Google Google Certifications CLOUD-DIGITAL-LEADER Questions & Answers

• Question 171:

  An organization wants to move from a tactical cloud adoption approach to a transformational approach. How should they change their cloud security?

  A. Provide staff identities using only Google Cloud authentication.

  B. Provide multiple layers of network security using a zero-trust model.

  C. Emphasize strong perimeter security and trust in their private network.

  D. Emphasize three main Identity Access Management roles: owner, editor, and viewer.

  Correct Answer: B

  https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/ Zero Trust is a security framework requiring all users, whether in or outside the organization's network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data

• Question 172:

  What issues can arise when organizations integrate third-party systems into their cloud infrastruc-ture?

  A. Third-party systems may not be powerful enough to run many critical business applications.

  B. Without sufficient security measures and regular checks, unsecured third-party systems can pose a threat to data security.

  C. Over-reliance on third-party systems limits an organization's potential for innova-tion.

  D. Third-party systems are less capable of addressing an organization's security re-quirements.

  Correct Answer: B

  Because unsecured third-party systems are a cybersecurity threat.

• Question 173:

  The customer has applications that do data processing on-premise. They have been built using Ha-doop and Spark. What product should I use on Google Cloud?

  A. Dataproc

  B. Dataflow

  C. Dataprep

  D. Dataplex

  Correct Answer: A

  Because Dataproc is used to run Hadoop/Spark workloads

• Question 174:

  If you increase the size of a subnet in a custom VPC network, the IP addresses of virtual machines already on that subnet might be affected. Which options are Correct.

  A. False

  B. None of the above

  C. True

  D. Not Defined by Google Cloud Platform

  Correct Answer: A

  You can dynamically increase the size of a subnet in a custom network by expanding the range of IP addresses allocated to it. Doing that doesn't affect already configured VMs.

• Question 175:

  You are working with a government agency. A web application serves users of the country. It al-lows citizens to receive certain services in providing their national identity. Citizens have com-plained that they are seeing delays in web page loading compared to before. On investigating, they are seeing a lot of spurious traffic coming in from a few IPs which they have identified as for-eign. What should they do?

  A. Setup Firewall rules to deny access to the malicious IPs.

  B. Setup Cloud Armor and add the malicious IPs to the deny list.

  C. Setup Firewall rules to allow access only to the IPs from within the country.

  D. Setup Cloud NAT and remove all the internal IPs and replace it with a single public IP.

  Correct Answer: B

  Cloud Armor provides DDoS protection for applications. It can also "Filter your incoming traffic based on IPv4 and IPv6 addresses or CIDRs. Enforce geography-based access controls to allow or deny traffic based on source geo using Google's geoIP mapping."

• Question 176:

  A large travel company has thus far invested heavily in their technology team. There is strategic pressure on the company to focus on their core business and innovate to survive in certain geogra-phies and thrive in others. They are evaluating whether a move to Google Cloud will be good for them. Which of these reasons would be relevant for them? (choose two answer)

  A. Application architecture won't be too involved because of serverless options.

  B. The IT team won't have to manage software upgrades, security patches, etc. for the VMs.

  C. The IT team won't have to work on procuring and provisioning new hardware and refreshes to existing hardware.

  D. Budgeting won't be an issue since the cloud takes care of billing.

  Correct Answer: BC

• Question 177:

  Your client is building a custom machine learning pipeline to identify lesions in the lungs based on x-rays. Different teams of data scientists are sharing common source data and building many ver-sions of ML models. Which of these Cloud Storage options would be best for them?

  A. Retain the data in use in a single region bucket with nearline storage. Retain the data in use in a dual-region bucket.

  B. Retain the data in use in a single region bucket with standard storage.

  C. Retain the data in use in a multi-region bucket.

  D. Retain the data in use in a dual-region bucket.

  Correct Answer: B

  Integrated repository for analytics and ML: The highest level of availability and performance within a single region is ideal for compute, analytics, and machine learning workloads in a particular region. Cloud Storage is also strongly consistent, giving you confidence and accuracy in analytics workloads.

  

  https://cloud.google.com/storage/docs/storage-classes

• Question 178:

  You are working with a user to set up an application in a new VPC behind a firewall and it is no-ticed that the user is concerned about data egress. Therefore, to provide assistance you want to con-figure the fewest open egress ports. Which of the following statement is correct?

  A. Set up a high-priority (1000) rule that blocks all egress and a low-priority (65534) rule that allows only the appropriate ports.

  B. Set up a low-priority (65534) rule that blocks all egress and a high-priority rule (1000) that allows only the appropriate ports.

  C. Set up a high-priority (1000) rule to allow the appropriate ports.

  D. Set up a high-priority (1000) rule that pairs both ingress and egress ports.

  Correct Answer: B

  Implied rules Every VPC network has two implied firewall rules. These rules exist, but are not shown in the Cloud Console:

  Implied allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination, except for traffic blocked by Google Cloud. A higher priority

  firewall rule may restrict outbound access. Internet access is allowed if no other firewall rules deny outbound traffic and if the instance has an external IP address or uses a Cloud NAT instance. For more information, see Internet access

  requirements.

  

  Reference link-https://cloud.google.com/vpc/docs/firewalls

• Question 179:

  A customer deploys an application to App Engine and needs to check for Open Web Appli-cation Security Project (OWASP) vulnerabilities. Which service should be used to accom-plish this?

  A. Cloud Armor

  B. Cloud Security Scanner

  C. Binary Authorization

  D. Forseti Security

  Correct Answer: B

  Web Security Scanner identifies security vulnerabilities in your App Engine, Google Kubernetes Engine (GKE), and Compute Engine web applications. It crawls your application, following all links within the scope of your starting URLs, and attempts to exercise as many user inputs and event handlers as possible. Currently, Web Security Scanner only supports public URLs and IPs that aren't behind a firewall. Web Security Scanner currently supports the App Engine standard environment and App Engine flexible environments, Compute Engine instances, and GKE resources.

  Reference link-https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview

• Question 180:

  You are discussing scaling requirements with a gaming company. When the game launches, they are expecting incoming data surges of 2 million users or more during weekends and holidays. Their on-premise systems have had issues scaling and they want your advice on solving the issue. What do you recommend?

  A. Either Compute Engine VMs or Kubernetes nodes work, but it is better to keep a buffer of an extra 2 million users.

  B. We can deploy a Pub/Sub to ingest data which will grow to absorb demand and pass it on to other stages.

  C. We will allocate Compute Engine VMs estimating 80% capacity of 2 million users.

  D. We will allocate Kubernetes nodes estimating 80% capacity of 2 million users.

  Correct Answer: B

  When there are huge surges in demand, it is preferable to use serverless technologies that automatically scale on demand. In this case, the key concern is data ingestion. Pub/Sub is a serverless system that can expand to absorb such demand.