Google Cloud Digital Leader Exam Prep
Cloud Digital Leader (Page 8 )

• Amazon Kendra is a managed enterprise search service that can index content stored in S3 and support natural-language queries to find text inside documents (PDFs, Word files, etc.).

• Rekognition analyzes images/videos, not document text search.
• Polly is a text-to-speech service.
• Lex is a chatbot service.

• Create a Kendra index.
• Add a data source of type S3 and point it to your bucket (with an IAM role that allows access).
• Configure/document conversion if needed, then index the data.
• Use the Kendra API or console to run natural-language queries against your indexed documents.

• Pay-as-you-go in Azure is an operating expense (OPEX) model, not an “elastic” expenditure model.
• Elastic or scalable terms describe capacity planning, not the cost category. The cost should be treated as OPEX since you pay for usage each month.
• The parallel question (Question 12) shows the correct approach is using an operational expenditure model.

• SageMaker endpoint: Not required because the model is being used through Amazon Bedrock.
• SageMaker Model Registry: Used for managing SageMaker models, not for making a Bedrock custom model available.
• Grant access in Amazon Bedrock: IAM permissions may still be needed, but granting access alone does not provide the required inference capacity.

• Date: 2018-12-31
• Time: 08:59

• B: The original value contains the text at, so it cannot be converted directly to a date.
• A: The last characters contain the time, not the date.
• D: Extracting the first 11 characters can leave an unwanted space and does not properly separate the time component.

• A recipient who already has a Microsoft account or an organizational account can authenticate by signing in.
• A recipient without a usable Microsoft identity may receive a one-time passcode by email.
• The passcode is sent to the same email address that was invited and is used to verify ownership of that address.

• The user starts in the corporate portal.
• The portal launches the Salesforce resource.
• The IdP sends the SAML response to Salesforce.

• Connected App + OAuth is for OAuth authorization and API/app access, not this SAML-based seamless login scenario.
• SP-initiated SSO would begin when the user first requests the Salesforce resource and Salesforce redirects them to the IdP. That is not the described starting point.

• Source: on-premises SQL Server Database1
• Destination: Fabric Warehouse Warehouse1
• Connectivity: on-premises data gateway

• Dataflow Gen1: Primarily for Power Query transformations and isn’t the best Fabric-native choice for this copy operation.
• KQL queryset: Queries data; it does not orchestrate copying from SQL Server.
• Notebook: Could perform custom code-based movement, but it is unnecessary and less direct than a pipeline.

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• Multi-pass wipe: Overwrites the drive’s existing data multiple times, making recovery much more difficult while preserving the drive’s functionality.
• Single-pass wipe: May be sufficient in some modern sanitization standards, but is presented here as less secure than multiple overwrites.
• Degaussing: Uses a strong magnetic field to disrupt data. It can render the drive unusable or unreliable, reducing its resale value.
• Pinning: Is not an appropriate data-sanitization method.

• Planning – identifying the need, objectives, scope and resources.
• Analysis – understanding business requirements and current problems.
• Design/development – determining how the system will work.
• Implementation – installing the system and putting it into operation.

Why

cmd 
PowerShell.exe -ExecutionPolicy Bypass -File C:\Scripts\ConfigureVM.ps1

Why the other options are less suitable

• GPO logon script: Runs only when a user logs on and may not run during initial VM provisioning.
• GPO startup script: Can work, but requires the VM to be joined to the domain and the policy to be applied. It is also normally evaluated at each startup.
• Place scripts in a VHD: Merely placing scripts on a disk does not cause them to execute.

• IaaS: You deploy and manage virtual machines, operating systems, disks, and networking. Azure manages the physical datacenter and host infrastructure.
• PaaS: Azure manages the operating system and runtime so you can focus on deploying applications, such as with Azure App Service or Azure Functions.
• SaaS: You consume a complete, provider-managed application.

1. Download the updated VPN client configuration package from the Azure VPN gateway.
2. Remove or update the existing VPN client configuration on the Windows 10 workstation.
3. Install the new package and reconnect.

• Mesh: WAPs communicate wirelessly with one another, often to extend coverage without wired connections. It does not specifically describe centralized WLC management.
• Point-to-point: Connects two specific devices or locations.
• Ad hoc: Wireless devices communicate directly with one another without an access point.

• Sales Processes define the set of Opportunity stages for a given workflow.
• Record Types let you have different data models (different fields and picklist values) on the same object.
• Page Layouts control which fields are shown/required for each record type.

• Create three Sales Processes so each team can use its own stages.
• Create three Record Types so each team has its own fields and picklist values.
• Create three Page Layouts so each record type shows the appropriate fields.

• Why: If an application on EC2 needs to call other AWS services, using an IAM role (attached to the EC2 instance as an instance profile) provides temporary, automatically rotated credentials. This avoids embedding access keys in the application.
• How it works: Create a role with the minimum required permissions, attach it to the EC2 instance, and let the AWS SDK used by the application retrieve credentials from the instance metadata service. The credentials rotate automatically and are scoped to the policy you define.
• Why not other options:

• Short answer: The correct term is Anti-forensics (option D), not “Felony.”

• Why: The actions described—hiding files in slack space, changing file headers, placing suspicious files in executables, and altering metadata—are classic anti-forensics techniques. They’re used to hinder or obscure forensic analysis, not to label the act as a legal category.

• About the options:

• Note: The provided answer key lists B (Felony), which is misleading for this exam objective. The exam typically tests knowledge of forensics concepts, where anti-forensics is the correct category.

• 6-phone boxes: 6x
• 8-phone boxes: 8x

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

• Why Ishikawa:

• Why not the others:

• The VPN gateway is in VirtualNetworkA.
• Gateway transit is configured on the peering associated with the VNet that contains the gateway—here, VirtualNetworkA.
• A peered VNet may use the remote gateway through the appropriate peering option, but this does not automatically update an existing P2S client’s routes.
• The Windows 10 workstation’s P2S VPN client package was created before VirtualNetworkB was peered, so it may not have a route for VirtualNetworkB.

sql 
CREATE TABLE my_table 
USING CSV 
OPTIONS (path '/path/to/csv');

sql 
CREATE TABLE my_table 
USING CSV 
LOCATION '/path/to/csv';

• USING CSV specifies the file format.
• path or LOCATION specifies where the files are stored.
• USING DELTA would be used only when the source data is in Delta format.
• FROM is used in a SELECT statement, not normally as the format declaration in CREATE TABLE.

• Product Owner: May attend, but is not required unless also working as a Developer.
• Scrum Master: May attend to help facilitate or coach, but is not required.
• Developers: Must participate because the event is specifically for them.

• S3 Lifecycle rules automate actions such as transitioning objects to different storage classes or deleting old objects.
• S3 bucket policies control access permissions; they do not preserve earlier object versions.
• S3 server-side encryption protects data confidentiality by encrypting objects at rest, but it does not prevent deletion or overwriting.

• Accidental deletion or overwriting ? S3 Versioning
• Unauthorized access ? bucket policies and IAM
• Data encryption ? server-side encryption

• Answer: Internal load balancers (ILB) — option C.

• An ILB has a frontend IP address that must be a private IP within the subnet’s address space. You pick this IP when you create the ILB, and it can be Static or Dynamic.
• Other options don’t require a per-subnet IP:

• Actual filename: Document.xml.txt
• Explorer displays: Document.xml
• File type: Text Document (.txt)

text 
Document.txt ? Document.xml

• Help the team identify the causes of delays.
• Encourage continuous improvement through retrospectives.
• Support the team in changing its process, tools, or collaboration methods.
• Help remove impediments that the team cannot resolve independently.

• A: An impediment log may help, but simply maintaining it does not ensure the impediments are resolved.
• B: Directing the team to solutions conflicts with agile self-management.
• C: Adding impediments to the product backlog could delay their resolution and treats them like product features.

• Hardware and infrastructure
• System software
• Networks and communications
• Technology platforms and services

• Business Architecture: Defines business strategy, organization, functions, and processes.
• Data Architecture: Defines the structure and management of enterprise data.
• Application Architecture: Describes application systems and how they interact to support business and data processing.

• Used for communication on the local link or LAN segment
• Automatically generated on IPv6-enabled interfaces
• Not routed by routers to other networks
• Commonly used by devices to communicate with their local IPv6 router
• Begins with FE80 through FEBF

• FC00::/7 — unique local unicast
• FE80::/10 — link-local unicast
• FF00::/8 — multicast
• 2000::/3 — global unicast

• A — Custom Button: A button can launch a flow, typically by passing the flow’s URL and record context.
• D — From a Process: A Process can invoke a flow using an Apex action configured for flow invocation. However, this is automation-triggered, not directly accessed by a user.
• B — Quick Action: In current Salesforce functionality, a Flow Quick Action can launch a screen flow directly from a record page. This makes B a valid modern method.
• C — Visual Workflow Launcher: This is not generally listed as a standard access method in current Salesforce terminology; Salesforce commonly uses the Flow component on Lightning pages instead.

• Context: You’ve enabled auditing in Dataverse and need to trim audit data to free storage. The question asks which deletion options you can use.

• What the options typically mean:

• About the provided answer (A, C, D): The list includes “by column,” which isn’t a typical or supported way to purge audit data. The more plausible trio is A (by record), B (date range), and C (by table older than date). If the exam expects A, C, D, that seems incorrect or mis-stated in the source.

• Practical takeaway: To reduce audit storage, use per-record deletions, per-table purge by date, and/or date-range deletions as supported by the environment’s audit management UI or admin docs.

• Data lakes: scalable, low-cost storage for structured, semi-structured, and unstructured data.
• Data warehouses: reliable SQL analytics, governance, and performance features.

• Data lake: Primarily provides flexible, scalable storage but may lack warehouse-style reliability and governance.
• Data warehouse: Strong for structured analytics but less flexible for raw and unstructured data.
• All of these: The individual lake and warehouse do not, by themselves, unify the siloed architecture.

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

• Correct answer: D – Do not enable default administrative accounts to ensure accountability.

• A – Do not use encryption methods … backups and sensitive information: Encryption helps protect data; not using it increases risk, not reduces insider threats.
• B – Do not allow administrators to use unique accounts during installation: We actually want unique admin accounts, not the opposite.
• C – Do not control the access to administrators and privileged users: Failing to control access directly enables misuse.

• A limited lifetime
• Permissions defined by an IAM role or policy
• The ability to access AWS APIs without using long-term IAM user credentials

• Amazon API Gateway — Builds and manages APIs; it does not generally issue AWS credentials for applications.
• IAM users — Usually use long-term credentials, which are less suitable for applications.
• IAM instance profiles — Provide temporary role credentials to applications running on EC2 instances, but are specifically tied to EC2. The broader requirement described is best met by AWS STS.

cmd 
powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\Configure-VM.ps1

• GPO logon script: Runs only when a user logs on, so configuration may be delayed and is user-dependent.
• GPO startup script: Can work, but requires the VMs to be domain-joined and introduces GPO dependency. It is not specifically tied to Windows deployment.
• Place scripts in a VHD: Merely makes the files available; it does not execute them.

• The files are stored in a document library, which is exposed through the SharePoint Folder connector.
• The connector returns file metadata, including Folder Path, Name, and Content.
• In Power Query, filter Folder Path so only files in the manufacturing reports folder are retained.
• You can then combine the remaining Excel files because they all have the same structure.

• SharePoint List is for SharePoint lists, not document-library files.
• Combine & Load combines files immediately, before you filter to the required folder, and may include unwanted files.
• Transform gives you the opportunity to filter the file list first, which is more efficient and targeted.

sql 
GRANT ALTER ON SCHEMA::schemaA TO User1;

• TRUNCATE TABLE is a DDL operation, not a normal DELETE.
• Having DELETE permission on a table is not sufficient to truncate it.
• The minimum relevant permission is ALTER on the table.
• Granting ALTER on SCHEMA::schemaA allows the user to truncate tables within schemaA.
• It does not grant equivalent permissions on schemaB or schemaC, satisfying least privilege.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• cloud applications only
• all Web traffic including cloud applications

• Cloud applications only: Only traffic to cloud apps is steered to Netskope for inspection/enforcement; other traffic bypasses.
• All Web traffic including cloud applications: All web-bound traffic, including cloud app traffic, is steered to Netskope.

• Browser isolation, Web traffic only, or a vague “traffic only” option are not the standard two steering modes.
• These two configurations let you decide what traffic Netskope analyzes in real time and what is bypassed.

• The “Answer(s)” field lists B and C (likely incorrect). The explanatory text correctly describes cloud applications only and all Web traffic including cloud applications as the two configurations.

• Assign users or their team an appropriate security role.
• Ensure the role has the required table privileges, such as read, create, write, and append.
• Share the app with that security role in the app designer.

• Dynamics administration center: Used for environment and service administration, not routine app access configuration.
• Manage Roles: Not the specific Dataverse area used to define app and data permissions.
• Security Roles: Define what users can access and which operations they can perform.

• Correct answer: S3 Versioning

• Why the other options aren’t suitable for this protection:

• Quick tip: For enhanced protection, enable Versioning (and consider related features like Object Lock for write-once scenarios in specific compliance cases).

• Business
• People
• Governance
• Platform
• Security
• Operations

• Program and project management
• Risk management
• Cloud financial management
• Data governance
• Portfolio management

• Sustainability
• Performance efficiency
• Reliability

• A. Tuning system software: This is a corrective action, not an analysis method. Tuning should be based on measured performance data.
• B. User dissatisfaction reports: Useful as an indicator, but subjective and insufficient for diagnosing the cause.
• D. Off-peak utilization and response time: This may hide problems occurring during peak periods. Performance analysis should cover representative or peak workloads.

• Answer: C – netstat -an

• netstat -an lists all active connections and listening ports with numeric addresses, without resolving names. This lets you spot DoS patterns such as a flood of connections to a specific port or many connections from a single or few IPs.
• The other options don’t help as directly:

• Windows: netstat -an and look for numerous ESTABLISHED connections to a service or many SYNs to a port.
• Filter by port, e.g., netstat -an | findstr :80, or on Linux: ss -tunap | grep ':80'.

• Netstat provides a snapshot. DoS detection often benefits from continuous monitoring, flow data, and IDS/IPS logs.

1. Get Data ? Folder in Power BI Desktop.
2. In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.
3. Remove the Content column (and any other data columns you do not need).

• Name
• Extension
• Date accessed
• Date modified
• Folder Path
• Attributes
• Content

• Improve QA testing efficiency: A prototype may help discover defects early, but that is not its greatest benefit.
• Decrease time allocated for user testing and review: Prototyping usually requires additional user involvement and review, not less.
• Minimize scope changes: Prototypes can actually reveal new requirements or cause scope changes. However, discovering those changes early is beneficial.

• You normally do not create a new sensitive information type for credit card numbers. Microsoft Purview already provides a built-in Credit Card Number sensitive information type.
• The required sequence should generally be:

• Approval publish: Request approval from a manager of the knowledge base before moving the article into the publish state.
• Instant Publish: Immediately publishes a draft article without requiring an approval.
• Instant Retire: Immediately retires a published article without requiring an approval.
• Retire Knowledge: Moves a knowledge article to the retired state.

• These are the base knowledge workflows that control how articles move between states (Draft, Published, Retired) and whether approvals are required.
• The other options describe different lifecycle actions, but these four cover the standard publish/retire workflows in ServiceNow.