Google Cloud Digital Leader Practice Exam

What the Google Cloud Digital Leader exam covers

• Digital transformation with Google Cloud102 questions
• Exploring data transformation with Google Cloud100 questions
• Innovating with Google Cloud artificial intelligence111 questions
• Modernizing infrastructure and applications with Google Cloud150 questions
• Trust and security with Google Cloud142 questions
• Scaling with Google Cloud operations116 questions

Free Google Cloud Digital Leader sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 721.

1. Question 1Digital transformation with Google Cloud

   Moving to the cloud typically shifts IT spending from which model to which?

   • AFrom capital expenditure (CapEx) to operational expenditure (OpEx)Correct
   • BFrom subscription licensing to per-seat billing
   • CFrom variable usage costs to fixed annual budgets
   • DFrom operational expenditure (OpEx) to capital expenditure (CapEx)
   ✓ Correct answer: A

   Cloud adoption replaces large upfront hardware and data-center purchases (capital expenditure) with metered charges for the resources you actually consume (operational expenditure). On Google Cloud you rent compute, storage, and networking on demand instead of buying and depreciating physical assets, so spending moves off the CapEx balance sheet to an ongoing OpEx line. This lets organizations avoid over-provisioning and match cost to real usage.

   Why the other options are wrong

   • BSubscription-to-per-seat is a billing detail, not the CapEx-to-OpEx shift the cloud drives.
   • CThe cloud moves spending toward variable, usage-based costs, not fixed annual budgets.
   • DThis reverses the direction; the cloud shifts from CapEx to OpEx, not the other way around.
2. Question 2Exploring data transformation with Google Cloud

   Which Google Cloud service lets teams discover, catalog, and govern data assets across the organization for better data integration and governance?

   • ADataplex (data catalog and governance)Correct
   • BMemorystore (managed in-memory cache)
   • CDataproc (managed Spark and Hadoop)
   • DCloud Composer (managed Apache Airflow)
   ✓ Correct answer: A

   Dataplex is Google Cloud's data governance and cataloging service, letting teams discover, organize, classify, and govern data assets spread across lakes, warehouses, and other stores from one place. Memorystore (caching), Dataproc (managed Spark/Hadoop), and Cloud Composer (workflow orchestration) address performance and processing, not cataloging and governance.

   Why the other options are wrong

   • BMemorystore is a caching service, not a data catalog and governance tool.
   • CDataproc runs Spark/Hadoop processing, not cataloging and governance of data assets.
   • DCloud Composer orchestrates workflows; it does not catalog or govern data assets.
3. Question 3Scaling with Google Cloud operations

   Which suite provides logging, monitoring, and tracing for Google Cloud?

   • AGoogle Cloud Operations suite (Cloud Logging/Monitoring/Trace)Correct
   • BBigQuery queries over manually exported log data
   • CCloud CDN (edge caching of static content)
   • DCloud NAT (managed outbound address translation)
   ✓ Correct answer: A

   The Google Cloud Operations suite combines Cloud Logging, Cloud Monitoring, and Cloud Trace to surface logs, metrics, and distributed request latency together. Cloud CDN, Cloud NAT, and manually querying exported logs in BigQuery are not the integrated observability suite.

   Why the other options are wrong

   • BBigQuery can query exported logs but is not the integrated observability suite.
   • CCloud CDN caches content at the edge; it does not provide logging or tracing.
   • DCloud NAT handles outbound connectivity, not logging, monitoring, or tracing.
4. Question 4Exploring data transformation with Google Cloud

   A team runs the same heavy reporting queries against BigQuery repeatedly throughout the day. Which BigQuery feature can improve performance and reduce cost by avoiding recomputation of identical queries?

   • ACloud Armor rules
   • BCloud VPN tunnels
   • CBigQuery cached query resultsCorrect
   • DA larger persistent disk
   ✓ Correct answer: C

   BigQuery automatically caches query results, so when the exact same query is rerun against unchanged data it returns the cached result almost instantly and at no query cost, avoiding recomputation of identical reports. Cloud Armor, Cloud VPN, and persistent disk size are unrelated to reusing query results.

   Why the other options are wrong

   • ACloud Armor applies web application firewall and DDoS rules at the load balancer and does nothing to speed up or cache repeated BigQuery queries.
   • BCloud VPN provides an encrypted network tunnel between environments and has no effect on query recomputation or cost inside BigQuery.
   • DA larger persistent disk adds VM block storage capacity, but BigQuery is serverless and does not use your persistent disks, so this would not cache or accelerate queries.
5. Question 5Trust and security with Google Cloud

   A team wants to ensure that only container images that have passed security scanning and are signed are allowed to deploy to GKE. Which capability enforces this trusted-deployment policy?

   • AArtifact Registry vulnerability scanning
   • BPod Security Admission
   • CBinary AuthorizationCorrect
   • DWorkload Identity
   ✓ Correct answer: C

   Binary Authorization is a deploy-time security control for GKE (and Cloud Run) that enforces policies requiring container images to be attested - meaning they have been signed by a trusted authority such as a CI/CD pipeline that completed security scanning - before they can be deployed. If an image lacks a valid attestation, Binary Authorization blocks the deployment, ensuring only verified and approved container images run in production clusters.

   Why the other options are wrong

   • AArtifact Registry scanning detects vulnerabilities in images but does not enforce that only signed, verified images can be deployed to the cluster
   • BPod Security Admission restricts pod security settings at admission; it does not verify image signatures or scan attestations
   • DWorkload Identity lets pods authenticate to Google Cloud services and does not gate which images may be deployed
6. Question 6Scaling with Google Cloud operations

   A leader hears the SRE team talk about an 'error budget' and wants to understand its business value. What is the primary purpose of an error budget?

   • AIt sets the maximum monthly cloud spend that a single project is permitted to consume before shutdown
   • BIt caps the total number of support cases that a team is allowed to open with the vendor each month
   • CIt defines how many on-call engineers may be scheduled to respond to incidents at the same time
   • DIt quantifies the acceptable amount of unreliability, balancing the pace of new feature releases against stabilityCorrect
   ✓ Correct answer: D

   An error budget is the portion of time or requests that a service is allowed to be unreliable, derived by subtracting the SLO target from 100%. For example, a 99.9% monthly SLO gives a 0.1% error budget - roughly 43 minutes of allowable downtime per month. Error budgets create a shared, data-driven framework for decision-making: when the budget is ample, engineering teams can take more risks and deploy new features faster. When the budget is nearly exhausted, teams prioritize reliability work and slow down risky releases. This aligns the incentives of product and operations teams.

   Why the other options are wrong

   • AAn error budget measures acceptable unreliability, not a limit on monetary spend.
   • BIt has nothing to do with support-case limits; it governs the reliability versus velocity trade-off.
   • COn-call staffing is unrelated; the error budget quantifies tolerable service unreliability.
7. Question 7Innovating with Google Cloud artificial intelligence

   An enterprise wants to give employees a generative AI assistant that can summarize long documents, draft emails, and answer questions grounded in company content. Which Google offering is designed for these generative AI business use cases?

   • AGemini models on Vertex AICorrect
   • BCloud Speech-to-Text API
   • CBigQuery ML linear regression
   • DCloud TPU
   ✓ Correct answer: A

   Gemini is Google's family of large multimodal foundation models available through Vertex AI, designed for generative AI tasks such as document summarization, long-form text drafting, question answering, and content grounded in enterprise data. By accessing Gemini through Vertex AI's managed APIs, enterprises benefit from data governance controls, integration with Google Cloud security, and grounding capabilities that connect model outputs to company-specific knowledge - exactly what is needed for an enterprise AI assistant.

   Why the other options are wrong

   • BCloud Speech-to-Text API converts audio recordings to text transcripts and has no capability for summarizing documents, drafting emails, or answering questions based on written content.
   • CBigQuery ML linear regression is a specific statistical modeling capability within the data warehouse for predicting numeric values from tabular data - it is not a generative AI assistant for natural language tasks.
   • DCloud TPU is specialized hardware that accelerates model training computation and is not a product that employees interact with directly for document summarization or email drafting.
8. Question 8Modernizing infrastructure and applications with Google Cloud

   During planning, a manager asks why containers and serverless platforms are described as improving developer productivity and time to market. Which explanation is the most accurate business rationale?

   • AThey let the same container image run on any cloud provider or on-premises host, so teams can freely relocate workloads at any time and avoid vendor lock-in
   • BThey fix the monthly infrastructure bill at a flat, predictable amount that stays the same each month no matter how much compute the application actually consumes
   • CThey automatically convert existing monolithic applications into microservices, so development teams can skip most of the manual refactoring work involved
   • DThey remove much of the undifferentiated work of provisioning, patching, and scaling infrastructure, so developers spend more time on application featuresCorrect
   ✓ Correct answer: D

   Containers and serverless platforms such as Cloud Run and Cloud Functions let Google manage provisioning, OS patching, and autoscaling of the underlying infrastructure, so developers spend their time on application logic instead of running servers - removing this 'undifferentiated heavy lifting' is what shortens time to market. They do not eliminate the need for testing, sound architecture, or operations, and because they bill by actual usage, costs track demand rather than staying flat.

   Why the other options are wrong

   • APortability is a real benefit but not the productivity rationale asked for, and moving containers across providers is rarely fully automatic.
   • BServerless and container platforms use consumption-based pricing that varies with usage; they do not fix a flat monthly bill.
   • CThese platforms do not automatically rewrite monoliths into microservices; that decomposition is still manual engineering work.
9. Question 9Trust and security with Google Cloud

   An insurer wants to retain sole control of the encryption keys that protect its data and even keep those keys outside Google's infrastructure to strengthen sovereignty claims. Which option meets this requirement?

   • ACloud External Key Manager (Cloud EKM)Correct
   • BGoogle default encryption at rest
   • CCloud Armor
   • DIdentity-Aware Proxy
   ✓ Correct answer: A

   Cloud External Key Manager (Cloud EKM) allows customers to use encryption keys that are generated and stored in an external key management system - outside Google's infrastructure entirely - to encrypt data in Google Cloud services. This means Google never has direct access to the plaintext keys, giving the customer sole control and strengthening sovereignty claims. It is the appropriate choice when regulatory requirements demand that keys remain beyond a cloud provider's reach.

   Why the other options are wrong

   • BGoogle default encryption at rest protects data using Google-managed keys, meaning Google controls the keys - this does not satisfy the requirement to keep keys outside Google's infrastructure.
   • CCloud Armor is a web application firewall and DDoS protection service; it secures applications from network-level attacks but has no role in encryption key management or sovereignty.
   • DIdentity-Aware Proxy controls access to applications based on user identity and context; it does not manage encryption keys or address the requirement to store keys outside Google's infrastructure.
10. Question 10Trust and security with Google Cloud

    Which statement best describes a Google Cloud service account?

    • AA human user's identity synchronized from an external directory into Cloud Identity
    • BA collection of IAM roles bundled together and assigned to a group of users
    • CAn API key issued to a project so client apps can call enabled Google Cloud APIs
    • DA special identity used by applications and workloads, rather than a human, to authenticate and access resourcesCorrect
    ✓ Correct answer: D

    Service accounts represent applications, virtual machines, or other workloads rather than people. Code running on a resource can use a service account to call Google Cloud APIs securely without a human signing in. You grant IAM roles to a service account to control what it can do.

    Why the other options are wrong

    • AA synchronized directory identity represents a human user, whereas a service account is a non-human identity for workloads.
    • BA bundle of roles is a permission grouping, not an identity that applications use to authenticate.
    • CAn API key identifies a project for API access but is not an identity that authenticates a workload with IAM.

Related Google resources

• Google Cloud Digital Leader study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Google Cloud Professional Cloud Security Engineer practice examRelated
• Google Cloud Professional Cloud Network Engineer practice examRelated
• Associate Google Workspace Administrator practice examRelated

Google Cloud Digital Leader practice exam FAQ