Cloud Digital Leader · CHEAT SHEET

Google Cloud Certified Cloud Digital Leader

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Digital Transformation with Google Cloud

17–17%

Why Cloud Technology is Transforming Business

Cloud computing is on-demand access to computing resources as services over the internet, paying only for what you use. Digital transformation uses such technologies to change business processes, culture and customer experiences. Cloud native describes how apps are built (microservices, containers, CI/CD), not where they run, and open source and open standards let workloads move between clouds.
On-premises, the organization buys the hardware, provides space, power and cooling, and waits months to add capacity, but keeps full control. In the cloud, the provider manages the infrastructure, resources are created or retired in seconds and you pay for what you use. In exchange, access depends on network connectivity and the customer keeps part of the security work.
The cloud lets organizations scale resources without investing in physical infrastructure, test ideas without waiting for hardware purchases and pay only for what they use, with FinOps to maximize the value of spend. It can strengthen security through provider features and experts, and offers strategic value: access to the latest innovations and IT staff focused on initiatives that differentiate the business.
On-premises infrastructure and private clouds are single-tenant and give more control, but with limited capacity and higher cost. The public cloud is multi-tenant, run by a third party and scales almost without limit. Hybrid cloud connects public and private environments working on the same task, and multicloud uses several public providers to avoid lock-in and single points of failure.
Google Cloud sums up its benefits in five ideas: intelligence (data and AI for better decisions), freedom (an open, hybrid and multicloud approach without lock-in), collaboration (Google Workspace for working from anywhere), trust (security, encryption and the shared fate model) and sustainability (regions with carbon-free energy and carbon footprint tools).

Fundamental Cloud Concepts

In the cloud, resources are spun up or retired in seconds (agility), grow with the business (scalability) and expand and shrink with demand peaks (elasticity). Backup and disaster recovery improve reliability. Total cost of ownership falls mainly because organizations no longer buy and maintain peak capacity that sits idle the rest of the time, paying only for what they use.
CapEx means large, one-time investments in physical assets such as servers or data centers, depreciated over their useful life. In the cloud, most costs are OpEx: ongoing, more predictable and incurred as resources are consumed. A fair total cost of ownership comparison must include on-premises space, power, cooling, staff and hardware refresh, not just the server purchase price.
Private cloud fits when regulation requires single-tenant environments or full control is needed; a virtual private cloud isolates workloads on shared public infrastructure. Hybrid cloud suits keeping mainframes or regulated apps on-premises while migrating at your own pace. Multicloud suits choosing the best public provider for each workload and avoiding dependence on a single vendor.
A region is an independent geographic area made of zones, and a zone is a deployment area within it; spreading resources across zones and regions limits the impact of failures. DNS maps domain names to IP addresses. Latency is the round-trip delay and bandwidth the bits per second a link can carry. Network edge locations and subsea fiber bring traffic close to users.
Google Cloud runs on the same private, low-latency network as Gmail, Search and YouTube, and traffic stays on its backbone for most of the journey. Workloads are spread across regions, zones, points of presence and cables for redundancy, and connectivity hubs reroute traffic when a subsea cable fails. The Region Picker tool compares regions by carbon footprint, price and latency.

Cloud Computing Models and Shared Responsibility

IaaS provides on-demand compute, storage and networking; the customer manages the operating system, middleware, applications and data (for example, Compute Engine). PaaS provides a managed environment where the customer only brings code and data (App Engine, Cloud Run). SaaS delivers a complete application managed by the provider, usually used through a browser (Google Workspace).
The more the provider manages, the less control and customization the customer keeps. IaaS gives the most control but requires configuring and maintaining systems with experienced staff. PaaS moves infrastructure maintenance and security to the provider, with possible vendor lock-in. SaaS is the quickest to adopt but offers little customization. Pay-as-you-go pricing reduces upfront capital expense.
IaaS fits lift-and-shift migrations of on-premises workloads or apps that need specific VMs and networks (Compute Engine). PaaS fits new applications, such as a website, when teams want to focus on code (App Engine, Cloud Run). SaaS fits when there is no expertise or need to build the application (Google Workspace). FaaS runs code in response to events (Cloud Run functions).
On premises the organization owns the whole stack. In IaaS most security is the customer's and Google handles infrastructure and physical security; in PaaS application-level and IAM controls are shared; in SaaS Google owns most of it. The provider always manages network and infrastructure, and the customer always owns access policies and data. Shared fate adds secure blueprints and guidance.

2. Exploring Data Transformation with Google Cloud

16–16%

The Value of Data

Data creates value when it is analyzed to inform decisions. A database stores and retrieves data for applications; relational ones use tables and ACID transactions. A data warehouse, such as BigQuery, consolidates current and historical data from many sources for reporting and analysis. A data lake keeps structured and unstructured data in its native format, without a predefined schema, for exploration and AI.
Organizations create value in three ways: analyzing data they already have (for example, BigQuery ML to predict with SQL), collecting new data (IoT sensors, app events) and sourcing data externally. BigQuery public datasets are hosted by Google and only queries are paid for; BigQuery sharing lets organizations share and discover third-party data across organizational boundaries without copying it.
Structured data follows a fixed schema in tables; semi-structured data, such as JSON, has tags without a rigid schema; unstructured data (free text, audio, images, video) makes up most enterprise data. The cloud lets organizations store it at petabyte scale in Cloud Storage and data lakes and extract value with AI such as Gemini, turning it into structured information.
The data value chain runs from ingestion to storage, processing, analysis and activation. Pub/Sub ingests events asynchronously; Dataflow processes streaming and batch data with one model, for example in ETL (extract, transform, load) or ELT pipelines; BigQuery analyzes large volumes with SQL, and Looker gives business users dashboards and governed metrics.
Data governance covers everything that keeps data secure, private, accurate, available and usable across its life cycle. It often assigns accountability to data stewards and tracks quality on six dimensions: accuracy, completeness, consistency, timeliness, validity and uniqueness. Without it, AI initiatives suffer from silos, poor-quality data, improper access and compliance gaps.

Google Cloud Data Management Solutions

A relational database organizes structured data in tables linked by primary and foreign keys, is queried with SQL and supports ACID transactions. NoSQL databases (document, key-value, wide-column, graph) use flexible schemas and scale horizontally. Object storage keeps unstructured data as objects with metadata and a unique identifier in a flat storage pool.
BigQuery is a fully managed, serverless data warehouse that separates storage and compute, so there are no resources to provision or scale; with BigQuery Omni it queries data in Amazon S3 or Azure Blob Storage without moving it. Cloud Storage offers Standard for hot data, Nearline for monthly access, Coldline for quarterly access and Archive, the cheapest, for less than once a year.
An organization can move its database as-is (rehost), move it to a managed service such as Cloud SQL or AlloyDB, or modernize it by changing engines. Database Migration Service runs homogeneous and heterogeneous migrations with an initial snapshot and continuous replication to minimize downtime, and converts schema and code with Gemini assistance. Bare Metal Solution runs Oracle as on-premises.

Making Data Useful and Accessible

Looker democratizes data through a semantic layer: analysts define metrics and relationships once in LookML, and business users explore by choosing dimensions, measures and filters without writing SQL. Conversational Analytics, powered by Gemini, answers natural-language questions, and Connected Sheets brings governed data into Google Sheets, always from a single source of truth.
Looker on BigQuery generates SQL that runs in the warehouse itself, so dashboards and reports reflect current data at scale without separate copies. Data is integrated into workflows with the Scheduler (email, webhook, Amazon S3, SFTP), with alerts on dashboard tiles when a condition is met, and with third-party integrations served through an action hub.
Streaming analytics processes and analyzes records continuously as they are generated, instead of in batches whose data can be stale by the time it is processed. This makes data useful from the instant it is created: real-time pricing and promotions from clickstreams, security alerts on anomalous activity, or notifications when a power grid crosses a threshold.
Pub/Sub is an asynchronous, scalable messaging service that decouples the services producing events from those processing them and is used to ingest data from applications and IoT devices. Dataflow is a fully managed service for unified stream and batch processing, built on Apache Beam, that autoscales and transforms data before loading it into BigQuery.

3. Innovating with Google Cloud Artificial Intelligence

16–16%

AI and ML Fundamentals

Artificial intelligence is the broad field of building machines that mimic human cognitive functions; machine learning is a subset of AI that learns from data, without explicit programming, to perform a specific task. Data analytics and BI describe what happened through reports and dashboards, while ML learns patterns from historical data to predict new outcomes.
ML solves different problems depending on the data: supervised learning uses labeled data to classify or predict values (sentiment, spam, forecasts); unsupervised learning finds patterns in unlabeled data (segmentation, anomalies); semi-supervised learning combines a little labeled data with much unlabeled data, and reinforcement learning learns by trial and error. Typical uses: fraud, recommendations and churn.
ML creates business value because it analyzes huge datasets beyond what manual analysis can handle and improves the more data it consumes; it scales decisions by applying learned patterns consistently with less human error, and it unlocks unstructured data such as documents, images and audio, for example with Document AI to extract structured data.
An ML model is only as good as its data: biased data produces biased results. Training data must represent the whole population, avoid data leakage and training-serving skew, and meet quality dimensions such as validity, completeness and freshness. In production, data is validated before retraining, and the pipeline stops when schema anomalies appear.
Explainable AI groups tools that show how a model reaches its outputs: it increases decision-makers' trust, makes models easier to debug and helps detect bias, and it should be applied across the lifecycle, from data to serving. Responsible AI rests on fairness, transparency, accountability, privacy and security, and builds the trust that customers now expect.

Google Cloud’s AI and ML solutions

Choosing an AI solution means weighing speed, effort, differentiation and required expertise. Pre-trained APIs are fastest and need no experts; AutoML trains on your own data without code but with predefined objectives; custom training gives complete control and more differentiation in exchange for more time and data science skills.
Google Cloud offers three paths: pre-trained APIs (Vision, Natural Language, Translation, Speech-to-Text, Text-to-Speech) for common tasks without your own data; AutoML to train a model on the organization's own data and labels without code; and custom training when you need complete control over the algorithm, the framework and the training scale.

Building and using Google Cloud AI and ML solutions

BigQuery ML lets you create, evaluate and run machine learning models with SQL queries inside BigQuery, where they are stored like tables. It brings ML to the data, so data does not have to be exported to other frameworks, and it puts ML within reach of analysts who already know SQL, with models such as regression, K-means or time series.
Pre-trained APIs solve common tasks without training models: Natural Language analyzes text (sentiment, entities, classification); Vision analyzes images (labels, OCR, faces, explicit content); Translation translates text; Speech-to-Text transcribes audio into text; and Text-to-Speech generates natural speech from text. They can be combined, for example to transcribe and then translate.
AutoML lets an organization train its own models from its labeled data without code and with little technical effort: images with its own categories, or tables with a target column for classification, regression or forecasting. This delivers predictions tailored to the business, provided the data is representative and the categories are recognizable to a person.
Vertex AI, whose services are now part of Gemini Enterprise Agent Platform, lets companies build custom models optimized for their own outcome, with any framework, algorithm and metric, plus hyperparameter tuning. Because it is a managed service, teams do not manage servers and can focus on the model that differentiates them from competitors.
TensorFlow is a free, open source machine learning library created by Google that forms an end-to-end ecosystem to build, train and deploy models in the cloud, on your own machines or on mobile devices. Cloud TPUs are Google-designed ASICs that accelerate ML, ideal for large models dominated by matrix computations.

4. Modernize Infrastructure and Applications with Google Cloud

17–17%

Cloud modernization and migration

Modernizing infrastructure with Google Cloud avoids hardware refresh cycles and upfront costs, shifting capital expenditure to operating expenditure. Modernizing applications brings agility to release features sooner, scalability, security and access to analytics and AI; it can proceed gradually with containers on GKE or Cloud Run, or with APIs managed by Apigee.
A workload is an application, service or dataset that consumes resources such as compute or storage. For each one you decide: retire (decommission), retain (leave it where it is), rehost (lift and shift, with almost no changes), replatform (optimize it during the move, for example with a managed database), refactor (change the code towards cloud-native traits) or reimagine (re-architect and rewrite).

Computing in the cloud

A VM is a software-based computer with its own operating system; a container packages code and dependencies and shares the host kernel. Microservices split an application into independent services, and Kubernetes orchestrates containers. Autoscaling adds or removes VMs with load, load balancing distributes traffic, and preemptible VMs are cheaper but Compute Engine can stop them.
Running compute in the cloud lets capacity grow or shrink with demand without buying servers, under a pay-as-you-go model. VMs can be duplicated in minutes to create identical environments, load is spread across many servers so another takes over if one fails, and regions close to users reduce latency.
Compute Engine gives full OS control and root access; GKE supports stateful apps and fine-grained control; Cloud Run runs stateless containers with no infrastructure to manage but limits customization. Scale-to-zero platforms can have cold starts, and on Cloud Run the local file system is ephemeral, so files must go to Cloud Storage.
Compute Engine creates and runs VMs on Google's infrastructure with no up-front investment. It adds value through custom machine types that avoid paying for unused capacity, live migration during host maintenance, instance groups that scale and self-heal, Spot VMs for fault-tolerant batch work, and committed use discounts for steady workloads.
Rehost (lift and shift) moves workloads with minor or no changes: it is the quickest approach, reuses existing tools and skills, and is required when an app can be neither modified nor retired. The trade-off is that the workload does not yet use cloud features. Migrate to Virtual Machines moves VMs to Compute Engine, and VMware Engine keeps VMware tools.

Serverless computing

In serverless computing the provider provisions, manages and scales the infrastructure, and you pay for actual usage with no charge for idle capacity. Scaling needs no tuned rules and can reach zero, and developers focus on code in their usual languages. Its limits are cold starts, reduced server visibility and vendor lock-in.
Cloud Run runs containers or source code with no cluster to manage, scales to zero and splits traffic across revisions for gradual rollouts. Cloud Run functions runs single-purpose code in response to events and bills only execution time. App Engine is a fully managed web platform, although Google recommends Cloud Run to new users.

Containers in the cloud

A VM virtualizes hardware and runs its own guest OS, so it can host different operating systems; a container virtualizes only the OS and shares the kernel, so it is lighter and starts in seconds. The same image behaves the same in development, testing and production, which speeds up CI/CD and separates developer and operations responsibilities.
Microservices let each service scale independently and isolate failures, so one failed service does not necessarily bring down the whole app; event-driven communication, for example with Pub/Sub, reduces coupling. Containers package each service with its dependencies and run on-premises and in the cloud, which enables hybrid cloud.
GKE is managed Kubernetes: Google manages the control plane and, in Autopilot mode, also nodes, scaling and security; it suits complex microservices and stateful apps. Cloud Run runs stateless containers with no cluster and pay-per-use pricing. Both use standard container images, so workloads can move between them.

The value of APIs

An API is software that lets two applications communicate: it defines stable entry points to logic and data so other developers can reuse them. It implies a contract that changes predictably, so the backend can change without breaking consumers, and it acts as an abstraction layer that connects legacy systems to new products.
Exposing valuable data and services as public APIs opens new business channels: partners and developers build products on them and the organization can charge for their use. In Apigee, APIs are bundled into API products with rate plans that define fees and charges, with prepaid or postpaid billing and even revenue sharing with developers.
Apigee is Google Cloud's native platform to build, manage, and secure APIs. Its proxies isolate consumers from the backend and its policies add security, quotas, and rate limiting without changing code; it also offers developer portals, analytics, monetization, and Apigee hybrid to process traffic in your own Kubernetes cluster.

Hybrid and multi-cloud

Hybrid cloud combines on-premises or private cloud with public cloud: it helps meet regulations, keep systems that are hard to migrate, modernize at your own pace, and run low-latency apps at the edge. Multicloud uses several public providers to get the best of each, avoid vendor lock-in, and reduce single points of failure.
Anthos, whose multi-cluster capabilities are now part of GKE, provides a single place to manage clusters on Google Cloud, other clouds, and on premises. Fleets group clusters so the same configuration and policies apply and they can be viewed in the console; GKE Multi-Cloud creates clusters on AWS and Azure, and attached clusters bring in existing ones.

5. Trust and Security with Google Cloud

17–17%

Trust and security in the cloud

Top threats include ransomware, now financially motivated multifaceted extortion, phishing, malware, DDoS attacks, insider threats, and misconfigurations, a leading cause of cloud data breaches. Compared with on premises, the cloud shares responsibility with the provider and requires controlling identities and dynamic workloads.
A cloud security model protects confidentiality (only authorized people get access), integrity (nothing is altered without authorization), and availability (services stay reachable, including against DDoS). Control and compliance rely on customer-managed keys in Cloud KMS, Access Transparency to audit access by Google personnel, and auditable controls.
Key terms: zero trust removes implicit trust and verifies each access by identity and context; least privilege grants only the access needed; DLP discovers, classifies, and de-identifies regulated data; SIEM analyzes logs to detect threats. Symmetric encryption uses one key and asymmetric encryption uses a public and a private key.

Google’s trusted infrastructure

Google designs its own data centers, servers, network, and security chips such as Titan, which authenticates hardware and its boot code. Purpose-built servers drop unneeded components that could add vulnerabilities, physical security is layered, and protection is built in progressive layers from hardware to operations: defense in depth.
Encryption protects data in three states: at rest (Google Cloud encrypts it by default and CMEK adds key control), in transit (TLS to the Google Front End), and in use (Confidential Computing). Authentication verifies identity, IAM authorization decides who can do what on which resources, and auditing with Cloud Audit Logs records who did what, where, and when.
2-step verification (2SV) stops a stolen password from being enough to sign in and mitigates phishing; Google recommends FIDO security keys, especially for super admins. IAM controls who can do what on which resources: roles (collections of permissions) are granted to principals on resources, preferably predefined roles rather than basic ones.
Cloud Armor protects applications against DDoS attacks and web attacks such as SQL injection or XSS, on Google Cloud, hybrid or multicloud environments. It offers always-on protection against volumetric L3 and L4 DDoS, preconfigured WAF rules for the OWASP Top 10, and Adaptive Protection, which uses machine learning to detect L7 attacks and suggest rules.
Security operations (SecOps) means detecting, investigating and responding to threats. Google Security Operations is a cloud-native platform that unifies SIEM, SOAR and threat intelligence, ingests telemetry from on-premises, other clouds and SaaS, provides detections maintained by Google and playbooks that automate response to shorten reaction time.

Google Cloud’s trust principles and compliance

Google Cloud's trust principles say customers own their data, Google neither sells it nor uses it for advertising, it is encrypted by default and no government gets backdoor access. Security is a shared responsibility: Google protects the infrastructure and the customer its data and access; with shared fate, Google also provides guidance and secure blueprints.
Google builds trust through transparency: its Transparency Reports publish data on how governments and companies affect privacy and explain how it handles government requests, and Access Transparency logs each access by its personnel to customer data. Independent third-party auditors also verify its controls and issue certifications and attestations.
The laws where a company operates, the laws where its customers are and industry regulations can require data to reside in a specific place or stay beyond the provider's reach. Google Cloud lets organizations choose where resources are created with organization policies, apply regimes with Assured Workloads, manage keys outside the cloud and run Google Distributed Cloud on premises or air-gapped.
The compliance resource center gathers Google Cloud's certifications, attestations and guidance organized by region and industry, and explains that for laws such as HIPAA Google provides documents and mappings rather than certifying the customer. Compliance Reports Manager lets customers download ISO/IEC certificates, SOC reports and self-assessments on demand at no additional cost.

6. Scaling with Google Cloud Operations

17–17%

Financial governance and managing cloud costs

Cloud financial governance (FinOps) brings technology, finance and business together so each team is accountable for its spending. Google Cloud recommends aligning spend with business value, fostering cost awareness, using only what is needed and optimizing continuously; Cloud Billing budgets alert when actual or forecasted thresholds are crossed and can automate responses through Pub/Sub.
In the cloud most costs are operational expenditure (OpEx) incurred on consumption, unlike the capital expenditure (CapEx) of owned hardware. Committed use discounts lower prices in exchange for committing usage or spend for a term; Spot VMs use excess capacity that is cheaper but can be interrupted; and unit economics measures cost per business unit.
The resource hierarchy runs from the organization to (optional) folders and projects, which contain the resources. With an organization, projects belong to the company and are managed centrally; folders model departments and delegate administration; and roles granted at a higher level are inherited, because the effective policy is the union of a resource's own policy and its ancestors'.
Cloud Billing budgets compare actual or forecasted spend with a planned amount and, through threshold rules, alert by email or through Pub/Sub to automate responses; on their own they do not stop spending. Quotas, by contrast, restrict how much of a resource or API a project can consume and block usage beyond the limit.
Cloud Billing Reports show a chart of a billing account's costs in the console that can be filtered by time range and grouped by project, service, SKU, location or label key. For the current month they include actual cost-to-date and a trend-based forecast, and the data can be downloaded as CSV.

Operational excellence and reliability at scale

Modernizing operations on Google Cloud means relying on managed services with automatic scaling, automating repetitive tasks to eliminate toil, and delivering software with CI/CD and progressive rollouts. Google Cloud Observability collects logs, metrics and traces automatically so teams can detect and resolve issues sooner.
Observability means collecting and analyzing telemetry to understand the state of applications: metrics (periodic numeric measurements), logs (timestamped events) and traces (the path of a request). A failure domain is a resource that can fail independently, such as a VM or a zone, and graceful degradation keeps a service running with reduced functionality under overload.
Disaster recovery starts from the RTO (maximum time offline) and the RPO (maximum period of data loss); the smaller they are, the more it costs, and a cold, warm or hot pattern is chosen. For high availability, Google Cloud recommends replicating critical components across zones and regions with automatic failover and scaling horizontally.
An SLI measures service behavior, an SLO sets the internal target and an SLA is the customer promise with a penalty; the error budget (1 minus the SLO) guides when to release or prioritize reliability. DORA measures delivery through deployment frequency and lead time (velocity) and change failure rate and time to restore (stability); postmortems are blameless.
Every customer gets Basic Support (documentation, forums, billing assistance and Active Assist). Standard Support targets workloads under development, Enhanced Support production workloads and Premium Support critical workloads, with a Technical Account Manager, Customer Aware Support, Operational Health Reviews and the Event Management Service for planned peaks.

Sustainability with Google Cloud

Google already matches its electricity use annually with wind and solar purchases, and its goal is 24/7 carbon-free energy: matching its consumption with carbon-free energy every hour and in every region. It publishes each region's Google CFE% and grid carbon intensity so customers can factor carbon into where they run workloads.
Carbon Footprint estimates the emissions of Google Cloud usage by project, region and product, with location-based and market-based figures and export to BigQuery. Region Picker helps choose a region by carbon, price and latency, and the Active Assist unattended project recommender suggests shutting down forgotten projects to cut cost, risk and emissions.

Practice this certification