SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
CDL · Domain 5

Trust and Security with Google Cloud practice questions

Trust and Security with Google Cloud is worth 18% of the CDL exam — the heaviest of the 6 domains. Cloud security concepts and Google's defense-in-depth approach: threats, the CIA triad, zero trust, encryption states, authentication vs authorization, Google Threat Intelligence, Security Command Center, Google Security Operations, AI security (Model Armor, AI Protection), network and identity controls, and how Google earns trust. Official (approximate) weighting ~18%. 6 fully worked examples are further down this page, answers included.

Exam weight
18%
the heaviest of the 6 domains
Questions
76
across 2 topics
Free, no account
5/day
a free account allows 10 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 6 domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Trust and Security with Google Cloud questions, fully explained

Questions from the CDL bank mapped to domain 5, with the answer key and the reasoning behind every option. None of them repeat the examples on the main CDL practice page.

Question 1Trust and Security with Google Cloud

A retailer's leaders ask which measure would most reduce business disruption if ransomware did manage to encrypt the company's production servers. What should the retailer put in place?

Choose one.

  • a
    Encryption at rest for the disks attached to the production servers

    Encryption at rest protects data on stolen or discarded disks. Ransomware runs with access to the live system and can still encrypt the files on top, so this does not help recovery.

  • b
    Regular backups kept separate from production, with tested restores Correct

    Isolated backups that are known to restore let the company rebuild without paying, which limits downtime and data loss after the attack succeeds.

  • c
    A stricter network firewall placed in front of the production servers

    A firewall can reduce how attackers get in, but the question asks about limiting damage once the servers are already encrypted. It does nothing to bring the data back.

  • d
    Two-step verification for employees who sign in to company email

    2SV makes stolen passwords less useful and helps prevent an attack. Once the servers are encrypted, it does not restore the data or shorten the outage.

The concept

Cyber resilience against ransomware depends on being able to recover: backups that the attacker cannot reach and that have been tested to restore.

Why that’s the answer

The stem assumes the attack has already succeeded, so prevention controls (firewall, 2SV) are no longer the answer. Encryption at rest is a common trap: it protects stored data from theft, not from an attacker who is already running on the system. Isolated, tested backups let the business restore service without paying.

How to reason it out
  1. Note the timing: the servers are already encrypted.
  2. Set aside controls that only prevent an attack.
  3. Remember encryption at rest does not stop ransomware on a live system.
  4. Choose separate, tested backups.

Exam tip: Prevention keeps ransomware out; isolated, tested backups get you back up when it gets in.

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader) — the lesson that teaches this.

Question 2Trust and Security with Google Cloud

An events company's ticket site goes offline at the start of a big sale because huge volumes of junk requests from thousands of hijacked devices overwhelm it. Which threat is this?

Choose one.

  • a
    A ransomware attack on the ticket database

    Ransomware encrypts data and demands payment. Nothing here is encrypted or held hostage; the site is simply overwhelmed.

  • b
    A phishing campaign aimed at customers

    Phishing deceives people into giving up credentials. It does not flood a website with requests from hijacked devices.

  • c
    A distributed denial-of-service attack Correct

    A DDoS attack floods a service with traffic from many sources so real users cannot reach it, which matches the site going offline under junk requests.

  • d
    A misconfiguration of the site's storage

    A misconfiguration can expose data or break a service, but the cause described is an outside flood of traffic, not a setting the company chose.

The concept

A distributed denial-of-service (DDoS) attack overwhelms a service with traffic from many sources; its business impact is lost availability, revenue and reputation.

Why that’s the answer

Traffic from many hijacked devices making a site unreachable is the definition of a DDoS attack. Ransomware, phishing and misconfiguration are real threats, but none of them works by flooding a service with requests.

How to reason it out
  1. Identify the symptom: the site is unreachable.
  2. Identify the cause: a flood of requests from many devices.
  3. Match many sources plus lost availability to DDoS.
  4. Rule out threats that steal, lock or expose data.

Exam tip: Many sources flooding a service until users can't reach it = DDoS.

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader) — the lesson that teaches this.

Question 3Trust and Security with Google Cloud

For several hours a bank's customers cannot reach online banking during a traffic flood. Investigators confirm no data was read or altered. Which security principle was compromised?

Choose one.

  • a
    Confidentiality

    Confidentiality is about keeping data from unauthorized people. The stem says no data was read.

  • b
    Integrity

    Integrity is about data staying accurate and unaltered. The stem says no data was changed.

  • c
    Availability Correct

    Availability means authorized users can reach systems and data when they need them. Customers being locked out for hours is a loss of availability.

  • d
    Compliance

    Compliance is meeting laws, regulations and standards. An outage might have regulatory consequences, but the principle directly hit is the service being reachable.

The concept

The CIA triad: confidentiality (only authorized people see data), integrity (data stays accurate and unaltered) and availability (systems are reachable when needed).

Why that’s the answer

No data was read (confidentiality intact) and none was changed (integrity intact); what failed is customers' ability to use the service. That is availability, the principle DDoS attacks target.

How to reason it out
  1. List what was affected: access to the service.
  2. List what was not: reading or changing data.
  3. Map lost access to availability.
  4. Choose availability.

Exam tip: Can't reach it = availability; seen by the wrong people = confidentiality; changed = integrity.

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader) — the lesson that teaches this.

Question 4Trust and Security with Google Cloud

Staff receive emails styled like the IT team's, asking them to sign in on a linked page to keep their mailbox active. The page records what they type. Which threat is this?

Choose one.

  • a
    Malware hidden in an email attachment

    Malware is software that harms a system. Nothing is installed here; staff are tricked into typing their passwords into a fake page.

  • b
    A distributed denial-of-service attack

    DDoS floods a service with traffic. These emails target people, not the capacity of a system.

  • c
    Phishing Correct

    Phishing uses fake messages that look trustworthy to trick people into revealing credentials, here by sending them to a lookalike sign-in page.

  • d
    An unsecured third-party system

    That threat is a supplier's or partner's weak system used as a way in. The emails merely pretend to come from the company's own IT team.

The concept

Phishing is social engineering: messages that impersonate a trusted sender to make people reveal credentials or run malicious content.

Why that’s the answer

The attack works on people, not systems: a convincing message leads staff to a fake page that captures passwords. That is phishing. No software is installed (not malware), no traffic flood (not DDoS) and no supplier system is involved.

How to reason it out
  1. Notice the attack targets people through a message.
  2. Notice the goal is to capture sign-in details.
  3. Match impersonation plus credential capture to phishing.
  4. Rule out malware, DDoS and third-party threats.

Exam tip: A message that impersonates someone trusted to steal credentials = phishing.

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader) — the lesson that teaches this.

Question 5Trust and Security with Google Cloud

Attackers break into a company's cloud project and quietly run cryptomining software on its virtual machines. What business impact is the company most likely to notice first?

Choose one.

  • a
    Its files encrypted and a ransom payment demanded

    That is ransomware. Cryptominers want to stay hidden and keep using the compute, not lock data.

  • b
    Employees receiving fake sign-in emails from attackers

    That describes phishing, which may be how attackers got in, but it is not the impact of running cryptomining software.

  • c
    Unexpectedly high compute charges on its cloud bill Correct

    Cryptomining consumes large amounts of compute that the victim pays for, so a sudden rise in compute costs is the typical first sign.

  • d
    Its website flooded by requests from many devices

    That is a DDoS attack, which targets availability from outside. Cryptomining uses the victim's own resources.

The concept

Cryptomining (cryptojacking) is the unauthorized use of an organization's computing resources to mine cryptocurrency; its business impact is cost and degraded performance.

Why that’s the answer

The attacker profits from compute the victim pays for, so the bill rises and workloads may slow. The other options describe different threats (ransomware, phishing, DDoS) with different impacts.

How to reason it out
  1. Recall what cryptomining software does: uses compute to mine coins.
  2. Ask who pays for that compute: the victim.
  3. Link the impact to cost and performance.
  4. Choose higher compute charges.

Exam tip: Cryptomining hits the bill: someone else mines on compute you pay for.

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader) — the lesson that teaches this.

Question 6Trust and Security with Google Cloud

A startup learns that a storage bucket holding customer records was readable by anyone on the internet because of a sharing setting a developer chose. No system was breached. What caused the exposure?

Choose one.

  • a
    Malware on the developer's laptop

    Malware would be harmful software running on a device. The stem says the exposure came from a sharing setting, and no system was breached.

  • b
    An unsecured third-party system

    That threat involves a supplier's weak system. The setting here was chosen inside the startup itself.

  • c
    A misconfiguration by the company Correct

    A setting chosen by the company's own developer exposed the data. That is a misconfiguration, one of the most common causes of cloud data exposure.

  • d
    Physical damage to the storage hardware

    Physical damage affects hardware and availability. It would not make records readable to the internet.

The concept

Misconfiguration means security settings left wrong by the customer, such as public access to storage or overly broad permissions; it is a leading cause of cloud breaches.

Why that’s the answer

Nothing was broken into: the data was exposed by the company's own setting. That is misconfiguration, and under the shared responsibility model configuring access to its data is the customer's job.

How to reason it out
  1. Note that no system was breached.
  2. Note the cause was a setting the developer chose.
  3. Match a customer-chosen setting that exposes data to misconfiguration.
  4. Choose misconfiguration.

Exam tip: Data exposed by your own settings, with no break-in = misconfiguration.

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader) — the lesson that teaches this.

What CDL domain 5 tests, topic by topic

The official exam guide breaks Trust and Security with Google Cloud into 2 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published CDL practice questions per topic in Trust and Security with Google Cloud
TopicWhat it coversQuestions
Describe fundamental cloud security conceptsOfficial Cloud Digital Leader objective 5.1 (guide launched August 12, 2026). Describe relevant cybersecurity threats and business implications (e.g., DDoS, ransomware, cryptomining, malware, viruses, phishing, misconfiguration, unsecured third party systems, physical damage, LLM attacks); Differentiate between cloud security and on-premises security; Describe the importance of control, compliance, confidentiality, integrity, and availability in a cloud security model; Define key security terms and concepts (e.g., data loss prevention, privileged access, least privilege, zero-trust architecture, security by default, security posture, cyber resilience, firewall, encryption, decryption); Explain how encryption safeguards an organization's data in different usage states (e.g., in use, in transit, at rest); Differentiate between authentication, authorization, and auditing (e.g., multi-factor authentication, two-step verification [2SV], IAM); Define the fundamental cloud security operations (SecOps) terms (e.g., security posture, threat intelligence, threat response).38
Describe the business value of making Google part of an organization's security team with its defense-in-depth, multilayered approach to cloud securityOfficial Cloud Digital Leader objective 5.2 (guide launched August 12, 2026). Recognize how Google Cloud secures every layer of the AI stack (e.g., infrastructure, data, models, platform, agents); Recognize how Google Threat Intelligence provides organizations with proactive insights into cyber threats and identify the unique sources that power its analysis (e.g., Google's vast global visibility, Mandiant's frontline incident response expertise, VirusTotal's crowd sourced threat detection); Recognize the benefits of Security Command Center to proactively discover, prioritize, and remediate security risks and misconfigurations across the Google Cloud environment; Recognize the benefits of using a unified security operations platform, like Google Security Operations, to ingest telemetry and accelerate threat detection and response; Recognize the benefits of Google's secure-by-design cloud platform (e.g., core infrastructure, proprietary data centers, purpose-built servers and networking, custom security hardware and software); Recognize the functionality, business value, and use cases for Google Cloud's AI-assisted and AI-focused security offerings (e.g., Gemini in Google Security Operations, AI Protection, Model Armor); Recognize the functionality, use cases, and business value of Google's other security offerings (e.g., Cloud VPC, Cloud VPN, Cloud Interconnect, firewalls, Cloud Armor, Cloud Logging, IAM, Sensitive Data Protection, Confidential Computing, Certificate Manager, Identity-Aware Proxy); Describe how Google Cloud earns and maintains customer trust in the cloud (e.g., transparency reports, third-party audits, digital sovereignty, data residency, compliance resource manager).38
Total76

Revise Trust and Security with Google Cloud before you drill it

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader)Questions on this topic are short business scenarios that describe an incident, a goal or a worry and ask which threat, principle, term or control it matches, or what business impact to expect. Many options are near-neighbour terms from the same list (confidentiality vs integrity vs availability, control vs compliance, least privilege vs zero trust, threat intelligence vs threat response, authentication vs authorization vs auditing), so the deciding detail is usually one fact in the stem: whether data was read, changed or unreachable, whether an attack has been detected yet, or whether the requirement comes from an outside rule. Harder items ask why a control such as encryption does not stop an attack, who owns a mistake under shared responsibility, or which measure limits the damage after an attack gets through. Expect a few Select TWO items.Google Cloud Security Products and Defense in Depth: Threat Intelligence, Security Command Center, SecOps, Model Armor and More (Cloud Digital Leader)Questions on this topic are short business scenarios that describe a security need, worry or incident and ask which Google Cloud offering fits or what business value an approach brings. Most options are real Google security products from the same family, so the deciding detail is one fact in the stem: whether the need is about outside attackers or your own configuration, finding versus blocking, network location versus identity, data at rest versus data being processed, or where data is stored versus who may access it. Harder items combine two products, ask which risk a single control leaves uncovered, or ask how to choose among many findings. Expect a few Select TWO items, such as the sources behind Google Threat Intelligence.

Other CDL domains

Domain 1: Digital Transformation with Google Cloud18% of the exam · 76 questionsDomain 2: Exploring Data Transformation with Google Cloud18% of the exam · 75 questionsDomain 3: Innovating with Google Cloud Artificial Intelligence18% of the exam · 76 questionsDomain 4: Modernize Infrastructure and Applications with Google Cloud18% of the exam · 75 questionsDomain 6: Scaling with Google Cloud Operations10% of the exam · 42 questionsAll CDL practice questionsMixed sessions across all 6 domains — the way the real exam interleaves them.

Trust and Security with Google Cloud: your questions

Trust and Security with Google Cloud is domain 5 of the CDL exam guide and carries 18% of the scored content — the heaviest of the 6 domains. On a 55-question paper that works out to roughly 10 questions, though Google Cloud does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official CDL exam guide.