Google Google Certifications CLOUD-DIGITAL-LEADER Questions & Answers

• Question 301:

  What conditions be true if a VM interface wants to send packets to the external IP addresses of Google APIs and services using Private Google Access?

  A. VM interface does not have an external IP address assigned.

  B. VM interface is connected to a subnet where Private Google Access is disabled

  C. Both A and B

  D. None of the Above.

  Correct Answer: A

  A VM interface can send packets to the external IP addresses of Google APIs and services using Private Google Access if all these conditions are met:

  -The VM interface is connected to a subnet where Private Google Access is enabled.

  -The VPC network that contains the subnet meets the network requirements for Google APIs and services.

  -The VM interface does not have an external IP address assigned.

  -The source IP address of packets sent from the VM matches the VM interface's primary internal IP address or an internal IP address from an alias IP range. A VM with an external IP address assigned to its network interface doesn't need

  Private Google Access to connect to Google APIs and services. However, the VPC network must meet the requirements for accessing Google APIs and services.

• Question 302:

  An organization with hybrid cloud architecture wants to build an application once and be able to run it both on-premises and in their public cloud. Which Google Cloud solution should the organization use?

  A. Cloud Functions

  B. App Engine

  C. Compute Engine

  D. Anthos

  Correct Answer: D

  Anthos allows organizations to build an application once and run it anywhere. Migrate directly from VMs, Build, deploy, and optimize apps on GKE, Anthos serverless landing zones and VMs anywhere-simply, flexibly, and securely

  

  Reference Link-https://cloud.google.com/anthos

• Question 303:

  Your team is using BigQuery as your central data warehouse. You are running a certain workload that you've run frequently over the last few days. It is a short, high capacity ana-lytics workload. Which of the following would be an appropriate pricing model to use?

  A. There is no need for any pricing model the first 1 TB of query data processed per month is free.

  B. On-demand pricing

  C. Flex Slots

  D. Flat-rate reservations

  Correct Answer: C

• Question 304:

  Your organization uses Active Directory to authenticate users. Users' Google account access must be removed when their Active Directory account is terminated. How should your organization meet this requirement?

  A. Configure two-factor authentication in the Google domain

  B. Remove the Google account from all IAM policies

  C. Configure BeyondCorp and Identity-Aware Proxy in the Google domain

  D. Configure single sign-on in the Google domain

  Correct Answer: D

  Configure single sign-on in the Google domain

  Single sign-on: Whenever a user needs to authenticate, Google Cloud delegates the authentication to Active Directory by using the Security Assertion Markup Language (SAML) protocol. This delegation ensures that only Active Directory manages user credentials and that any applicable policies or multi-factor authentication (MFA) mechanisms are being enforced. For a sign-on to succeed.

  https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction Reference Link-https://cloud.google.com/architecture/identity/single-sign-on

• Question 305:

  What are the network requirements for Private Google Access?

  A. Private Google Access automatically enables any API.

  B. Your network must have appropriate routes for the destination IP ranges used by Google APIs and services.

  C. Both A and B

  D. None of the Above

  Correct Answer: B

  Network requirements for Private Google Access:

  -Because Private Google Access is enabled on a per-subnet basis, you must use a VPC network. Legacy networks are not supported because they don't support subnets.

  -Private Google Access does not automatically enable any API. You must separately enable the Google APIs you need to use via the APIs and services page in the Google Cloud Console.

  -If you use the private.googleapis.com or the restricted.googleapis.com domain names, you'll need to create DNS records to direct traffic to the IP addresses associated with those domains.

  -Your network must have appropriate routes for the destination IP ranges used by Google APIs and services. These routes must use the default internet gateway next hop. If you use the private.googleapis.com or the

  restricted.googleapis.com domain names, you only need one route (per domain). Otherwise, you'll need to create multiple routes.

  -Egress firewalls must permit traffic to the IP address ranges used by Google APIs and services. The implied allow egress firewall rule satisfies this requirement. For other ways to meet the firewall requirement.

• Question 306:

  An organization has had a data leak scare because one employee made a sensitive Cloud Storage bucket available to the public. Given the nature of the company's business, it is understood that there is never any reason to give the public direct access to any file. The security head wants to ensure that such an event never occurs again. How can you ensure this?

  A. Remove Edit access rights of all Cloud Storage buckets so that no user can make any edits.

  B. Set an organizational policy constraint to restrict bucket access set to the public.

  C. Use Cloud Scheduler to run a job at a specified interval to scan buckets. Any public permissions can be programmatically changed.

  D. Write Cloud Functions code connected to Cloud Storage. Any changes will be notified to the function which can be used to reset the public access.

  Correct Answer: B

  The straightforward way to set it is using Organizational Policy constraint. Any attempts to change the organizational setting will be rejected for any project and resource.

  References link: -> https://cloud.google.com/resource-manager/docs/organization-policy/overview -> https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints

• Question 307:

  Your ed-tech start-up was originally launched in a small geography. Any user sign-ups, course progress, tests taken, etc. are captured on a self-managed MySQL database. Every user generates many such transactions. Now you're taking the application globally and preparing for a much larger influx of users from all over the world. The existing MySQL server is unlikely to be able to scale. Which convenient option can be considered?

  A. Migrate to BigQuery

  B. Migrate to Cloud Spanner

  C. Migrate to Cloud SQL

  D. Migrate to Bigtable

  Correct Answer: B

  Cloud Spanner is a global scale SQL database that scales extremely well. That would be the best choice.

• Question 308:

  You are currently managing workloads running on Windows Server for which your company owns the licenses. Your workloads are only needed during working hours, which allows you to shut down the instances during the weekend. Your Windows Server licenses are up for renewal in a month, and you want to optimize your license cost.

  What should you do?

  A. Renew your licenses for an additional period of 3 years. Renew your licenses for an additional period of 3 years. Negotiate a cost reduction with your current hosting provider wherein infrastructure cost is reduced when workloads are not in use

  B. Renew your licenses for an additional period of 2 years. Negotiate a cost reduction by committing to an automatic renewal of the licenses at the end of the 2 year period

  C. Migrate the workloads to Compute Engine with a bring-your-own-license (BYOL) model

  D. Migrate the workloads to Compute Engine with a pay-as-you-go (PAYG) model

  Correct Answer: D

  The PAYG model is more convenient because you only pay for usage. And the case describes that the workloads are only run on certain days.

• Question 309:

  You are a program manager within a Software as a Service (SaaS) company that offers rendering software for animation studios. Your team needs the ability to allow scenes to be scheduled at will and to be interrupted at any time to restart later. Any individual scene rendering takes less than 12 hours to complete, and there is no service-level agreement (SLA) for the completion time for all scenes. Results will be stored in a global Cloud Storage bucket. The compute resources are not bound to any single geographical location. This software needs to run on Google Cloud in a cost-optimized way.

  What should you do?

  A. Deploy the application on Compute Engine using preemptible instances

  B. Develop the application so it can run in an unmanaged instance group

  C. Create a reservation for the minimum number of Compute Engine instances you will use

  D. Start more instances with fewer virtual centralized processing units (vCPUs) instead of fewer instances with more vCPUs

  Correct Answer: A

  Preemptible VMs are cost-effective instances that can be used for short-lived and non-critical workloads. Since the rendering of individual scenes takes less than 12 hours and can be interrupted and restarted, you can leverage preemptible VMs to perform the rendering tasks. Preemptible VMs are available at a significantly lower cost compared to regular instances but can be preempted by GCP with a 30-second notice. By designing your rendering workflow to handle interruptions gracefully, such as checkpointing and resuming, you can take advantage of the cost savings provided by preemptible VMs. https://cloud.google.com/compute/docs/instances/preemptible

• Question 310:

  Your organization needs a large amount of extra computing power within the next two weeks.

  After those two weeks, the need for the additional resources will end.

  Which is the most cost-effective approach?

  A. Use a committed use discount to reserve a very powerful virtual machine

  B. Purchase one very powerful physical computer

  C. Start a very powerful virtual machine without using a committed use discount

  D. Purchase multiple physical computers and scale workload across them

  Correct Answer: C

  When you purchase a committed use contract, you purchase Compute Engine resources--such as vCPUs, memory, GPUs, local SSDs, and sole-tenant nodes--at a discounted price in return for committing to paying for those resources for 1 year or 3 years