View Full Google Cloud Digital Leader Exam Dumps and Practice Test Dumps.

 

Question 21

An organization is planning to migrate a legacy on-premises MySQL database to Google Cloud. They want to minimize administrative overhead for database management tasks such as patch management, backups, and replication while maintaining full relational SQL compatibility. Which service should they choose?

1. BigQuery
2. Cloud Bigtable
3. Cloud SQL
4. Cloud Datastore

Correct Answer: 3

Explanation

Cloud SQL is a fully managed relational database service for MySQL, PostgreSQL, and SQL Server. It automates operational administrative tasks including security patching, automated backups, replication, capacity management, and failover handling, allowing IT teams to focus on application development rather than database administration. BigQuery is optimized for analytical data warehousing rather than transactional workloads. Cloud Bigtable is a NoSQL key-value store meant for massive analytical/operational data, and Cloud Datastore (now Firestore in Datastore mode) is a document NoSQL database, making Cloud SQL the optimal choice for managed MySQL migration.

Question 22

Which Google Cloud identity service provides single sign-on (SSO), multi-factor authentication (MFA), and centralized user lifecycle management across cloud applications and enterprise devices?

1. Cloud IAM
2. Cloud Identity
3. Identity-Aware Proxy (IAP)
4. Key Management Service (KMS)

Correct Answer: 2

Explanation

Cloud Identity is Google Cloud’s Identity as a Service (IDaaS) solution that provides centralized user authentication, identity lifecycle management, single sign-on (SSO), and multi-factor authentication (MFA). It allows organizations to manage users and groups independently of Google Workspace. While Identity and Access Management (IAM) defines permissions and access rules for Google Cloud resources, Cloud Identity handles the core authentication layer and user credentials across cloud resources and enterprise apps. Identity-Aware Proxy guards application access based on context, and KMS manages cryptographic keys.

Question 23

A multimedia streaming enterprise needs to serve high-definition video content to millions of globally distributed users with minimum latency. Which Google Cloud service should they integrate into their architecture?

1. Cloud Interconnect
2. Cloud CDN
3. Cloud Armor
4. Cloud DNS

Correct Answer: 2

Explanation

Cloud CDN (Content Delivery Network) uses Google’s global edge network of distributed points of presence (PoPs) to cache static content—such as video streams, images, and web assets—closer to end-users. This drastically reduces network latency, speeds up web page loading, and offloads origin server infrastructure. Cloud Interconnect connects private hybrid networks, Cloud Armor provides security against network and application attacks (WAF/DDoS), and Cloud DNS handles domain name translation, leaving Cloud CDN as the primary service dedicated to low-latency edge caching and content delivery.

Question 24

An enterprise wants to migrate a heavy Apache Hadoop and Apache Spark analytics infrastructure to Google Cloud without altering its existing processing jobs and open-source tools. Which managed service fits this requirement?

1. Dataflow
2. Cloud Dataproc
3. Dataprep
4. BigQuery ML

Correct Answer: 2

Explanation

Cloud Dataproc is a fully managed cloud service for running Apache Spark, Apache Hadoop, Presto, and open-source data processing clusters. It allows enterprises to move existing open-source data pipelines directly to the cloud quickly and cost-effectively, enabling fast cluster creation, autoscaling, and integration with Cloud Storage. Dataflow provides unified stream and batch processing using the Apache Beam SDK, which requires pipeline restructuring. Dataprep is an interactive data preparation UI tool, and BigQuery ML executes machine learning directly within BigQuery using SQL.

Question 25

Under Google Cloud’s resource hierarchy, which entity acts as the root node and allows organizations to centrally apply policies, access controls, and compliance settings across all underlying resources?

1. Folders
2. Projects
3. Organization Node
4. Resource Groups

Correct Answer: 3

Explanation

The Organization Node is the top structural level in the Google Cloud resource hierarchy. It represents an enterprise company and acts as the root node under which Folders, Projects, and individual Resources are organized. Assigning IAM policies and Organization Policy constraints at the Organization Node ensures centralized governance, security boundaries, and compliance rules naturally inherit down to all child folders, projects, and underlying resources. Folders provide mid-level grouping, while Projects hold the actual technical resources.

Question 26

Which network security tool controls inbound and outbound traffic to Google Cloud Virtual Machine (VM) instances based on specified protocol, port, and IP address rules?

1. Cloud NAT
2. VPC Firewall Rules
3. Cloud Router
4. VPC Network Peering

Correct Answer: 2

Explanation

VPC Firewall Rules regulate traffic flow to and from Compute Engine Virtual Machine instances within a Virtual Private Cloud (VPC) network. Administrators can define allow or deny rules based on protocols (such as TCP/UDP), ports, source/destination IP addresses, service accounts, or network tags. Cloud NAT provides outbound internet connectivity for private VMs without exposing public IP addresses. Cloud Router dynamically manages BGP routing tables, and VPC Network Peering connects internal networks privately across different VPCs without traversing the public internet.

Question 27

A hospital system needs to store patient records and medical imaging files with a strict compliance policy: once written, data can never be modified or deleted for 7 years. Which feature satisfies this requirement?

1. Customer-Managed Encryption Keys (CMEK)
2. Cloud Storage Bucket Lock (WORM policy)
3. Object Versioning
4. Lifecycle Management Rules

Correct Answer: 2

Explanation

Cloud Storage Bucket Lock enables Write Once, Read Many (WORM) retention policies on Cloud Storage buckets. Once an administrator locks a retention policy, objects stored within the bucket cannot be overwritten, modified, or deleted by any user or service account until the specified retention period (such as 7 years) elapses. This guarantees compliance with strict legal and regulatory requirements. CMEK handles encryption management, Object Versioning retains historical copies of changed files, and Lifecycle Management automates storage tier transitions or deletions.

Question 28

Which Google Cloud continuous processing service provides unified stream and batch data processing using pipelines built on the Apache Beam framework?

1. Cloud Pub/Sub
2. Cloud Composer
3. Dataflow
4. Dataplex

Correct Answer: 3

Explanation

Dataflow is a fully managed, serverless service for executing unified batch and real-time streaming data pipelines using the open-source Apache Beam SDK. Dataflow automatically provisions compute capacity, handles pipeline optimizations, and scales resources dynamically based on processing load. Cloud Pub/Sub is the messaging ingestion layer that feeds data into pipelines. Cloud Composer orchestrates complex workflows across systems using Apache Airflow, and Dataplex manages data governance across distributed data lakes.

Question 29

What is the core benefit of using Google Kubernetes Engine (GKE) Autopilot mode compared to GKE Standard mode?

1. Autopilot eliminates all billing charges for network egress data
2. Autopilot manages node infrastructure, provisioning, scaling, and security hardening automatically, charging per pod resource requested
3. Autopilot grants complete access to host operating system kernels
4. Autopilot replaces containers with traditional virtual machines

Correct Answer: 2

Explanation

GKE Autopilot is a fully managed operational mode for Kubernetes where Google Cloud assumes complete management of node infrastructure, cluster provisioning, maintenance, autoscaling, and security hardening. Unlike GKE Standard (where users manage and pay for underlying VM worker nodes), GKE Autopilot bills users strictly for the CPU, memory, and storage resources requested by their running pods. This abstracts node management overhead entirely, reducing operational workload while enforcing Kubernetes security best practices out of the box.

Question 30

An enterprise wants to enforce a central security policy that prevents employees from creating public Cloud Storage buckets across any project. Which tool should they use?

1. Custom IAM Roles
2. Organization Policies
3. Firewall Rules
4. Cloud Audit Logs

Correct Answer: 2

Explanation

Organization Policies give administrators centralized programmatic control over their entire Google Cloud resource hierarchy. They allow security teams to configure strict constraints across all projects—such as enforcing Domain Restricted Sharing or enforcing the storage.uniformBucketLevelAccess policy to block public storage buckets globally. Custom IAM Roles grant user permissions, Firewall Rules manage network traffic, and Cloud Audit Logs record administrative actions, making Organization Policies the correct governance tool for system-wide restriction policies.

Question 31

Which deployment strategy deploys a new version of an application alongside the older version, gradually routing user traffic to the new version to minimize release risks?

1. Lift-and-Shift Deployment
2. Canary Deployment
3. Re-architecting Deployment
4. Cold Swap Deployment

Correct Answer: 2

Explanation

A Canary deployment is a progressive rollout pattern where a new application software version is deployed to a small percentage of user traffic alongside the stable version. By monitoring metrics and system logs during the initial release phase, operations teams can validate stability before incrementally shifting remaining traffic. If bugs or performance drops occur, traffic can be instantly routed back to the older version with minimal user impact. Cloud Run and GKE natively support traffic splitting to facilitate canary deployments.

Question 32

A financial services firm must maintain full control over its data encryption keys in Google Cloud and require keys to be generated and stored inside hardware security modules (HSMs). Which service fits this requirement?

1. Google-managed encryption keys
2. Customer-Supplied Encryption Keys (CSEK)
3. Cloud Key Management Service (Cloud KMS) with Cloud HSM
4. Secret Manager

Correct Answer: 3

Explanation

Cloud Key Management Service (Cloud KMS) combined with Cloud HSM provides managed hardware security modules validated at FIPS 140-2 Level 3. It allows enterprises to generate, use, rotate, and manage cryptographic keys within tamper-resistant hardware while seamlessly integrating with Google Cloud services like Storage and BigQuery. Secret Manager is designed to store API keys and passwords rather than cryptographic encryption keys, while Google-managed keys provide zero customer administrative key control.

Question 33

Which Google Cloud developer tool acts as a secure repository for storing, managing, and scanning container images and language packages (such as Maven or npm)?

1. Cloud Build
2. Artifact Registry
3. Cloud Source Repositories
4. Deployment Manager

Correct Answer: 2

Explanation

Artifact Registry is Google Cloud’s fully managed build artifact and package management repository. It expands on Container Registry capabilities to manage container images, Helm charts, and language packages (such as Java Maven, Node.js npm, or Python PyPI) with integrated security scanning for vulnerabilities. Cloud Build automates continuous integration (CI) execution, Cloud Source Repositories hosts Git source code, and Deployment Manager is an infrastructure-as-code automation tool.

Question 34

What is the function of Google Cloud Identity-Aware Proxy (IAP)?

1. Protecting web applications against large-scale distributed denial-of-service (DDoS) attacks
2. Verifying user identity and context (such as device security status) before granting access to internal applications without a traditional VPN
3. Routing global network traffic to the nearest geographic data center
4. Automating operating system patching for Compute Engine instances

Correct Answer: 2

Explanation

Identity-Aware Proxy (IAP) implements a Zero Trust security framework (BeyondCorp) by controlling access to cloud applications and virtual machines running on Google Cloud. Instead of relying on traditional network-level VPNs, IAP intercept requests to verify identity (via IAM authentication) and context (such as user credentials, IP address, and device posture) before allowing connection to internal admin panels or applications. Cloud Armor handles DDoS protection, and Global Load Balancing handles traffic routing.

Question 35

An e-commerce retailer experiences unpredictable traffic bursts during flash sales. Which compute characteristic allows Google Cloud infrastructure to automatically add capacity during peaks and reduce it during lulls?

1. Static Provisioning
2. Elasticity (Autoscaling)
3. Fault Tolerance
4. High Availability

Correct Answer: 2

Explanation

Elasticity, achieved through autoscaling, is the ability of cloud computing systems to automatically scale resource capacity up or down in real time based on demand metrics (such as CPU utilization or HTTP request rates). This ensures applications maintain optimal performance during high-volume spikes while avoiding over-provisioning and idle resource costs when traffic returns to baseline levels. Compute Engine Managed Instance Groups (MIGs), Cloud Run, and GKE leverage elasticity to balance cost and performance dynamically.

Question 36

Which tool allows organizations to model, provision, and manage Google Cloud resources declaratively using code (Infrastructure as Code)?

1. Google Cloud CLI
2. Google Cloud Console
3. Terraform / Google Cloud Deployment Manager
4. Cloud Shell

Correct Answer: 3

Explanation

Infrastructure as Code (IaC) tools like HashiCorp Terraform and Google Cloud Deployment Manager allow infrastructure engineering teams to define, provision, and update cloud resources declaratively using code scripts. This approach enables version control, automated repeatable deployments, team collaboration, and consistent environment creation. The Google Cloud Console is a web UI, the Cloud CLI is a command-line interface for manual/scripted commands, and Cloud Shell is an interactive terminal environment.

Question 37

A global firm needs to execute complex batch data workflows that require orchestrating tasks across Cloud Storage, BigQuery, and Dataflow on a scheduled basis. Which service should they use?

1. Cloud Tasks
2. Cloud Composer
3. Cloud Pub/Sub
4. Cloud Scheduler

Correct Answer: 2

Explanation

Cloud Composer is a fully managed workflow orchestration service built on the open-source Apache Airflow framework. It allows developers to author, schedule, and monitor complex multi-step data pipelines (DAGs) across hybrid and multi-cloud environments. Cloud Composer integrates seamlessly with data tools like BigQuery, Cloud Storage, and Dataflow to enforce sequence and dependency logic. Cloud Scheduler is a lightweight cron-job service, Cloud Tasks manages individual asynchronous task queues, and Cloud Pub/Sub handles messaging streams.

Question 38

What is a key difference between Managed Instance Groups (MIGs) and unmanaged instance groups in Compute Engine?

1. Unmanaged instance groups offer automatic scaling, self-healing, and rolling updates across identical instances
2. Managed Instance Groups (MIGs) operate identical VMs based on an instance template, offering autoscaling, self-healing, and automated updates
3. Unmanaged instance groups can only contain single-core vCPU instances
4. Managed Instance Groups cannot be integrated with Cloud Load Balancing

Correct Answer: 2

Explanation

Managed Instance Groups (MIGs) utilize an instance template to manage sets of identical Virtual Machines across single or multiple zones. MIGs provide automated features such as dynamic autoscaling, self-healing (recreating unhealthy instances based on health checks), rolling updates, and seamless load balancer integration. Unmanaged instance groups are simple collections of heterogeneous (different) VM instances that do not support automated scaling, self-healing, or template-based updates.

Question 39

Which Google Cloud solution provides a dedicated, isolated physical server environment for customers requiring single-tenant hardware to satisfy strict regulatory or licensing constraints?

1. Sole-Tenant Nodes
2. Shared Core VM Instances
3. Preemptible Virtual Machines
4. Custom Machine Types

Correct Answer: 1

Explanation

Sole-Tenant Nodes are physical Compute Engine servers dedicated exclusively to a single customer’s use. This single-tenant physical hardware isolation helps enterprises satisfy strict data security mandates, regulatory compliance rules, and complex software licensing requirements (such as per-core legacy software licensing). Shared core instances share underlying physical hardware with other tenants, while custom machine types allow tailored vCPU/memory configurations on standard multi-tenant infrastructure.

Question 40

An enterprise wants to centralize API management, secure backend microservices, monitor developer usage, and monetize external APIs. Which Google Cloud platform should they use?

1. Apigee API Management
2. Cloud Endpoints
3. Service Directory
4. Cloud API Gateway

Correct Answer: 1

Explanation

Apigee is Google Cloud’s enterprise-grade API management platform. It allows organizations to design, secure, deploy, monitor, scale, and monetize APIs across environments (on-premises, Google Cloud, or multi-cloud). Apigee provides advanced developer portal capabilities, API analytics, rate limiting, quota management, and enterprise security policies. API Gateway and Cloud Endpoints offer lightweight serverless API management, whereas Apigee provides full-lifecycle enterprise API transformation capabilities.