CDL cheat sheet — every exam topic on one page

Digital Transformation with Google Cloud

Why Cloud Transforms Business: Benefits, Drivers and Google Cloud Differentiators (Cloud Digital Leader)

• Cloud computing has five essential characteristics (NIST): on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.
• Infrastructure is the compute, storage and networking layer that applications run on.
• Digital transformation changes processes, culture and customer experience; digitization and rehosting alone do not.
• Agentic AI plans steps and acts through tools; generative AI creates content, predictive ML forecasts, and rule-based automation follows fixed logic.
• Open source is code licensed for anyone to use, modify and share; an open standard is a public specification that open or closed products can implement.
• Each cloud benefit solves a distinct problem: scalability changes how much, flexibility changes which kinds, global reach fixes distance, high availability survives failure.
• Pay-as-you-go turns CapEx into OpEx, but savings come only from matching capacity to use; committed use discounts are an optional price reduction for steady use.
• Security is shared: the provider secures the infrastructure and encrypts data at rest by default; the customer manages access, configuration, data classification and compliance.
• Drivers are customer expectations, digital-native competition and the data and AI opportunity; hurdles are skills, culture and unmodernized legacy; waiting risks falling behind and technical debt.
• The exam guide's example differentiators are world-leading AI, openness, AI Hypercomputer, an AI-ready data platform, frontline-informed security and Google's global network.

Cloud Concepts: Hybrid and Multicloud, Regions and Zones, IaaS vs PaaS vs SaaS (Cloud Digital Leader)

• Private cloud is the cloud model on dedicated infrastructure: isolation and control, but the organization funds and maintains the hardware and its capacity is capped at what it owns.
• Hybrid cloud combines on-premises or private infrastructure with public cloud; multicloud uses two or more public providers. One estate can be both (hybrid multicloud).
• Multicloud reduces dependence on one provider and lets you pick the best service per workload, at the cost of more tools, skills and bills to manage.
• An IP address identifies a device or service (external or internal, ephemeral or static); DNS (Cloud DNS on Google Cloud) translates domain names into IP addresses. Cloud NAT translates addresses for outbound traffic, not names.
• Latency is delay and grows with distance; bandwidth is capacity per second. Delay without loss of quality, or many sequential round trips, point to latency; slow bulk transfers point to bandwidth.
• A region contains several zones. Spreading across zones survives a zone outage; surviving a region outage needs a second region, which must also meet any data-residency rule.
• Edge locations bring traffic onto Google's private backbone near users and cache content with Cloud CDN, cutting delay and load on origin servers; they don't run main workloads or help per-user content.
• IaaS (Compute Engine) gives the most control and most management, PaaS (App Engine, Cloud Run) lets teams ship code without servers, and SaaS (Google Workspace) is a finished app with limited customization.
• From IaaS to SaaS, OS patching and application updates move to the provider; data and access decisions always stay with the customer.

Exploring Data Transformation with Google Cloud

Data in Digital Transformation: Databases, Lakes, Warehouses and Governance (Cloud Digital Leader)

• Data creates value when it is analysed and acted on: real-time insights, trends, evidence-based strategy and the raw material for AI. Storing or copying data alone adds no new insight.
• AI models learn from data, so siloed, incomplete data weakens them. The fix is connecting the data, not adding volume or compute to a fragmented picture.
• Databases run transactions, warehouses hold cleaned structured data from many systems for analysis (schema-on-write), and lakes keep raw data of any type in its native format (schema-on-read).
• Heavy analytics on the transactional database slows operations. A warehouse separates the two workloads and combines data from many sources.
• A data lake without a catalogue, owners and access policies becomes a data swamp. Governance fixes it while keeping the lake's flexibility.
• Data source type follows who collected it: first-party (you), second-party (a partner's own data shared directly), third-party (a provider's aggregated product).
• Structured data has a fixed schema, semi-structured data has labelled but varying fields (JSON, XML), and unstructured data has no model (images, audio, free text).
• The data supply chain runs genesis, collection, processing, storage, analysis, activation. Fix quality problems once at processing, not in every dashboard.
• Activation puts insight into the workflows where people and systems act. Accurate reports nobody uses create no value.
• Governance classifies first, assigns owners, agrees definitions, grants role-based access and audits continuously. Open formats and standard interfaces break silos without vendor lock-in.

Google Cloud Data Products: Cloud SQL, Spanner, AlloyDB, Bigtable, BigQuery, Firestore and Storage Classes (Cloud Digital Leader)

• Relational databases use linked tables, SQL and transactions; NoSQL databases use flexible models such as documents or wide-column rows; object storage keeps whole files in buckets.
• Files such as images, video and backups go in Cloud Storage, not a database.
• Cloud SQL runs managed MySQL, PostgreSQL and SQL Server for regional apps that want to keep their engine; it is the only choice of the three relational products for SQL Server.
• AlloyDB is high-performance, PostgreSQL-compatible and speeds analytics on live operational data in the same database.
• Spanner is relational with strong consistency and horizontal scale across regions: the choice for global transactions or a database that has outgrown one server.
• Bigtable serves massive throughput and millisecond key lookups (IoT, ad tech, personalization); BigQuery runs serverless SQL analytics over huge datasets; Firestore syncs mobile and web app data in real time and offline.
• Move heavy reporting off the transactional database into BigQuery; a bigger operational database does not separate the workloads.
• Pick the storage class by total cost: Standard for frequent access, Nearline about monthly, Coldline about quarterly, Archive less than yearly; colder classes add retrieval fees and minimum durations.
• Autoclass moves each object by its own access, returns read objects to Standard, charges no retrieval or early deletion fees (a management fee applies) and replaces class-changing lifecycle rules.
• Database Migration Service migrates into Cloud SQL and AlloyDB, converts Oracle to PostgreSQL-compatible targets, and its continuous mode keeps the source live until a short cutover.

Smart Analytics on Google Cloud: Looker, Streaming Analytics, Pub/Sub, Dataflow and Spark (Cloud Digital Leader)

• Looker democratizes data: business users explore governed data and build reports without writing SQL, within role-based permissions.
• Looker's semantic model, written in LookML, defines each metric once, so every report and self-service user gets the same numbers.
• Self-service and governance work together: when figures disagree, settle the business rule once in the model so every user inherits it.
• Looker queries BigQuery in place instead of working from an extract, so dashboards stay current, subject to the model's cache policy.
• Workflow integration puts Looker data into other tools: scheduled delivery, sending results to other services through actions and webhooks, and embedded analytics in your own application.
• Streaming analytics matters when an insight loses its value within minutes (security alerts, live pricing, equipment faults); batch suits reviews of a closed period.
• Pub/Sub ingests events at scale and delivers them asynchronously to many subscribers, decoupling producers from consumers.
• Dataflow is serverless batch and streaming processing on Apache Beam: one codebase for both, no clusters to manage.
• Managed Service for Apache Spark (formerly Dataproc) runs existing Spark and Hadoop jobs largely as they are, on managed clusters you create and delete as work requires.
• A typical modern pipeline is Pub/Sub ingest, Dataflow processing, BigQuery storage and analysis, and Looker visualization.

Innovating with Google Cloud Artificial Intelligence

AI, Machine Learning and Generative AI Fundamentals: Business Value, Data Quality and Responsible AI (Cloud Digital Leader)

• ML is part of AI, and generative AI is part of ML; rule-based expert systems are AI but not ML.
• Generative AI creates new content; predictive ML scores or classifies; analytics answers questions; BI reports performance.
• Agentic AI plans and takes actions in other systems toward a goal; a chatbot only answers.
• The exam guide names five key benefits of Google Cloud's AI offerings: infrastructure, an AI-ready data cloud, first-party models, an all-in-one developer platform, and pre-built agents and applications. Pick the one that removes the root cause within the constraint.
• ML fits complex, changing patterns, large structured or unstructured datasets, and high-volume repeated decisions.
• Keep rules where logic is fixed, fully known and must be traceable; many systems combine a model with fixed rules.
• A model learns its data's flaws, so fix the data (and the process that produces it) when a model underperforms.
• Six data quality dimensions: completeness, uniqueness, timeliness, validity, accuracy, consistency. Validity is allowed; accuracy is true; consistency is agreement across sources.
• Explainable AI shows what drove a prediction; per-prediction explanations are needed when individual decisions must be justified.
• Responsible AI reduces the risk of harm, legal action and reputation damage through testing, fairness review and named accountability.

Google Cloud AI Offerings for Business Value: Agent Platform, Pre-trained APIs, AI Hypercomputer and BigQuery ML (Cloud Digital Leader)

• Choosing an AI solution trades speed, effort and expertise against differentiation: pre-built apps and pre-trained APIs are fastest; custom models on your own data differentiate but need data and skills.
• Model Garden gives choice and flexibility: Google, open and partner models on one platform, so teams pick the best model per task and avoid lock-in. The Model Registry versions your own models.
• Gemini Enterprise Agent Platform is the unified platform to access models, tune, train, build, deploy (Agent Runtime) and monitor AI models and agents.
• Build on Agent Platform for custom or customer-facing agents that use company data and act through company systems; use the pre-built Gemini Enterprise app for generic employee needs.
• Vision reads images (labels, landmarks, text, SafeSearch); Translation converts text between languages with glossaries; Speech-to-Text turns audio into text, batch or streaming; Text-to-Speech runs the other way.
• Purpose-built APIs fit well-defined tasks; Gemini fits open-ended, multimodal generation such as drafting and summarizing. Combine them when a project has both kinds of task.
• Agent Studio tunes foundation models on your examples to change how they respond; grounding adds facts. AutoML builds custom image and tabular models from labeled data without code.
• AI Hypercomputer combines TPUs and GPUs with fast storage and networking, open frameworks such as PyTorch, JAX and TensorFlow, and flexible consumption models.
• Match consumption to workload: committed use discounts on reserved capacity for steady use, Spot VMs for interruptible work, flex-start for short jobs that can wait, calendar-mode future reservations for guaranteed capacity in a fixed future window, on-demand for the unpredictable.
• BigQuery ML creates and runs models with standard SQL inside BigQuery, so analysts experiment quickly without exporting data; remote models bring Gemini into SQL queries.

Modernize Infrastructure and Applications with Google Cloud

Cloud Migration Strategies and Compute Terms: Rehost, Replatform, Refactor, Containers, Serverless and Spot VMs (Cloud Digital Leader)

• A workload is an application or service plus the resources it needs; migrations move workloads in waves, not servers.
• Discovery and assessment come first: dependencies decide what moves together, usage decides size and cost.
• Retire needs a reason to stop (no users, a replacement); retain needs a reason to stay (regulation, recent hardware, a contract) and a later review.
• Rehost is fastest but carries over sizing and design; replatform adds targeted upgrades like a managed database; refactor changes the architecture; reimagine changes the business process.
• Each workload in a portfolio gets its own approach, decided by its stated constraints.
• VMs virtualize hardware with a full OS each; containers package the app with its dependencies and share the host kernel, so they are lighter and portable.
• Microservices are released and scaled independently; Kubernetes orchestrates containers by scheduling, restarting and scaling them.
• Managed means the provider does the upkeep; serverless also removes servers entirely, scales to zero and charges per use.
• Spot VMs are deeply discounted, can be stopped at any time and have no maximum runtime, unlike legacy preemptible VMs' 24-hour cap; keep live services off them.
• Autoscaling changes how many instances run; load balancing spreads traffic and routes around failed instances.

Compute Engine, GKE, Cloud Run and Multicloud Products: Business Value of Google Cloud Infrastructure (Cloud Digital Leader)

• Compute Engine gives full OS control and a fast way to move applications unchanged; you still patch what runs inside the VM.
• Spot VMs are cheapest but can be reclaimed, so use them only for work that can restart.
• Committed use discounts suit steady, long-term usage; autoscaled managed instance groups suit variable demand. Commit to the baseline and autoscale the spikes.
• Microservices let teams release and scale parts of an application independently and keep a failure in one service from taking down the rest.
• Managed services shift infrastructure work such as patching, backups and capacity planning to Google; the application, its data and access stay the customer's responsibility.
• GKE is managed, open-source-based Kubernetes; Autopilot also manages the nodes and by default bills for the resources pods request.
• Cloud Run runs any container serverlessly and scales to zero; Cloud Run functions run small event-driven code.
• BigQuery Omni queries data in AWS and Azure in place; AlloyDB Omni runs AlloyDB outside Google Cloud; Looker gives governed metrics across clouds.
• GKE fleets and multicloud features (formerly sold as GKE Enterprise) manage Kubernetes clusters across clouds and on premises; Google Distributed Cloud brings Google Cloud into your own sites.

APIs and Apigee: The Business Value of APIs (Cloud Digital Leader)

• An API is a contract between programs: agreed requests and responses, with the provider's internals hidden. Keep the contract stable and the provider can change everything behind it.
• One API can serve every channel with the same live data, and a stable API layer lets an old backend be replaced piece by piece while apps keep shipping.
• Public-facing APIs let partners and developers build on an organization's capabilities, opening new channels and customers; callers still authenticate, and the provider still runs the backend.
• Consumption pricing scales with use, recurring and setup fees are fixed, and revenue sharing pays the developer a share of the sales it generates.
• In Apigee, rate plans on API products set the fees; prepaid wallets collect charges up front (and can block calls at zero balance with a monetization limits check), while postpaid invoices after use.
• Apigee puts proxies with shared policies in front of existing APIs, including legacy systems, without moving or rewriting the backends.
• Only enforced controls stop bad traffic: keys or OAuth tokens turn away unapproved callers, and quotas and spike arrest stop floods. Analytics only reports afterwards.
• Analytics answers who uses what; the developer portal lets developers onboard themselves; Advanced API Security finds misconfigured APIs and abuse.
• API Gateway and Cloud Endpoints secure and monitor APIs; Apigee is the choice when APIs are a product needing monetization and a developer portal, whatever the backend runs on.
• Apigee hybrid keeps request processing on customer-managed Kubernetes while Google hosts the management plane.

Trust and Security with Google Cloud

Cloud Security Fundamentals: Threats, Shared Responsibility, Zero Trust, Encryption and IAM (Cloud Digital Leader)

• Name a threat by what it did: data locked for ransom is ransomware, a surprise compute bill is cryptomining, an outage from a traffic flood is DDoS, data exposed by your own settings is misconfiguration.
• Malware is the family; a virus is the kind that spreads by infecting files.
• Prompt injection manipulates a model through its input at run time; data poisoning corrupts its training data beforehand.
• Isolated, tested backups limit ransomware damage; a physical disaster hits one place, so resilience means more than one region.
• In Google Cloud, Google secures the infrastructure; the customer secures its data, identities and access configuration, so misconfiguration stays the customer's to prevent.
• Confidentiality = not seen by the wrong people; integrity = not changed; availability = reachable. Control is deciding for yourself; compliance is meeting and proving external rules.
• Least privilege limits access in scope and in time; privileged access is kept small, temporary, approved and logged.
• Zero trust verifies every request on identity and device; a stronger perimeter is still perimeter security.
• Encryption protects data at rest, in transit and in use, but it does not stop someone using stolen valid credentials.
• Authentication (2SV, MFA) proves who you are, authorization (IAM) decides what you may do, auditing records what you did.

Google Cloud Security Products and Defense in Depth: Threat Intelligence, Security Command Center, SecOps, Model Armor and More (Cloud Digital Leader)

• Defense in depth stacks independent layers; Google supplies and runs many of them, from hardware to AI security.
• AI security covers every layer: infrastructure, data, models, platform and agents. Prompt screening alone cannot detect poisoned training data.
• Google Threat Intelligence looks outward at attackers, powered by Google's global visibility, Mandiant's incident response and VirusTotal's crowdsourced analysis.
• Security Command Center looks inward: it finds, ranks and helps fix misconfigurations and vulnerabilities; attack path simulation shows which fixes cut the most risk.
• Google Security Operations unifies ingestion, detection and response so analysts search huge telemetry volumes fast; Gemini in it adds natural-language search and case summaries.
• Model Armor screens prompts and responses (injection, jailbreaks, sensitive data, harmful content, malicious URLs), even for models outside Google Cloud; AI Protection inventories AI assets and risks in Security Command Center.
• Titan chips are the hardware root of trust that verifies Google's servers boot untampered firmware.
• Cloud VPN is a quick, low-cost encrypted tunnel over the internet; Cloud Interconnect is a private, high-bandwidth link off the public internet.
• Cloud Armor filters DDoS, web attacks, bots and countries at the edge; IAP admits users to an app by identity and device without a VPN; IAM sets permissions on resources.
• Sensitive Data Protection finds and de-identifies sensitive data; Confidential Computing protects data in use; transparency reports, audits, Assured Workloads and region choice build trust.

Scaling with Google Cloud Operations

Controlling Cloud Costs: CapEx vs OpEx, FinOps, Resource Hierarchy, Quotas and Budgets (Cloud Digital Leader)

• Cloud turns up-front CapEx into variable OpEx; finance moves from approving purchases to tracking and forecasting spend continuously.
• A fair TCO counts facilities, power, cooling, staff and hardware refresh on premises, and sizes cloud resources to real usage rather than peak.
• Google recommends a cross-functional FinOps team (finance, technology, business) and making every team see and own its spend.
• Tools alone do not control cost: alerts need named owners (people) and an agreed follow-up routine (process).
• Billing reports show trends; billing export to BigQuery is for automated, custom analysis; labels split costs inside one project; Recommender finds idle and oversized VMs.
• The hierarchy runs organization → folders → projects → resources; billing attaches at the project.
• Policies inherit downward to existing and future children; inherited IAM grants add up, so a lower-level change cannot cancel a grant made higher up.
• Quotas cap resource use; alerts-only budgets notify (actual or forecasted thresholds) and never stop spending; spend cap budgets can pause only a few services such as Cloud Run and the Gemini API.
• Spot VMs are cheap but can be reclaimed at any time; Dynamic Workload Scheduler Flex-start provisions accelerators together and bills only while they run.

Cloud Digital Leader: Modern Operations, Observability, Resilience and SRE

• Google Cloud Observability (formerly the operations suite) is Google Cloud's managed suite for metrics, logs, traces, profiles and errors.
• Cloud Monitoring = metrics, dashboards, alerting policies and uptime checks; Cloud Logging = central, searchable log entries.
• Cloud Trace shows where delay builds up across services; Cloud Profiler shows which functions use CPU and memory inside the code.
• Error Reporting groups exceptions from logs by cause, with counts and first-seen times, and flags new kinds.
• An uptime check probes a public URL from the internet like a visitor, so it sees failures that never reach the servers.
• High availability = accessible with minimal downtime; operational excellence = how well the team deploys, runs and improves workloads.
• Redundancy protects against the failure domain the copies do not share: several zones for a zone outage, several regions for a regional one.
• Replicas copy mistakes; only backups — stored outside the region they protect — can undo deleted or corrupted data.
• The four golden signals are latency, traffic, errors and saturation; saturation is the early warning.
• SLI = measurement, SLO = stricter internal target, SLA = contract with credits; the error budget is the unreliability the SLO allows.