Many of the questions people miss on Cloud Digital Leader are not about unknown concepts but about picking the wrong one of two similar services. There are three relational databases, four compute options, and three security operations products, and in 2026 even frequently tested products such as Vertex AI, Dataproc, and Looker Studio changed their names. When two answer choices come as a pair, like Cloud SQL and Spanner, knowing each definition is not enough; you need to be able to state in one sentence what separates them.
This post is the review installment of our CDL study series. From the services explained separately in the domain posts, it picks only the groups that often appear together as each other's wrong answers and reorganizes them by the criteria that tell them apart and the clue phrases that show up in questions. At the end, it also collects the products that have been renamed.
---
Three Questions That Separate Similar Services
When you run into two similar services, asking the following three questions in order settles most cases.
| Question | What it separates | Example | |------|------|------| | What does it handle? | The subject (objects, relational data, events, code, traffic, risk) | Cloud Storage handles files; Cloud SQL handles transactional data in tables | | Who manages it? | The management scope (you vs. Google) | With Compute Engine you manage down to the OS; with Cloud Run, Google manages the servers | | How big, how fast? | Scale and timing (regional vs. global, batch vs. real time) | Spanner is global scale; Pub/Sub and Dataflow are real time |
---
Domains 1 and 2: Confusing Pairs in Networking and Data
Hybrid vs. Multicloud vs. Private Cloud
| Aspect | Hybrid cloud | Multicloud | Private cloud | |------|------|------|------| | Meaning | On-premises and public cloud together | Two or more public clouds together | A cloud environment used by one organization only | | Clues in the question | "Together with our existing data center" | "AWS and Google Cloud together" | "Our own dedicated infrastructure" |
Cloud VPN vs. Dedicated Interconnect vs. Partner Interconnect
| Aspect | Cloud VPN | Dedicated Interconnect | Partner Interconnect | |------|------|------|------| | Path | Encrypted tunnel over the public internet | Direct physical connection | Through a service provider | | Bandwidth | About 1–3 Gbps per tunnel | 10, 100, or 400 Gbps circuits | 50 Mbps to 50 Gbps | | Clues in the question | "Quickly and cheaply" | "High volume, without crossing the internet" | "Cannot connect directly at a colocation facility" |
Cloud SQL vs. AlloyDB vs. Spanner
| Aspect | Cloud SQL | AlloyDB | Spanner | |------|------|------|------| | Core | Managed MySQL, PostgreSQL, SQL Server | High-performance PostgreSQL compatible, transactions and analytics together | Globally distributed, horizontal scaling | | Clues in the question | "Keep our existing MySQL as is" | "PostgreSQL compatible but faster" | "Users worldwide, strong consistency, 99.999%" |
Bigtable vs. Firestore vs. BigQuery
| Aspect | Bigtable | Firestore | BigQuery | |------|------|------|------| | Type | Wide-column NoSQL | Document NoSQL | Serverless data warehouse | | Clues in the question | "IoT and time series, millions per second" | "Mobile app, real-time sync" | "Large-scale analysis with SQL" |
Pub/Sub vs. Dataflow vs. Managed Service for Apache Spark
| Aspect | Pub/Sub | Dataflow | Managed Service for Apache Spark | |------|------|------|------| | Role | Receives and delivers events | Stream and batch processing | Spark and Hadoop processing (formerly Dataproc) | | Clues in the question | "Collect events from thousands of devices" | "One codebase for streams and batches" | "Keep our existing Spark jobs as is" |
Looker vs. Data Studio, Autoclass vs. Lifecycle Management
| Aspect | Looker | Data Studio | Autoclass | Lifecycle management | |------|------|------|------|------| | Core | Enterprise BI with consistent metrics through a semantic layer | Free visualization and reports (formerly Looker Studio) | Changes classes automatically by access pattern | Changes class or deletes by a set rule (such as age) |
Related posts: Networking Fundamentals and Google's Global Network, Choosing Databases and Storage, and Migrating, Real-Time Analytics and Looker
---
Domain 3: Confusing Pairs in AI
Pre-trained APIs vs. AutoML vs. BigQuery ML vs. Custom Training
| Aspect | Pre-trained APIs | AutoML | BigQuery ML | Custom training | |------|------|------|------|------| | Expertise needed | Almost none | Low (minimal code) | SQL | High (ML engineers) | | Trains on your own data | No | Yes | Yes | Yes | | Clues in the question | "Translate or transcribe right away" | "With our data, without code" | "Analysts in SQL" | "A unique model that is a core competitive edge" |
Generative AI vs. Agentic AI, Agent Platform vs. Gemini Enterprise
| Aspect | Generative AI | Agentic AI | Gemini Enterprise Agent Platform | Gemini Enterprise | |------|------|------|------|------| | Core | Creates new content | Takes a goal, plans, and uses tools to finish the work | A platform where developers build and run models and agents (formerly Vertex AI) | An AI agent app employees use right away |
Related posts: Agentic AI and Gemini Enterprise Agent Platform, AI/ML Innovation Services
---
Domain 4: Confusing Pairs in Infrastructure
Compute Engine vs. GKE vs. Cloud Run vs. Cloud Run Functions
The four are easiest to remember when you line them up in order of how much less you have to manage.
!A spectrum of four compute options in which Google manages more as you move from Compute Engine to Cloud Run functions
| Aspect | Compute Engine | GKE | Cloud Run | Cloud Run functions | |------|------|------|------|------| | Clues in the question | "Control down to the OS," "move existing servers as is" | "Orchestrate many containers" | "Containers without managing servers, scale to zero" | "Run code when a file is uploaded" |
Migration Terms: Retire, Retain, Rehost, Replatform, Refactor, Reimagine
| Term | Meaning | |------|------| | Retire | Shut down applications that are no longer needed | | Retain | Leave them on-premises for now | | Rehost (lift and shift) | Move to VMs as is, without changing code | | Replatform (move and improve) | Change a few parts to use managed services (for example, moving the database to Cloud SQL) | | Refactor | Rework the code substantially to be cloud native (for example, microservices) | | Reimagine | Redesign the business process itself around the cloud and AI |
Spot VMs vs. Committed Use Discounts vs. Sustained Use Discounts
| Aspect | Spot VMs | Committed use discounts (CUDs) | Sustained use discounts (SUDs) | |------|------|------|------| | Condition | Spare capacity that can be reclaimed at any time | Commit to one or three years of usage | Applied automatically when you run resources for much of the month | | Clues in the question | "Batch jobs that can be interrupted" | "Steady usage, long-term commitment" | "Automatic discount with no sign-up" |
Related posts: Infrastructure Modernization Services
---
Domain 5: Confusing Pairs in Security
Security Command Center vs. Google Security Operations vs. Google Threat Intelligence
| Aspect | Security Command Center | Google Security Operations | Google Threat Intelligence | |------|------|------|------| | Core | Finds misconfigurations, vulnerabilities, and threats in Google Cloud | Collects logs across the organization to detect, investigate, and respond | Proactive information about attackers and threats | | Clues in the question | "Public bucket," "security posture" | "SIEM and SOAR," "automated playbook response" | "Mandiant," "VirusTotal" |
Cloud Armor vs. VPC Firewall Rules vs. IAP
| Aspect | Cloud Armor | VPC firewall rules | Identity-Aware Proxy | |------|------|------|------| | Core | Blocks DDoS and web attacks in front of the load balancer | Allows or denies traffic by IP and port | Controls app access by user identity and context | | Clues in the question | "DDoS," "SQL injection" | "Allow only certain ports" | "Remote workers connect without a VPN" |
Model Armor vs. Sensitive Data Protection, Transparency Reports vs. Access Transparency
| Aspect | Model Armor | Sensitive Data Protection | Transparency reports | Access Transparency | |------|------|------|------|------| | Core | Screens LLM prompts and responses | Finds and de-identifies sensitive information in data | Publish how government data requests are handled | Records of Google personnel accessing customer data |
Related posts: Security Operations and AI Security, Security Concepts and Product Map
---
Domain 6: Confusing Pairs in Operations
Quotas vs. Budgets, Replication vs. Backups
| Aspect | Quotas | Budgets | Replication | Backups | |------|------|------|------|------| | Core | Requests fail beyond the limit | Alerts at thresholds (alerts-only budgets do not stop usage) | Real-time copy, protects against outages | Point-in-time copy, protects against mistakes and ransomware |
Cloud Monitoring vs. Logging vs. Trace vs. Profiler vs. Error Reporting
| Tool | Question it answers | |------|------| | Cloud Monitoring | Is it healthy right now? (metrics, dashboards, alerts) | | Cloud Logging | What happened? (logs) | | Cloud Trace | Where did it slow down? (latency along the request path) | | Cloud Profiler | Which code uses the most resources? | | Error Reporting | Which errors are new? |