state (e.g., data on persistent disks) is lost, making it unsuitable for stateful applications.

Full explanation →

424

MCQmedium

A company wants to connect its on-premises data center to Google Cloud with a reliable, lower-latency connection that doesn't traverse the public internet, but doesn't need the bandwidth of a full Dedicated Interconnect. Which Google Cloud connectivity product is most appropriate?

A.Cloud VPN, which creates an encrypted IPsec tunnel over the public internet

B.Partner Interconnect, which provides private connectivity through a service provider partner's network — supporting lower bandwidth tiers without requiring a direct physical fiber connection

C.Dedicated Interconnect, which requires provisioning a 10 Gbps or 100 Gbps dedicated physical fiber connection

D.Cloud CDN, which caches content at edge locations close to the on-premises data center

AnswerB

Partner Interconnect is the right solution. It provides the private connectivity (no public internet) and lower latency characteristics of Dedicated Interconnect, but at lower bandwidth tiers (50 Mbps–50 Gbps) through a service provider partner — appropriate for organizations that don't need or justify a full Dedicated Interconnect circuit.

Why this answer

Partner Interconnect is the correct choice because it provides private connectivity between an on-premises data center and Google Cloud via a service provider partner's network, offering lower bandwidth tiers (e.g., 50 Mbps to 10 Gbps) without requiring a direct physical fiber connection. This meets the requirements for a reliable, lower-latency connection that avoids the public internet, while Dedicated Interconnect would be overkill for bandwidth needs below 10 Gbps.

Exam trap

The trap here is that candidates often confuse Partner Interconnect with Cloud VPN, assuming that any private connection must be encrypted or that VPN is sufficient for low-latency needs, but the key differentiator is that Partner Interconnect avoids the public internet entirely, providing consistent latency and SLA-backed reliability that IPsec VPNs cannot guarantee.

How to eliminate wrong answers

Option A is wrong because Cloud VPN creates an encrypted IPsec tunnel over the public internet, which does not provide a private connection that avoids the public internet and may introduce higher latency and variability. Option C is wrong because Dedicated Interconnect requires provisioning a minimum of 10 Gbps or 100 Gbps dedicated physical fiber connection, which exceeds the stated need for lower bandwidth and does not fit the 'doesn't need the bandwidth of a full Dedicated Interconnect' requirement. Option D is wrong because Cloud CDN is a content delivery network that caches content at edge locations for improved performance of web content, not a connectivity product for linking an on-premises data center to Google Cloud.

Full explanation →

425

MCQhard

A security team wants to ensure that only container images built by their approved CI/CD pipeline can run in their GKE cluster. Images built outside the approved process — even by internal engineers — should be blocked. Which Google Cloud security feature enforces this?

A.Cloud Armor — it blocks unauthorized container images at the load balancer.

B.Binary Authorization — requiring cryptographic attestations for container images before they can be deployed to GKE.

C.Cloud IAM — restricting `container.pods.create` permission to only the CI/CD service account.

D.Artifact Registry vulnerability scanning — blocking images with CVEs from being deployed.

AnswerB

Binary Authorization enforces that only images with valid attestations (created by the approved CI/CD pipeline using Cloud KMS keys) can be deployed to GKE. Unsigned or externally built images are blocked at admission.

Why this answer

Binary Authorization is the correct answer because it enforces deployment-time policy by requiring that container images have a valid cryptographic attestation (e.g., from a trusted CI/CD pipeline) before they can be scheduled on GKE. This ensures that only images built and signed by the approved process are allowed to run, blocking all others regardless of who built them.

Exam trap

The trap here is that candidates confuse access control (IAM) with image provenance enforcement, mistakenly thinking that restricting who can create pods (Option C) is sufficient to block unauthorized images, when in reality a CI/CD service account could still deploy an unsigned image if not prevented by Binary Authorization.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall and DDoS protection service that operates at the load balancer layer, not a container image admission controller; it cannot inspect or block container images at the pod-creation level. Option C is wrong because restricting `container.pods.create` permission to only the CI/CD service account would prevent engineers from directly creating pods, but it would not block images built outside the approved pipeline if those images were pushed to a registry and referenced by a pod created by the CI/CD service account; it controls who can create pods, not which images can be used. Option D is wrong because Artifact Registry vulnerability scanning identifies CVEs in images but does not enforce admission policies; it provides security insights but does not block deployment of images lacking attestations.

Full explanation →

426

MCQhard

A large enterprise has 200+ applications and is developing its cloud migration strategy. A cloud architect argues that not all applications should be migrated the same way. Which migration strategy framework best organizes the different approaches for moving applications to cloud?

A.All applications should be completely rewritten as cloud-native microservices for maximum cloud benefit

B.A portfolio-based migration framework (such as the 6 Rs: Rehost, Replatform, Refactor, Repurchase, Retire, Retain) that applies the right migration strategy to each application based on its business value and cloud-readiness

C.Migrate all applications simultaneously during a single weekend cutover to minimize the total migration duration

D.Keep all applications on-premises until a complete cloud-native replacement is built for each one

AnswerB

The 6 Rs framework is the industry-standard answer for enterprise migration portfolio management. Simple internal apps: rehost (lift-and-shift). Commercially available replacements: repurchase. End-of-life apps: retire. Mission-critical legacy: retain. The right strategy for each application maximizes value while managing risk and cost.

Why this answer

Option B is correct because a portfolio-based migration framework like the 6 Rs (Rehost, Replatform, Refactor, Repurchase, Retire, Retain) provides a structured, risk-aware approach to cloud migration. It recognizes that each application has unique business value, technical debt, and cloud-readiness, so a one-size-fits-all strategy would be inefficient or disruptive. This framework aligns migration tactics with business objectives, enabling the enterprise to optimize cost, performance, and operational continuity across a diverse application portfolio.

Exam trap

Google Cloud often tests the misconception that all applications must be fully re-architected (Refactor) to gain cloud benefits, when in reality a balanced portfolio approach using the 6 Rs is more practical and cost-effective for large-scale migrations.

How to eliminate wrong answers

Option A is wrong because completely rewriting all 200+ applications as cloud-native microservices is impractical, costly, and time-consuming; it ignores the reality that many legacy applications may not benefit from microservices and can be migrated more efficiently via rehosting or replatforming. Option C is wrong because migrating all applications simultaneously during a single weekend cutover is extremely high-risk, likely causing widespread outages, data loss, and failed migrations due to the lack of testing and rollback capability; it violates the principle of incremental, validated migration. Option D is wrong because keeping all applications on-premises until a complete cloud-native replacement is built for each one defeats the purpose of cloud migration, delays benefits, and incurs unnecessary maintenance costs; it ignores the possibility of using lift-and-shift (Rehost) or other intermediate strategies to gain immediate cloud advantages.

Full explanation →

427

MCQeasy

A company is concerned that employees might accidentally or maliciously upload sensitive personal data (such as credit card numbers or Social Security Numbers) to Cloud Storage buckets. Which Google Cloud product can automatically scan uploaded files and identify sensitive data patterns?

A.Cloud Armor, which inspects incoming HTTP requests for sensitive data patterns

B.Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection

C.Cloud Logging, which records all file upload events to Cloud Storage

D.Security Command Center, which audits Cloud Storage bucket permissions

AnswerB

Cloud DLP is the correct answer. It has 150+ built-in infoTypes for detecting sensitive data patterns (credit card numbers matching Luhn algorithm, SSN format detection, etc.) and can scan Cloud Storage objects on a scheduled or triggered basis, flagging or de-identifying findings.

Why this answer

Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to inspect and classify sensitive data within Cloud Storage objects. It uses built-in detectors (infoTypes) to identify patterns like credit card numbers (Luhn check) and Social Security Numbers, and can trigger automated actions such as redaction or logging when sensitive data is found.

Exam trap

The trap here is confusing a security monitoring or perimeter defense service (Cloud Armor, Security Command Center) with a content-aware data classification service (Cloud DLP), leading candidates to pick a service that audits permissions or logs events rather than one that inspects file contents for sensitive patterns.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) that protects against DDoS and OWASP Top 10 threats by inspecting HTTP/S traffic at the edge, not by scanning stored files for sensitive data patterns. Option C is wrong because Cloud Logging captures and stores audit logs of events (e.g., object uploads) but does not perform content inspection or pattern matching on the uploaded data. Option D is wrong because Security Command Center provides a centralized view of security risks and misconfigurations (e.g., public bucket permissions) but does not scan object contents for sensitive data patterns.

Full explanation →

428

MCQeasy

A company wants to store archival data that must be retained for 10 years. The data is accessed less than once a year. Which Cloud Storage class is the most cost-effective?

A.Standard Storage

B.Nearline Storage

C.Coldline Storage

D.Archive Storage

AnswerD

Archive storage is the cheapest for data accessed less than once a year.

Why this answer

Archive Storage is the most cost-effective option for data that must be retained for 10 years and is accessed less than once a year. This class offers the lowest storage cost among Google Cloud Storage classes, specifically designed for long-term preservation of data that is rarely accessed, with a minimum storage duration of 365 days and higher retrieval costs that are acceptable given the infrequent access pattern.

Exam trap

Google Cloud often tests the misconception that 'Coldline' is the cheapest storage class, but Archive Storage is actually the lowest-cost option for long-term retention with very infrequent access, and candidates may overlook the minimum storage duration and retrieval cost trade-offs.

How to eliminate wrong answers

Option A is wrong because Standard Storage is optimized for frequently accessed data with no minimum storage duration and higher per-GB storage costs, making it cost-prohibitive for 10-year archival retention. Option B is wrong because Nearline Storage is designed for data accessed less than once a month, with a 30-day minimum storage duration and higher storage costs than Archive Storage, making it less cost-effective for data accessed less than once a year. Option C is wrong because Coldline Storage is intended for data accessed less than once a quarter, with a 90-day minimum storage duration and storage costs that are still higher than Archive Storage, so it is not the most cost-effective for 10-year archival with annual access.

Full explanation →

429

Drag & Dropmedium

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

The correct sequence starts with containerizing the app, creating a cluster, defining the deployment, applying it, and exposing it as a service.

Full explanation →

430

MCQmedium

A startup wants to minimize upfront costs and shift from capital expenditure to operational expenditure. Which cloud pricing model enables this transformation?

A.Pay-as-you-go

B.Reserved instances

C.Committed use discounts

D.Sustained use discounts

AnswerA

Pay-as-you-go eliminates upfront costs, shifting to OpEx.

Why this answer

Option B is correct because pay-as-you-go allows customers to pay only for what they use without upfront commitments, converting CapEx to OpEx. Reserved instances (A) require upfront commitment, committed use discounts (C) also involve commitments, and sustained use discounts (D) are automatic but still based on usage.

Full explanation →

431

MCQeasy

A company wants to innovate quickly by leveraging machine learning without building models from scratch. Which Google Cloud service allows them to use pre-trained models via APIs?

A.BigQuery ML

B.AI Platform

C.Cloud Vision API

D.AutoML

AnswerC

Cloud Vision API offers pre-trained models via simple API calls.

Why this answer

Cloud Vision API is correct because it provides pre-trained machine learning models via REST APIs, allowing the company to integrate image recognition capabilities (e.g., label detection, OCR, face detection) without building or training any models. This directly meets the requirement of leveraging ML without building from scratch, as the API abstracts all model training and deployment.

Exam trap

Google Cloud often tests the distinction between 'pre-trained APIs' and 'custom model training services'—candidates mistakenly choose AutoML because they think 'no building from scratch' means no coding, but AutoML still requires training a custom model, not using a pre-trained one.

How to eliminate wrong answers

Option A is wrong because BigQuery ML enables users to create and train custom ML models using SQL queries on data in BigQuery, but it does not provide pre-trained models via APIs—it requires building models from scratch. Option B is wrong because AI Platform is a managed service for training, deploying, and scaling custom ML models, but it does not offer pre-trained models via APIs; it is designed for custom model workflows. Option D is wrong because AutoML allows users to train custom models on their own data with minimal ML expertise, but it still requires training a model from scratch rather than using pre-trained models via APIs.

Full explanation →

432

MCQeasy

A startup's website becomes unexpectedly popular and traffic spikes 50x within minutes. The application is hosted on Google Cloud. Which Google Cloud product automatically increases the number of application instances in response to this traffic spike without manual intervention?

A.Cloud Monitoring, which detects the traffic spike and sends an alert to the operations team to manually scale up

B.Managed Instance Groups with autoscaling (for VMs) or Cloud Run (for containers), which automatically provision additional instances based on traffic load without manual intervention

C.Cloud Load Balancing, which distributes traffic evenly across existing instances to handle the spike

D.Cloud Billing, which automatically increases the spending limit when traffic spikes occur

AnswerB

This is correct. MIG autoscaling monitors CPU/request metrics and automatically adds instances when load increases, then removes them when load drops. Cloud Run scales automatically to any number of container instances in seconds. Both handle the 50x spike scenario automatically.

Why this answer

Managed Instance Groups (MIGs) with autoscaling and Cloud Run both automatically adjust the number of running instances or container replicas based on real-time metrics like CPU utilization, request rate, or latency. When traffic spikes 50x, the autoscaler detects the increased load and provisions new VMs or container instances without any manual intervention, ensuring the application remains responsive. This is the only option that provides automatic, infrastructure-level scaling in response to load.

Exam trap

Cisco often tests the misconception that load balancing alone handles spikes, but candidates must remember that load balancers distribute traffic only to existing instances — autoscaling is required to add capacity.

How to eliminate wrong answers

Option A is wrong because Cloud Monitoring only collects metrics and sends alerts; it does not automatically scale instances — scaling requires a separate service like MIG autoscaler or Cloud Run. Option C is wrong because Cloud Load Balancing distributes traffic across existing instances but does not create new instances; it relies on an autoscaler to add capacity. Option D is wrong because Cloud Billing manages budgets and spending limits, not instance provisioning; it has no mechanism to scale application instances.

Full explanation →

433

MCQeasy

A company wants to optimize Cloud Storage costs for a bucket containing 100 TB of access logs. The logs from the last 7 days are frequently analyzed; logs from 8–90 days are occasionally reviewed; logs older than 90 days are archived for compliance but rarely accessed. What is the most cost-effective storage class configuration?

A.Store all 100 TB in Standard storage for consistent access performance.

B.Configure lifecycle rules: Standard (0-7 days) → Nearline (8-90 days) → Archive (90+ days).

C.Delete all logs older than 7 days to minimize storage costs.

D.Store all logs in Archive storage since most are rarely accessed.

AnswerB

Lifecycle Management automatically transitions objects between storage classes as they age. Standard for active logs, Nearline for occasional review, Archive for compliance retention — each class priced for its access pattern.

Why this answer

Option B is correct because it aligns the storage class with the access patterns of the logs: Standard for frequently accessed recent data, Nearline for occasional access, and Archive for rarely accessed compliance data. This minimizes costs by using cheaper storage for older data while maintaining performance for active analysis. Lifecycle rules automate the transition, ensuring no manual intervention is needed.

Exam trap

Google Cloud often tests the misconception that Archive storage is always the cheapest option, ignoring the retrieval costs and latency for frequently accessed data, leading candidates to choose Option D.

How to eliminate wrong answers

Option A is wrong because storing all 100 TB in Standard storage is unnecessarily expensive for logs older than 7 days that are rarely accessed. Option C is wrong because deleting logs older than 7 days violates compliance requirements and loses data that may be needed for audits or occasional review. Option D is wrong because storing all logs in Archive storage would cause high retrieval costs and latency for the frequently accessed last 7 days of logs, making it impractical for active analysis.

Full explanation →

434

MCQmedium

A company has a production database running on Cloud SQL. They need to perform maintenance on the primary instance without downtime. Which feature allows this?

A.Read replicas with failover

B.Database import/export

C.Multi-region deployment

D.Automated backups

AnswerA

Read replicas can be promoted, allowing maintenance on the primary without downtime.

Why this answer

Read replicas with failover allow you to promote a read replica to a new primary instance in the event of a planned maintenance or failure, enabling zero-downtime operations. Cloud SQL uses this feature to redirect traffic seamlessly by updating the DNS record to point to the promoted replica, ensuring the database remains available during maintenance.

Exam trap

Google Cloud often tests the misconception that automated backups or multi-region deployment alone provide high availability, but the key is that only read replicas with failover offer a hot standby that can be promoted without downtime.

How to eliminate wrong answers

Option B is wrong because database import/export is a data migration tool (e.g., using mysqldump or pg_dump) that requires downtime for consistent snapshots and does not provide automatic failover or continuous availability. Option C is wrong because multi-region deployment in Cloud SQL is not a built-in feature; Cloud SQL supports regional instances only, and true multi-region failover requires external configurations like cross-region replication with additional services. Option D is wrong because automated backups create point-in-time recovery snapshots but do not provide a standby instance for failover; backups are for data restoration, not for maintaining uptime during maintenance.

Full explanation →

435

Multi-Selecthard

Which THREE are required to achieve HIPAA compliance on Google Cloud?

Select 3 answers

A.Sign a Business Associate Agreement (BAA) with Google

B.Enable Cloud Audit Logs for tracking access to ePHI

C.Use only GCP services that are covered under the BAA

D.Use a dedicated project for all PHI workloads

E.Configure multi-factor authentication for all users

AnswersA, B, C

Correct: A BAA is required for HIPAA compliance.

Why this answer

Option A is correct because HIPAA requires covered entities and their business associates to have a written agreement that establishes the permitted and required uses of protected health information (PHI). Google Cloud provides a standard Business Associate Agreement (BAA) that customers must sign to contractually bind Google to HIPAA obligations, including safeguarding ePHI and reporting breaches. Without a signed BAA, Google is not legally liable as a business associate under HIPAA, making this a foundational requirement for compliance.

Exam trap

Google Cloud often tests the misconception that HIPAA requires dedicated infrastructure (like a separate project) or specific security controls (like MFA), when in fact HIPAA focuses on contractual agreements (BAA), data access logging, and using only services that are contractually covered under the BAA.

Full explanation →

436

MCQeasy

A company is deciding whether to store a large video archive (hundreds of terabytes, accessed perhaps twice per year for legal holds) in Google Cloud. Which Cloud Storage class is designed for this infrequently accessed, long-term archival use case?

A.Standard storage, which provides the lowest latency and highest availability for frequently accessed data

B.Archive storage, which offers the lowest storage cost for data accessed less than once per year, accepting higher retrieval costs and latency for infrequent access

C.Nearline storage, for data accessed approximately once per month

D.Coldline storage, for data accessed approximately once per quarter

AnswerB

Archive storage is specifically designed for the described use case: massive data volumes, very infrequent access (legal holds qualify as rare events). The trade-off — higher retrieval cost and latency — is acceptable when access is measured in times per year rather than times per day.

Why this answer

Archive storage is the correct choice because it is specifically designed for data that is accessed less than once per year, offering the lowest storage cost among Google Cloud Storage classes. This aligns perfectly with the use case of a large video archive accessed only twice per year for legal holds, where higher retrieval costs and latency are acceptable trade-offs for long-term preservation.

Exam trap

Cisco often tests the specific access frequency thresholds for each storage class (e.g., Nearline for monthly, Coldline for quarterly, Archive for yearly or less), and the trap here is that candidates may confuse Coldline (quarterly) with Archive (yearly) due to similar names implying 'cold' storage.

How to eliminate wrong answers

Option A is wrong because Standard storage is optimized for frequently accessed data with low latency and high availability, not for infrequently accessed archival data, and would incur unnecessary costs. Option C is wrong because Nearline storage is intended for data accessed approximately once per month, which does not match the twice-per-year access pattern. Option D is wrong because Coldline storage is designed for data accessed approximately once per quarter, still more frequent than the described use case, and would result in higher storage costs than Archive storage.

Full explanation →

437

MCQeasy

A web application's homepage loads user-specific data (shopping cart, recent orders) on every visit. The data changes frequently. An engineer suggests caching this data in a Redis cache between the web tier and the database. What is the primary benefit of this caching layer?

A.Caching encrypts data in transit between the web tier and database.

B.Caching reduces database load and improves response times by serving frequently accessed data from fast in-memory storage.

C.Caching permanently stores user data so the database can be deleted.

D.Caching automatically synchronizes data between multiple database replicas.

AnswerB

Redis/Memorystore serves cache hits in microseconds vs. database queries in milliseconds. Fewer DB queries = lower DB load, faster responses, and ability to handle more concurrent users.

Why this answer

Option B is correct because caching user-specific data like shopping carts and recent orders in Redis reduces the load on the primary database by serving frequently accessed data from fast in-memory storage. This improves response times for the web application, as Redis can deliver data in microseconds compared to the millisecond latency of a typical relational database query. The caching layer acts as a temporary, high-speed buffer that offloads read-heavy traffic from the database, which is especially beneficial for data that changes frequently but is read often.

Exam trap

Google Cloud often tests the misconception that caching provides permanent storage or replaces the database, leading candidates to incorrectly select Option C, but the trap here is that caching is a temporary, performance-enhancing layer, not a durable storage solution.

How to eliminate wrong answers

Option A is wrong because caching does not inherently encrypt data in transit; encryption is a separate concern typically handled by TLS/SSL between the web tier and the database, not by the caching layer itself. Option C is wrong because caching is not a permanent storage solution; Redis is an in-memory store that can lose data on restart unless persistence is configured, and the database remains the authoritative source of truth for user data. Option D is wrong because caching does not automatically synchronize data between database replicas; that is the role of database replication mechanisms (e.g., MySQL Group Replication or PostgreSQL streaming replication), not a cache layer.

Full explanation →

438

MCQeasy

A startup wants to run a containerized web application that scales to zero when not in use, and only pay for the time the container is processing requests. Which Google Cloud compute service should they choose?

A.Google Kubernetes Engine (GKE)

B.App Engine Standard Environment

C.Cloud Run

D.Compute Engine with autoscaling

AnswerC

Cloud Run runs containers and scales to zero, ideal for pay-per-use.

Why this answer

Cloud Run is the correct choice because it is a fully managed serverless compute platform that automatically scales your containerized application to zero when there are no incoming requests. You are billed only for the resources consumed during request processing, measured in 100-millisecond increments, which aligns perfectly with the requirement to pay only for active processing time.

Exam trap

The trap here is that candidates often confuse 'scaling to zero' with 'autoscaling' and choose Compute Engine or GKE, not realizing that those services require at least one running instance or node, whereas Cloud Run is the only option that can truly scale down to zero instances when idle.

How to eliminate wrong answers

Option A is wrong because Google Kubernetes Engine (GKE) requires at least one node to run your containers, even if the application is idle, and does not scale to zero; you pay for the underlying node VMs regardless of usage. Option B is wrong because App Engine Standard Environment does not support arbitrary containerized applications; it runs only in a sandboxed runtime environment with specific language runtimes and does not allow you to bring your own Docker container. Option D is wrong because Compute Engine with autoscaling still requires a minimum number of running VM instances (even if set to 1) and does not scale to zero; you are billed for the provisioned VM instances even when no requests are being processed.

Full explanation →

439

MCQmedium

A data analytics team uses BigQuery for large-scale queries. They notice that queries are scanning more data than necessary, leading to high costs. Which feature should they implement to reduce the amount of data scanned per query?

A.Materialized views

B.Streaming inserts

C.Partitioning

D.Clustering

AnswerC

Partitioning divides a table into segments based on a column, allowing queries to scan only relevant partitions, reducing cost.

Why this answer

Partitioning divides a table into segments based on a column (e.g., date), allowing BigQuery to prune partitions during query execution. When a query includes a filter on the partitioning column, BigQuery scans only the relevant partitions, significantly reducing the bytes processed and lowering costs.

Exam trap

Google Cloud often tests the distinction between partitioning (which reduces data scanned by pruning entire segments) and clustering (which only reorganizes data within partitions for better compression and filtering, but does not reduce the total data scanned unless combined with partitioning).

How to eliminate wrong answers

Option A is wrong because materialized views precompute and cache query results for faster performance, but they do not reduce the amount of raw data scanned per query; they may even increase storage costs. Option B is wrong because streaming inserts are used for real-time data ingestion into BigQuery, not for controlling data scan volume during queries. Option D is wrong because clustering sorts data within partitions based on column values, improving query performance and reducing costs only after partitioning is applied; without partitioning, clustering alone does not limit the total data scanned.

Full explanation →

440

MCQeasy

A company's cloud environment has grown rapidly and the team is struggling to understand what cloud resources exist across dozens of projects. Which Google Cloud product provides a unified inventory of all cloud assets across an organization's projects and folders?

A.Cloud Billing console, which lists all resources that have incurred charges

B.Cloud Asset Inventory, which provides a searchable, unified inventory of all resources and IAM policies across an organization's projects and folders

C.Google Cloud Console project dashboard, which shows resources within a single project

D.Security Command Center, which lists security vulnerabilities in cloud resources

AnswerB

Cloud Asset Inventory is the correct service. It maintains a complete, searchable catalog of all resources (and their configurations) across the entire organization, supports historical queries, and integrates with policy analysis tools. This is the purpose-built service for organizational resource visibility.

Why this answer

Cloud Asset Inventory is the correct answer because it is the Google Cloud service specifically designed to provide a unified, searchable inventory of all cloud assets (resources and IAM policies) across an organization's projects, folders, and organization nodes. It supports real-time and historical snapshots, enabling teams to discover and track resources as the environment scales. This directly addresses the need to understand what resources exist across dozens of projects.

Exam trap

Cisco often tests the distinction between a unified inventory service (Cloud Asset Inventory) and a security-focused tool (Security Command Center), leading candidates to mistakenly choose the latter because they associate 'inventory' with security asset management.

How to eliminate wrong answers

Option A is wrong because the Cloud Billing console only lists resources that have incurred charges, not a comprehensive inventory of all assets (including free-tier or non-billable resources), and it does not provide a unified view across projects and folders. Option C is wrong because the Google Cloud Console project dashboard shows resources only within a single project, not across dozens of projects and folders as required. Option D is wrong because Security Command Center focuses on security vulnerabilities and threats, not on providing a unified inventory of all cloud assets.

Full explanation →

441

MCQmedium

A company's IT team is planning its network architecture for a Google Cloud deployment. They want to ensure that their development, staging, and production environments are completely isolated from each other at the network level. What is the most effective way to achieve this isolation in Google Cloud?

A.Using separate subnets within the same VPC for each environment, with firewall rules blocking cross-subnet traffic

B.Deploying each environment (dev, staging, prod) in separate VPC networks — optionally in separate Google Cloud projects — to achieve complete network isolation with no default connectivity between environments

C.Using different IP address ranges for each environment within the same network

D.Using Cloud IAM to restrict developers from accessing production resources, which achieves the same isolation as network separation

AnswerB

Separate VPCs provide true network isolation. By default, separate VPCs have no connectivity. Traffic between them requires explicit peering, VPN, or Shared VPC configuration. Using separate projects adds IAM-level access control on top of network isolation.

Why this answer

Option B is correct because deploying each environment in separate VPC networks (optionally in separate projects) provides complete network isolation by default. In Google Cloud, VPC networks are isolated entities with no inherent peering or connectivity; traffic between them requires explicit VPC peering or VPN configurations. This ensures that development, staging, and production environments cannot communicate at the network layer unless intentionally connected, meeting the requirement for complete isolation.

Exam trap

The trap here is that candidates assume firewall rules or IAM can achieve the same level of isolation as separate VPCs, but network-level isolation requires separate routing domains, not just access controls or IP address segmentation.

How to eliminate wrong answers

Option A is wrong because using separate subnets within the same VPC still allows routing between subnets by default; firewall rules can block traffic, but they are not a guarantee of complete network isolation (e.g., misconfigurations or implicit routes can bypass them). Option C is wrong because using different IP address ranges within the same network does not provide isolation; all subnets in a VPC can communicate via internal routes unless explicitly blocked, and the network itself is a single broadcast domain. Option D is wrong because Cloud IAM controls access at the identity and resource level, not at the network layer; it cannot prevent network-level connectivity between environments, such as direct IP traffic or lateral movement within the same VPC.

Full explanation →

442

MCQhard

A financial services company needs a managed data warehouse that can ingest streaming transaction data in real time AND support complex SQL analytics across years of historical data — all without managing any infrastructure. Which Google Cloud product meets both streaming ingest and analytical query requirements in a single serverless service?

A.Cloud Bigtable for streaming ingest and BigQuery for historical analytics — two separate services

B.BigQuery, which supports real-time streaming ingest via its Storage Write API and large-scale analytical SQL queries across petabytes of data in a single fully managed, serverless service

C.Cloud SQL with read replicas — one instance for streaming writes, read replicas for analytical queries

D.Cloud Dataflow running continuously to process the stream and load to Persistent Disk for SQL queries

AnswerB

BigQuery meets both requirements natively. The Storage Write API (and legacy streaming API) enables sub-minute data availability for analytics. BigQuery's distributed query engine handles analytical SQL across petabytes. No infrastructure to manage, no separate streaming and analytical systems to maintain.

Why this answer

BigQuery is a fully managed, serverless data warehouse that supports real-time streaming ingest via the Storage Write API and enables complex SQL analytics across petabytes of historical data. This single service meets both requirements without any infrastructure management, unlike the other options that require separate services or manual orchestration.

Exam trap

Google Cloud often tests the misconception that streaming ingest and analytical querying require separate services, leading candidates to overlook BigQuery's unified serverless capability in favor of multi-service architectures like Cloud Bigtable plus BigQuery.

How to eliminate wrong answers

Option A is wrong because it proposes two separate services (Cloud Bigtable for streaming and BigQuery for analytics), which violates the requirement for a single serverless service and introduces operational complexity. Option C is wrong because Cloud SQL is a relational database not designed for petabyte-scale analytics or real-time streaming ingest at high throughput, and read replicas do not provide serverless, managed data warehousing. Option D is wrong because Cloud Dataflow is a stream processing service, not a data warehouse, and Persistent Disk is block storage that cannot natively support SQL analytics without additional compute and query engines.

Full explanation →

443

MCQhard

An organization wants to ensure that Google Cloud services used by its employees cannot be used to exfiltrate data to a competitor's Google Cloud project. For example, they want to prevent copying data from their Cloud Storage bucket to a Storage bucket owned by a competitor. Which Google Cloud security control most directly prevents this type of insider data exfiltration?

A.IAM permissions that restrict users from accessing competitor projects

B.Cloud DLP, by scanning and redacting sensitive data before it can be stored

C.VPC Service Controls, which create a security perimeter around Google Cloud APIs so data cannot be moved to projects outside the defined perimeter

D.Organization Policy constraints that prevent resource creation in competitor accounts

AnswerC

VPC Service Controls are precisely designed for this. A service perimeter defines which projects can exchange data with each other. Even if a user has valid credentials, the API enforces that data cannot be read from inside the perimeter and written outside it — blocking the insider exfiltration pattern described.

Why this answer

VPC Service Controls (C) directly prevent data exfiltration by creating a security perimeter around Google Cloud APIs. This perimeter blocks any data movement to resources outside the defined perimeter, such as a competitor's Cloud Storage bucket, regardless of the user's IAM permissions. It works at the API layer, intercepting requests that attempt to copy data to an unauthorized project.

Exam trap

The trap here is that candidates often confuse IAM permissions with network-level controls, assuming that restricting IAM access to competitor projects is sufficient, but VPC Service Controls are the only mechanism that enforces a boundary at the API layer regardless of user identity.

How to eliminate wrong answers

Option A is wrong because IAM permissions control access to resources within a project, but they do not prevent a user with legitimate access to a source bucket from copying data to a destination bucket in a different project if the user has permissions on that destination. Option B is wrong because Cloud DLP scans and redacts sensitive data but does not block the transfer of data to an external project; it only modifies the content. Option D is wrong because Organization Policy constraints can restrict resource creation in competitor accounts, but they do not prevent data exfiltration from existing resources to already-created competitor projects.

Full explanation →

444

MCQhard

A company's application is composed of 15 microservices. When a performance issue occurs, the team struggles to determine which service is causing latency since request traces span multiple services. Which Google Cloud service helps identify which specific service in a microservices chain is causing slowdowns?

A.Cloud Logging — search logs for error messages across all 15 services.

B.Cloud Trace — captures distributed request traces showing end-to-end latency across all microservices.

C.Cloud Monitoring dashboards — create per-service CPU utilization graphs.

D.Security Command Center — scan for misconfigurations causing performance issues.

AnswerB

Cloud Trace shows the complete request journey: which service was called, in what order, and how long each call took. The Gantt-chart view immediately reveals the latency culprit service.

Why this answer

Cloud Trace is designed specifically for distributed tracing in microservices architectures. It captures end-to-end latency data for each request as it traverses multiple services, allowing you to pinpoint which service in the chain is introducing the most delay. This directly addresses the problem of identifying the specific service causing slowdowns in a 15-service application.

Exam trap

The trap here is that candidates confuse Cloud Logging (which shows error messages) with Cloud Trace (which shows latency timing), or assume CPU utilization graphs (Cloud Monitoring) can pinpoint request-level slowdowns, when only distributed tracing can reveal the exact service in the chain causing the delay.

How to eliminate wrong answers

Option A is wrong because Cloud Logging is for aggregating and searching log entries, not for tracing request latency across services; it cannot show the per-service timing breakdown needed to identify the slowest service. Option C is wrong because Cloud Monitoring dashboards showing per-service CPU utilization can indicate resource pressure but do not trace individual requests across services, so they cannot reveal which service in a specific request chain is causing latency. Option D is wrong because Security Command Center focuses on security misconfigurations and vulnerabilities, not on performance latency or distributed tracing.

Full explanation →

445

MCQeasy

What does 'high availability' mean in the context of cloud services, and how is it typically measured?

A.High availability means a system is fast — it responds to requests in under 100 milliseconds.

B.High availability means a system is operational for a very high percentage of time, typically measured as a percentage (e.g., 99.9% uptime).

C.High availability means a system stores data in multiple geographic locations for disaster recovery.

D.High availability requires manual intervention to restart failed services within 30 minutes.

AnswerB

HA is quantified as an uptime percentage over a period. 99.9% = ~8.7 hours downtime/year; 99.99% = ~53 minutes/year. Achieved through redundancy and automatic failover.

Why this answer

High availability (HA) refers to a system's ability to remain operational and accessible for an exceptionally high proportion of time, minimizing downtime. It is typically quantified as a percentage of uptime over a defined period, such as 99.9% ('three nines'), which corresponds to approximately 8.76 hours of downtime per year. This metric is fundamental in cloud service level agreements (SLAs) to guarantee service continuity.

Exam trap

Google Cloud often tests the distinction between high availability (uptime percentage) and related but distinct concepts like disaster recovery (geographic redundancy) or performance (latency), so candidates must focus on the precise definition of availability as operational uptime rather than other operational characteristics.

How to eliminate wrong answers

Option A is wrong because high availability is not about raw speed or low latency; it is about uptime and reliability, not performance metrics like sub-100ms response times. Option C is wrong because while geographic data replication supports disaster recovery, it is a specific strategy for data resilience, not the definition or measurement of high availability itself. Option D is wrong because high availability is designed to be automatic, often using failover clusters or load balancers, and requiring manual intervention within 30 minutes contradicts the goal of minimizing downtime without human action.

Full explanation →

446

Multi-Selecthard

A company uses Cloud Spanner for a global application. They need to ensure high availability and disaster recovery across regions. Which TWO actions should they take? (Choose 2)

Select 2 answers

A.Deploy the database in a single region with backups

B.Schedule regular backups using Cloud Spanner backup feature

C.Configure read replicas in a different region

D.Use Cloud Memorystore to cache database queries

E.Use a multi-region instance configuration

AnswersB, E

Backups protect against data loss and allow point-in-time recovery.

Why this answer

Option B is correct because Cloud Spanner's built-in backup feature allows you to create consistent backups of your database without impacting performance, and these backups can be restored to a different region for disaster recovery. This provides a reliable way to recover from regional failures or data corruption, ensuring high availability and DR across regions.

Exam trap

Google Cloud often tests the misconception that read replicas or caching services like Memorystore can provide cross-region disaster recovery, but Cloud Spanner's architecture relies on synchronous multi-region replication and backups, not asynchronous replicas or external caches.

Full explanation →

447

Matchingmedium

Match each Google Cloud data service to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Managed relational database (MySQL, PostgreSQL, SQL Server)

Globally distributed, strongly consistent relational database

NoSQL document database for mobile and web apps

NoSQL wide-column database for large analytical workloads

Managed in-memory cache (Redis/Memcached)

Why these pairings

These are the primary managed database services in Google Cloud.

Full explanation →

448

MCQmedium

A power utility company collects electricity meter readings from 10 million smart meters every 15 minutes — generating billions of rows of time-series data per year. They need to query this data to detect anomalies and patterns. Which Google Cloud database is optimized for this massive-scale time-series IoT data?

A.Cloud SQL (PostgreSQL)

B.Cloud Bigtable

C.Firestore

D.Cloud Storage (CSV files)

AnswerB

Bigtable is designed for exactly this workload: massive time-series data from IoT devices. Row key (meter_id + timestamp) enables efficient range scans. Handles petabytes with sub-millisecond latency.

Why this answer

Cloud Bigtable is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, making it ideal for ingesting and querying high-throughput time-series data from millions of IoT devices. It supports sub-10ms latency on queries, automatic sharding, and seamless integration with Google Cloud's data analytics ecosystem (e.g., BigQuery, Dataflow), which is critical for detecting anomalies and patterns across billions of rows of meter readings.

Exam trap

The trap here is that candidates confuse 'time-series data' with 'relational data' and choose Cloud SQL (PostgreSQL) for its SQL familiarity, overlooking the need for massive horizontal scalability and high write throughput that only Bigtable provides.

How to eliminate wrong answers

Option A is wrong because Cloud SQL (PostgreSQL) is a relational OLTP database not optimized for the extreme write throughput and horizontal scaling required for billions of time-series rows; it would hit performance bottlenecks and storage limits. Option C is wrong because Firestore is a document-oriented NoSQL database designed for real-time mobile/web apps with moderate write rates, not for massive-scale IoT time-series ingestion and analytical queries. Option D is wrong because Cloud Storage with CSV files lacks native querying capabilities, indexing, and low-latency access needed for real-time anomaly detection; it would require additional services like BigQuery for analysis, adding latency and complexity.

Full explanation →

449

MCQeasy

A traditional taxi company is losing market share to ride-sharing apps built on cloud platforms. A digital transformation consultant explains that the ride-sharing companies have a fundamental advantage rooted in their technology architecture. Which cloud-enabled capability most directly explains the ride-sharing companies' competitive advantage?

A.Ride-sharing companies own more vehicles than taxi companies, giving them greater fleet capacity

B.Cloud-enabled real-time matching, dynamic ML-driven pricing, and elastic mobile platforms create an operating model that taxi companies' legacy systems cannot replicate

C.Ride-sharing companies pay lower taxes, giving them a cost advantage over regulated taxi companies

D.Ride-sharing apps are available on smartphones, while taxis require phone calls

AnswerB

The competitive advantage is entirely cloud-powered: real-time GPS matching at scale (impossible without cloud compute), surge pricing driven by ML demand prediction, and mobile apps that create a seamless customer experience. These capabilities require cloud infrastructure and cloud-native development practices.

Why this answer

Option B is correct because ride-sharing companies leverage cloud-native architectures—specifically real-time matching algorithms, machine learning (ML) for dynamic pricing, and elastic mobile platforms—to create an operating model that scales instantly with demand. This cloud-enabled capability allows them to optimize driver-rider pairing and pricing in milliseconds, a level of agility that traditional taxi companies with on-premises legacy systems cannot replicate. The fundamental advantage is not about asset ownership or tax structure but about the architectural ability to process massive real-time data streams and adjust operations dynamically.

Exam trap

Cisco often tests the misconception that a simple frontend feature (like a smartphone app) is the core advantage, when in fact the cloud-native backend—real-time matching, ML pricing, and elastic scaling—is the transformative differentiator.

How to eliminate wrong answers

Option A is wrong because ride-sharing companies typically do not own vehicles; they rely on independent drivers using their own cars, so greater fleet capacity is not a cloud-enabled advantage but a business model choice. Option C is wrong because ride-sharing companies do not inherently pay lower taxes; tax advantages vary by jurisdiction and are not a technology architecture feature, nor do they stem from cloud platforms. Option D is wrong because while smartphone availability is a factor, it is not a cloud-enabled capability—it is a device-level feature; the competitive advantage lies in the cloud backend that processes real-time data, not merely the frontend app.

Full explanation →

450

MCQeasy

A data analytics team needs to analyze petabytes of structured data using SQL queries without managing any database infrastructure. Query results must return within seconds for most queries. Which Google Cloud service is designed for this use case?

A.Cloud SQL

B.BigQuery

C.Cloud Bigtable

D.Cloud Spanner

AnswerB

BigQuery is Google's serverless data warehouse, designed for petabyte-scale SQL analytics. It requires no infrastructure management and delivers fast query performance through massive parallelism.

Why this answer

BigQuery is a serverless, highly scalable data warehouse designed for analyzing petabytes of data using SQL without any infrastructure management. Its columnar storage and distributed query engine enable sub-second query performance on large datasets, making it ideal for this use case.

Exam trap

Cisco often tests the distinction between OLTP (Cloud SQL, Cloud Spanner) and OLAP (BigQuery) services, and candidates may confuse Bigtable's NoSQL scalability with SQL analytics capabilities.

How to eliminate wrong answers

Option A is wrong because Cloud SQL is a managed relational database for OLTP workloads, not designed for petabyte-scale analytics or sub-second queries on massive datasets. Option C is wrong because Cloud Bigtable is a NoSQL wide-column database optimized for low-latency read/write operations on time-series or IoT data, not for complex SQL analytics on structured data. Option D is wrong because Cloud Spanner is a globally distributed relational database with strong consistency for transactional workloads, not a serverless analytics solution for petabyte-scale SQL queries.

Full explanation →

Google Cloud Digital Leader (GCDL) — Questions 376–450