Google Cloud Digital Leader
Last reviewed: May 2026
A scannable reference of architectural patterns the CDL exam tests. Read top-to-bottom, or jump to a section.
Shift IT spending from large upfront hardware purchases to a pay-as-you-go model.
Utilize cloud services to convert capital expenditure (CapEx) to operational expenditure (OpEx).
Why: Cloud provides financial flexibility, lowers entry barriers, and aligns costs directly with usage, avoiding over-provisioning.
Clarify security ownership between the cloud provider and the customer.
Google secures the cloud infrastructure (hardware, network). The customer secures what they put in the cloud (data, IAM, application code).
Why: The customer is always responsible for their data and access controls, regardless of the service model (IaaS, PaaS, SaaS).
Adopt cloud while maintaining flexibility to use other platforms or technologies.
Prioritize services built on open-source technologies like Kubernetes (GKE), TensorFlow, and Apache Beam (Dataflow).
Why: Open-source standards increase workload portability, preventing lock-in to proprietary APIs and enabling hybrid/multi-cloud strategies.
Reduce the carbon footprint of IT operations to meet corporate sustainability targets.
Host workloads on Google Cloud, leveraging its 100% renewable energy match. Use the Carbon Footprint tool to monitor and select low-carbon regions.
Why: Google Cloud operates one of the cleanest clouds, allowing businesses to inherit its sustainability benefits.
Integrate on-premises infrastructure with cloud services due to regulation or data sovereignty.
Use Anthos for a consistent Kubernetes-based platform across on-premises and Google Cloud.
Why: Anthos provides a unified management and control plane for applications, regardless of where they run, simplifying hybrid operations.
Analyze petabytes of structured data with complex SQL queries without managing infrastructure.
Use BigQuery.
Why: BigQuery is a fully-managed, serverless data warehouse optimized for large-scale analytical queries.
Need a globally distributed relational database with strong consistency and horizontal scalability.
Use Cloud Spanner.
Why: Spanner combines relational semantics (ACID, SQL) with non-relational scale, ideal for mission-critical global applications like finance.
Store and retrieve large volumes of simple key-value data (e.g., IoT, user profiles) with single-digit millisecond latency.
Use Cloud Bigtable.
Why: Bigtable is a wide-column NoSQL database optimized for high-throughput, low-latency operational and analytical workloads.
Build a mobile or web app that requires real-time data synchronization and offline functionality.
Use Firestore.
Why: Firestore is a NoSQL document database with built-in real-time sync and offline persistence, designed for modern application development.
Migrate a traditional on-premises MySQL, PostgreSQL, or SQL Server database to a managed cloud service with minimal changes.
Use Cloud SQL.
Why: Cloud SQL is a fully-managed relational database service that provides compatibility with standard database engines, automating backups, patches, and replication.
Ingest and process a high-volume, real-time stream of data (e.g., IoT, clickstreams) for immediate analysis.
Use Pub/Sub for ingestion, Dataflow for stream processing, and BigQuery for analytics.
Why: This is the canonical serverless pattern for scalable, real-time analytics on Google Cloud.
Store data with varying access patterns (frequent, infrequent, archive) cost-effectively.
Use Cloud Storage with lifecycle policies to automatically transition data between Standard, Nearline, Coldline, and Archive classes.
Why: Lifecycle policies automate data tiering, matching storage cost to access frequency without manual intervention.
Store vast amounts of raw, unstructured, and semi-structured data for future processing and analysis.
Use Cloud Storage as the central repository (data lake).
Why: Cloud Storage offers durable, low-cost object storage that integrates with all GCP data processing services (BigQuery, Dataproc, Dataflow).
Run large-scale data processing jobs using open-source frameworks like Apache Spark and Hadoop.
Use Dataproc.
Why: Dataproc provides fully managed Spark and Hadoop clusters, automating cluster creation and management, allowing teams to focus on their jobs.
Add AI capabilities like image recognition, sentiment analysis, or speech transcription to an app without ML expertise.
Use pre-trained APIs: Vision AI, Natural Language AI, Speech-to-Text API, Translation API.
Why: These APIs provide Google's state-of-the-art models for common use cases, requiring only a simple REST API call.
Train a custom ML model using your own labeled data (e.g., product images, customer text) but with no ML coding experience.
Use AutoML within Vertex AI.
Why: AutoML automates the process of model building, enabling teams to create high-quality custom models via a simple graphical interface.
A data science team needs a unified platform to build, train, deploy, and manage custom ML models throughout their lifecycle (MLOps).
Use Vertex AI.
Why: Vertex AI is a comprehensive MLOps platform that provides tools for every step of the machine learning workflow in a single environment.
Automatically extract structured information (e.g., invoice numbers, line items) from scanned documents or PDFs.
Use Document AI.
Why: Document AI is specifically trained to understand document layouts and extract structured data, reducing manual data entry.
Build a chatbot or voice-based virtual agent to handle customer service inquiries.
Use Dialogflow.
Why: Dialogflow is a natural language understanding platform designed for building conversational interfaces, managing intents, entities, and conversation flow.
Build and run predictive models directly on data stored in a data warehouse using only SQL.
Use BigQuery ML.
Why: BigQuery ML democratizes machine learning by allowing data analysts to create models using familiar SQL syntax, avoiding data movement.
Build applications that can generate new content, such as text summaries, code, or images.
Use the Vertex AI platform for Generative AI, accessing foundation models like Gemini.
Why: Vertex AI provides managed access to powerful foundation models via APIs, enabling rapid development of generative AI features.
Migrate a legacy application running on a VM to the cloud with minimal changes, requiring full OS control.
Use Compute Engine.
Why: Compute Engine (IaaS) provides virtual machines, offering maximum control and a direct migration path for on-premises servers.
Deploy a stateless, containerized web application that must scale automatically based on traffic, including scaling to zero.
Use Cloud Run.
Why: Cloud Run is a fully-managed serverless platform for containers that abstracts away all infrastructure and bills only for active request processing time.
Run a complex microservices architecture using containers, requiring fine-grained orchestration and control.
Use Google Kubernetes Engine (GKE).
Why: GKE provides a managed, production-ready Kubernetes environment, offering full orchestration capabilities while automating cluster management.
Execute a small piece of code in response to an event, like a file upload to Cloud Storage or a Pub/Sub message.
Use Cloud Functions.
Why: Cloud Functions (FaaS) is a serverless, event-driven compute service ideal for short-lived, single-purpose functions without managing servers.
Deploy a web application and focus only on writing code, letting the platform handle servers, scaling, and patching.
Use App Engine.
Why: App Engine (PaaS) is a fully-managed platform that abstracts all infrastructure, ideal for developers who want the fastest way to deploy an application.
Run large, fault-tolerant batch processing or high-performance computing jobs at the lowest possible cost.
Use Spot VMs on Compute Engine.
Why: Spot VMs offer deep discounts (up to 91%) for workloads that can be interrupted, making them highly cost-effective for non-critical batch jobs.
Establish a high-bandwidth, low-latency, private connection between an on-premises data center and Google Cloud.
Use Cloud Interconnect.
Why: Cloud Interconnect provides a dedicated physical connection, offering more reliable and consistent performance than VPN over the public internet.
Deliver web or video content to a global user base with low latency.
Use Cloud CDN.
Why: Cloud CDN caches content at Google's globally distributed edge locations, serving users from a point of presence near them.
Store and manage container images, OS packages, and language packages securely with vulnerability scanning.
Use Artifact Registry.
Why: Artifact Registry is a universal, managed repository that integrates with CI/CD and GKE to provide secure and centralized package management.
Migrate existing VMware workloads to Google Cloud without re-architecting applications or changing operational tools.
Use Google Cloud VMware Engine.
Why: It provides a dedicated, fully managed VMware software-defined data center (SDDC) running on Google Cloud, enabling a seamless "lift and shift" for VMware.
Manage user access to cloud resources based on job function, following the principle of least privilege.
Assign predefined or custom IAM roles to Google Groups, not individual users.
Why: Managing permissions via groups simplifies administration and ensures new users automatically inherit the correct, minimal permissions.
Gain a centralized view of security vulnerabilities, threats, and misconfigurations across the entire GCP organization.
Use Security Command Center.
Why: It acts as a single pane of glass for security, aggregating findings from multiple sources and providing actionable insights.
Protect public-facing web applications from DDoS attacks and common web exploits (e.g., SQL injection).
Use Cloud Armor.
Why: Cloud Armor is Google's Web Application Firewall (WAF) and DDoS mitigation service that integrates with the global load balancer.
Encrypt data in cloud services while maintaining full control over the encryption keys.
Use Cloud Key Management Service (Cloud KMS) to create Customer-Managed Encryption Keys (CMEK).
Why: CMEK allows you to control the key lifecycle (rotation, destruction) for compliance or policy reasons, while Google manages the key infrastructure.
Discover, classify, and redact sensitive data (e.g., credit card numbers, PII) stored in Cloud Storage or BigQuery.
Use Cloud Data Loss Prevention (DLP).
Why: Cloud DLP provides tools to automatically scan and take action on sensitive data to prevent accidental exposure.
Provide secure access to internal web applications for employees without using a traditional VPN.
Use Identity-Aware Proxy (IAP).
Why: IAP enforces access policies based on user identity and context, creating a zero-trust security model for applications.
Prevent data exfiltration by creating a security perimeter around sensitive Google Cloud projects and services.
Use VPC Service Controls.
Why: VPC Service Controls isolates services and data, ensuring that data cannot be moved outside the defined perimeter, even by a user with valid IAM permissions.
Securely store and manage application secrets like API keys, passwords, and certificates.
Use Secret Manager.
Why: Secret Manager provides a centralized, versioned, and audited store for secrets with granular IAM permissions, which is more secure than storing them in code or configuration files.
Gain comprehensive observability into application and infrastructure health through metrics, logs, and traces.
Use the Google Cloud operations suite: Cloud Monitoring (metrics/alerts), Cloud Logging (logs), and Cloud Trace (tracing).
Why: This integrated suite provides a complete picture of system performance for proactive monitoring and faster troubleshooting.
Proactively manage cloud spending and receive notifications before costs exceed planned amounts.
Configure Cloud Billing budget alerts.
Why: Budgets provide programmatic notifications when spending reaches certain thresholds, preventing cost overruns.
Track and allocate cloud costs to specific teams, projects, or cost centers for chargeback.
Apply Labels to all resources and use Cloud Billing reports to filter and group costs by label.
Why: Labels are the primary mechanism for organizing resources and attributing costs for financial governance.
Reduce costs for predictable, steady-state workloads that run continuously (e.g., a database server).
Purchase 1-year or 3-year Committed Use Discounts (CUDs) for Compute Engine or other services.
Why: CUDs offer significant savings over on-demand pricing in exchange for a commitment to a consistent level of resource usage.
Organize cloud resources to mirror the company’s structure (e.g., departments, environments) and apply policies hierarchically.
Use the Organization > Folders > Projects resource hierarchy.
Why: This structure enables centralized control, as IAM and Organization policies are inherited down the hierarchy, simplifying governance at scale.
Define, deploy, and manage cloud infrastructure in a repeatable, version-controlled, and automated way.
Use an Infrastructure as Code (IaC) tool like Terraform or Cloud Deployment Manager.
Why: IaC reduces manual errors, increases deployment speed, and provides an auditable record of infrastructure changes.
Balance the need for service reliability with the need to innovate and release new features.
Implement Site Reliability Engineering (SRE) principles: define Service Level Objectives (SLOs) and use the resulting Error Budget.
Why: The error budget provides a data-driven framework for deciding when to prioritize reliability work over feature development, protecting user experience.
