GCP Professional Cloud Security Engineer - Fact Sheet¶

Exam Overview¶

📖 Official Exam Guide - Complete certification overview and requirements

📖 Exam Registration - Register for the certification exam

The Professional Cloud Security Engineer exam assesses your ability to: - Design and implement a secure infrastructure on Google Cloud Platform - Configure access controls and organization policies - Implement data protection and compliance requirements - Monitor and respond to security incidents - Validate regulatory compliance

Exam Details: - Duration: 2 hours - Format: 50-60 multiple choice and multiple select questions - Languages: English, Japanese - Cost: $200 USD - Passing Score: Not disclosed by Google - Validity: 2 years from certification date

Section 1: Configuring Access and Security Controls (28%)¶

1.1 Identity and Access Management (IAM)¶

📖 IAM Overview - Fundamental concepts of Google Cloud IAM

📖 IAM Roles - Understanding predefined, custom, and basic roles

📖 IAM Policies - How to grant, change, and revoke access to resources

📖 IAM Best Practices - Security recommendations for IAM implementation

📖 Service Accounts - Understanding service accounts and their use cases

📖 Service Account Keys - Managing and securing service account keys

📖 Workload Identity - Kubernetes workloads accessing Google Cloud services securely

📖 IAM Conditions - Conditional access controls based on attributes

📖 Custom Roles - Creating and managing custom IAM roles

📖 IAM Recommender - AI-powered IAM policy recommendations

Key IAM Concepts:

Principals: Who can access resources - Google accounts (end users) - Service accounts (applications/services) - Google groups (collections of users) - Google Workspace domains - Cloud Identity domains - allAuthenticatedUsers (any authenticated account) - allUsers (public access)

Roles: Collections of permissions - Basic roles: Owner, Editor, Viewer (not recommended for production) - Predefined roles: Curated by Google for specific services - Custom roles: User-defined granular permissions

Resources: What is being accessed - Organization - Folders - Projects - Individual resources (VMs, buckets, etc.)

IAM Policy Binding: Links principals to roles for specific resources

📖 Policy Inheritance - Understanding resource hierarchy and policy inheritance

📖 IAM Policy Troubleshooter - Debugging access issues

📖 Policy Analyzer - Analyzing which principals have access to resources

1.2 Organization Policy Service¶

📖 Organization Policy Overview - Centralized constraints for resources

📖 Organization Policy Constraints - List of available policy constraints

📖 Custom Organization Policies - Creating custom constraints using CEL

📖 Organization Policy Best Practices - Recommended patterns for policy implementation

Common Organization Policies: - Disable service account key creation - Restrict resource locations - Enforce uniform bucket-level access - Disable VM serial port access - Require OS Login - Restrict protocol forwarding - Disable automatic IAM grants for default service accounts - Restrict public IP address assignment - Define allowed external IPs - Disable VPC external IPv6 usage

📖 Resource Hierarchy - Organization, folders, projects structure

📖 Organization Policy Inheritance - How policies inherit and override

1.3 Access Context Manager & VPC Service Controls¶

📖 Access Context Manager Overview - Context-aware access to Google Cloud resources

📖 Access Levels - Defining conditions for access

📖 VPC Service Controls - Mitigating data exfiltration risks

📖 Service Perimeters - Creating security perimeters around Google Cloud resources

📖 VPC-SC Supported Services - Services that support VPC Service Controls

📖 Access Policy - Organization-level access policy configuration

📖 Ingress and Egress Rules - Controlling data flow across perimeter boundaries

📖 VPC-SC Troubleshooting - Debugging perimeter violations

VPC Service Controls Key Concepts:

Perimeter Types: - Regular perimeters: Standard security boundaries - Bridge perimeters: Allow communication between regular perimeters - Dry-run mode: Test policies without enforcement

Access Levels Attributes: - IP address/subnet - Device policy - User identity - Geographic location - Access level combinations (AND/OR/NOT)

📖 Private Google Access - Accessing Google APIs from internal IPs

📖 Private Service Connect - Private connectivity to Google and third-party services

1.4 Cloud Identity¶

📖 Cloud Identity Overview - Identity as a Service (IDaaS) platform

📖 Cloud Identity Free vs Premium - Feature comparison between editions

📖 User Lifecycle Management - Managing user accounts

📖 Group Management - Creating and managing security groups

📖 Security Settings - Configuring identity security features

📖 2-Step Verification - Enforcing two-factor authentication

📖 Single Sign-On (SSO) - Implementing SAML-based SSO

📖 Context-Aware Access - Granular access controls based on context

Section 2: Configuring Network Security (18%)¶

2.1 VPC Network Architecture¶

📖 VPC Networks Overview - Virtual Private Cloud fundamentals

📖 Firewall Rules - Configuring VPC firewall rules

📖 Firewall Rules Logging - Enabling and using firewall logs

📖 Hierarchical Firewall Policies - Organization and folder-level firewall rules

📖 Firewall Insights - Analyzing and optimizing firewall rules

📖 VPC Network Peering - Connecting VPC networks

📖 Shared VPC - Centralized network administration

📖 VPC Flow Logs - Network telemetry and troubleshooting

Firewall Rule Components: - Direction: Ingress or Egress - Priority: 0-65535 (lower numbers have higher priority) - Action: Allow or Deny - Target: All instances, specific tags, or service accounts - Source/Destination: IP ranges, tags, or service accounts - Protocol and ports: TCP, UDP, ICMP, etc.

📖 Implied Firewall Rules - Default allow egress and deny ingress rules

2.2 Load Balancing Security¶

📖 Load Balancing Overview - Google Cloud load balancing options

📖 Cloud Armor - DDoS protection and WAF capabilities

📖 Cloud Armor Security Policies - Creating and managing security policies

📖 Cloud Armor Preconfigured WAF Rules - OWASP Top 10 protection

📖 Cloud Armor Rate Limiting - Protecting against volumetric attacks

📖 Cloud Armor Adaptive Protection - ML-based DDoS detection

📖 SSL Policies - Configuring minimum TLS version and cipher suites

📖 SSL Certificates - Managing certificates for load balancers

📖 Google-managed SSL Certificates - Automatic certificate provisioning and renewal

2.3 Cloud DNS Security¶

📖 Cloud DNS Overview - Managed DNS service

📖 Cloud DNS Security - DNS security best practices

📖 DNSSEC - Protecting against DNS spoofing attacks

📖 DNS Logging - Monitoring and logging DNS queries

📖 Private DNS Zones - Internal DNS resolution

2.4 Network Connectivity Security¶

📖 Cloud VPN - IPsec VPN connectivity to Google Cloud

📖 Cloud Interconnect - Dedicated physical connections

📖 Cloud NAT - Managed network address translation

📖 Cloud NAT Logging - Monitoring NAT gateway connections

📖 Cloud Router - Dynamic routing with BGP

Section 3: Ensuring Data Protection (20%)¶

3.1 Cloud Key Management Service (Cloud KMS)¶

📖 Cloud KMS Overview - Cryptographic key management service

📖 Encryption at Rest - Google's default encryption implementation

📖 Customer-Managed Encryption Keys (CMEK) - Using your own encryption keys

📖 Key Rings and Keys - Organizing cryptographic keys

📖 Key Versions - Managing multiple versions of keys

📖 Key Rotation - Automatic and manual key rotation strategies

📖 Symmetric vs Asymmetric Keys - Understanding key types and algorithms

📖 External Key Manager (EKM) - Using keys stored in external key management systems

📖 Cloud HSM - FIPS 140-2 Level 3 certified hardware security modules

📖 Key Access Justifications - Transparency into Google's access to your keys

Cloud KMS Key Protection Levels: - Software: Keys stored in software - HSM: Keys stored in FIPS 140-2 Level 3 HSM - External: Keys stored in external key management partner system

📖 Envelope Encryption - How Google Cloud implements encryption

📖 IAM Permissions for Cloud KMS - Controlling access to keys

📖 Crypto Key IAM Roles - Understanding CryptoKey roles

3.2 Data Loss Prevention (DLP)¶

📖 Cloud DLP Overview - Discovering and protecting sensitive data

📖 InfoTypes - Built-in detectors for sensitive data

📖 Custom InfoTypes - Creating custom detection patterns

📖 Inspection - Scanning content for sensitive data

📖 De-identification - Masking or redacting sensitive data

📖 Re-identification - Reversing de-identification transformations

📖 DLP Templates - Reusable inspection and de-identification configurations

📖 DLP Job Triggers - Automated scanning of data sources

De-identification Techniques: - Masking: Replacing characters with asterisks or other characters - Redaction: Removing sensitive values entirely - Replacement: Substituting with surrogate values - Tokenization: Replacing with tokens that can be mapped back - Bucketing: Generalizing values into ranges - Date shifting: Shifting dates by random amounts - Crypto-based tokenization: Using cryptographic keys

📖 DLP Findings - Understanding inspection results

📖 DLP Best Practices - Optimal configuration and usage patterns

3.3 Cloud Storage Security¶

📖 Cloud Storage Overview - Object storage service fundamentals

📖 Cloud Storage IAM - Bucket and object-level permissions

📖 Uniform Bucket-Level Access - Simplified access control model

📖 Access Control Lists (ACLs) - Fine-grained object access control

📖 Signed URLs - Time-limited access to objects

📖 Signed Policy Documents - Controlling upload parameters

📖 Bucket Lock - Immutable retention policies

📖 Object Versioning - Protecting against accidental deletion

📖 Lifecycle Management - Automated object retention and deletion

📖 Cloud Storage Audit Logs - Tracking bucket and object access

📖 Requester Pays - Charging access costs to requesters

📖 Public Access Prevention - Preventing public exposure of buckets

3.4 Data Encryption¶

📖 Encryption in Transit - Protecting data as it moves

📖 Encryption at Rest - Default encryption for stored data

📖 Application-Layer Encryption - Encrypting data before storage

📖 Client-Side Encryption - Customer-supplied encryption keys

📖 Secret Manager - Storing API keys, passwords, certificates

📖 Secret Manager Best Practices - Secure secret management patterns

📖 Secret Versions - Managing multiple secret versions

3.5 Database Security¶

📖 Cloud SQL Security - Securing managed relational databases

📖 Cloud SQL IAM Authentication - Passwordless database authentication

📖 Cloud SQL SSL/TLS - Encrypting database connections

📖 Cloud SQL Proxy - Secure access without whitelisting IPs

📖 Cloud Spanner Security - Distributed database security

📖 BigQuery Security - Data warehouse security controls

📖 BigQuery Column-Level Security - Fine-grained access to columns

📖 BigQuery Row-Level Security - Filtering rows based on user identity

📖 Authorized Views - Sharing query results without underlying data access

Section 4: Managing Security Operations (22%)¶

4.1 Security Command Center¶

📖 Security Command Center Overview - Centralized security and risk management

📖 SCC Standard vs Premium - Feature comparison between tiers

📖 SCC Findings - Understanding and managing security findings

📖 SCC Sources - Built-in and custom security sources

📖 Asset Discovery - Inventory of cloud resources

📖 Security Health Analytics - Automated vulnerability detection

📖 Web Security Scanner - Scanning App Engine, GKE, and Compute Engine web apps

📖 Event Threat Detection - Identifying threats in Cloud Logging

📖 Container Threat Detection - Runtime threat detection for GKE

📖 Virtual Machine Threat Detection - Detecting malicious activity on VMs

📖 SCC Notifications - Automating response to findings

📖 SCC Export to BigQuery - Analyzing findings at scale

📖 SCC SIEM Integration - Connecting to third-party SIEM tools

4.2 Cloud Logging and Monitoring¶

📖 Cloud Logging Overview - Centralized logging service

📖 Cloud Audit Logs - Who did what, where, and when

📖 Admin Activity Logs - Administrative actions tracking

📖 Data Access Logs - Data read and write operations

📖 System Event Logs - Google Cloud administrative actions

📖 Policy Denied Logs - Security policy violations

📖 Log Retention - Default and custom retention periods

📖 Log Sinks - Routing logs to external destinations

📖 Log Buckets - Organizing and storing logs

📖 Log-Based Metrics - Creating metrics from log data

📖 Cloud Monitoring - Infrastructure and application monitoring

📖 Alerting Policies - Automated incident notifications

📖 Uptime Checks - Monitoring service availability

4.3 Incident Response¶

📖 Incident Response Guide - Best practices for incident handling

📖 Chronicle Security Operations - Cloud-native SIEM solution

📖 Forensic Analysis - Investigating security incidents

📖 Disk Snapshots for Forensics - Preserving evidence

📖 Memory Forensics - Analyzing compromised instances

📖 Compromised Instance Response - Steps to isolate and investigate

4.4 Vulnerability Management¶

📖 Binary Authorization - Deploy-time security controls for containers

📖 Binary Authorization Policies - Enforcing attestation requirements

📖 Container Analysis - Metadata storage for container images

📖 Vulnerability Scanning - Automated container vulnerability detection

📖 Attestations - Cryptographic verification of build process

📖 Artifact Registry Security - Securing container and package repositories

📖 OS Patch Management - Automated patching for VM instances

📖 OS Config - Managing operating system configurations

📖 Shielded VMs - Protecting against rootkits and bootkits

📖 Confidential VMs - Memory encryption for sensitive workloads

Section 5: Supporting Compliance Requirements (12%)¶

5.1 Compliance and Certifications¶

📖 Compliance Resource Center - Overview of Google Cloud certifications

📖 ISO/IEC 27001 - Information security management certification

📖 SOC 2/SOC 3 - Service organization controls reports

📖 PCI DSS - Payment card industry compliance

📖 HIPAA - Healthcare data protection requirements

📖 FedRAMP - US federal government cloud security

📖 GDPR - European data protection regulation

📖 CCPA - California consumer privacy act

📖 Compliance Reports Manager - Accessing compliance documentation

5.2 Assured Workloads¶

📖 Assured Workloads Overview - Compliance-focused environments

📖 Assured Workloads Compliance Regimes - Supported regulatory frameworks

📖 Sovereign Controls - Data residency and access controls

📖 Workload Monitoring - Tracking compliance violations

5.3 Data Residency and Sovereignty¶

📖 Data Residency - Controlling where data is stored

📖 Resource Locations - Available regions and zones

📖 Organization Policy Resource Locations - Restricting resource deployment locations

📖 Data Localization - Meeting geographic data requirements

5.4 Transparency and Control¶

📖 Access Transparency - Visibility into Google admin access

📖 Access Approval - Explicit approval for Google support access

📖 VPC Service Controls Audit Logs - Monitoring perimeter violations

📖 Data Processing Addendum - GDPR data processing terms

Additional Security Services and Tools¶

Container and Kubernetes Security¶

📖 GKE Security Overview - Kubernetes security architecture

📖 GKE Hardening Guide - Security best practices for GKE

📖 GKE Workload Identity - Pod-level service account authentication

📖 Network Policies - Pod-to-pod communication controls

📖 Pod Security Standards - Enforcing pod security configurations

📖 GKE Security Posture - Automated security posture management

📖 GKE Binary Authorization - Enforcing trusted container deployment

Security Scanning and Assessment¶

📖 Web Security Scanner - Application vulnerability scanning

📖 On-Demand Scanning - Scanning arbitrary container images

📖 Continuous Validation - Ongoing security posture assessment

📖 Risk Manager - Prioritizing security findings

Legacy Tools (For Reference)¶

📖 Forseti Security - Open-source security toolkit (now deprecated)

Note: Forseti Security has been deprecated in favor of Security Command Center and native Google Cloud security services. While it may still appear in legacy documentation, focus on Security Command Center for exam preparation.

Forseti Components (Historical Knowledge): - Inventory: Asset discovery and snapshot - Scanner: Policy violation detection - Enforcer: Automatic remediation - Explain: IAM policy analysis - Notifier: Alert distribution

Modern alternatives: - SCC Asset Discovery replaces Forseti Inventory - Security Health Analytics replaces Forseti Scanner - Policy Intelligence replaces Forseti Explain - SCC Notifications replaces Forseti Notifier

Key Security Principles and Best Practices¶

Defense in Depth¶

Implement multiple layers of security controls:

1. Perimeter Security: Firewall rules, Cloud Armor, VPC Service Controls
2. Identity Security: IAM, Cloud Identity, Context-Aware Access
3. Data Security: Encryption, DLP, access controls
4. Application Security: Binary Authorization, vulnerability scanning
5. Monitoring: Cloud Logging, Security Command Center, alerting

Principle of Least Privilege¶

📖 Least Privilege IAM - Granting minimal necessary permissions

Best Practices: - Use predefined roles over basic roles - Create custom roles for specific needs - Grant roles at the lowest resource level possible - Use service accounts for applications - Regularly review and revoke unnecessary permissions - Use IAM Recommender to identify over-privileged accounts - Implement temporary elevated access with IAM conditions

Separation of Duties¶

📖 Separation of Duties - Preventing conflicts of interest

Implementation Strategies: - Different teams manage network, security, and applications - Multiple approvers for critical changes - No single person has full administrative access - Use separate projects for development, staging, production - Implement change approval workflows

Zero Trust Security¶

📖 BeyondCorp Enterprise - Zero trust access platform

📖 Zero Trust Architecture - Implementation guide

Zero Trust Principles: - Never trust, always verify - Assume breach - Verify explicitly - Use least privilege access - Segment access - Monitor and log everything

Security by Default¶

• Default encryption at rest and in transit
• Disable unnecessary services and APIs
• Use secure defaults for configurations
• Enable audit logging by default
• Implement organization policies early

Shared Responsibility Model¶

📖 Shared Responsibility - Understanding security ownership

Google's Responsibilities: - Physical security of data centers - Hardware and infrastructure - Network infrastructure - Hypervisor and host OS

Customer's Responsibilities: - IAM and access controls - Data encryption keys (CMEK) - Application security - Network configuration - Data classification and protection - Compliance with regulations

Common Security Scenarios and Solutions¶

Scenario 1: Preventing Data Exfiltration¶

Solution Components: - VPC Service Controls perimeters around sensitive projects - Organization policy to restrict external IPs - Cloud Armor to block malicious traffic - DLP to scan for sensitive data leaving organization - VPC Flow Logs to monitor network traffic - Security Command Center to detect anomalies

Scenario 2: Securing Multi-Tenant Application¶

Solution Components: - Separate projects per customer (strongest isolation) - VPC Service Controls to prevent cross-tenant access - IAM conditions for context-aware access - Row-level security in BigQuery for data isolation - Separate encryption keys per tenant (CMEK) - Audit logs to track all access

Scenario 3: Meeting Compliance Requirements¶

Solution Components: - Assured Workloads for compliance frameworks - Organization policies to enforce constraints - Access Transparency for visibility into Google access - Access Approval for explicit approval requirements - Resource location restrictions - Compliance Reports Manager for certifications - Regular security posture assessments

Scenario 4: Container Security Pipeline¶

Solution Components: - Artifact Registry for container storage - Vulnerability Scanning for image analysis - Binary Authorization to enforce attestations - Build attestations in CI/CD pipeline - Pod Security Standards for runtime controls - GKE Security Posture monitoring - Network policies for pod isolation

Scenario 5: Incident Response¶

Solution Components: - Security Command Center for detection - Cloud Logging for audit trails - Log sinks to long-term storage and SIEM - Alerting policies for anomalies - Disk snapshots for forensics - Isolation through firewall rules - Compromised credential revocation

Scenario 6: Secure Hybrid Architecture¶

Solution Components: - Cloud VPN or Interconnect for connectivity - Private Google Access for API access - Cloud NAT for outbound connectivity - Shared VPC for centralized networking - Organization policies applied organization-wide - Hierarchical firewall policies - VPC Service Controls spanning on-premises

Exam Preparation Tips¶

Key Topics to Master¶

1. IAM Deep Dive: Roles, policies, service accounts, conditions, best practices
2. VPC Service Controls: Perimeters, access levels, ingress/egress rules
3. Cloud KMS: CMEK, key rotation, HSM, envelope encryption
4. Security Command Center: All detection capabilities, findings, notifications
5. Organization Policies: Common constraints, inheritance model
6. Network Security: Firewall rules, Cloud Armor, load balancer security
7. Data Protection: DLP, encryption options, Secret Manager
8. Compliance: Major frameworks (HIPAA, PCI DSS, GDPR), Assured Workloads
9. Container Security: Binary Authorization, GKE hardening, Workload Identity
10. Monitoring and Logging: Audit logs, log exports, alerting

Hands-On Practice¶

Set up free tier or trial account and practice: - Creating IAM policies with conditions - Configuring VPC Service Controls perimeters - Setting up Cloud KMS keys and encryption - Deploying Binary Authorization policies - Configuring Cloud Armor rules - Creating organization policies - Analyzing Security Command Center findings - Setting up DLP inspection jobs - Implementing secure GKE clusters - Configuring audit log sinks

Common Exam Patterns¶

• Scenario-based questions requiring multiple services
• Identifying most secure solution among options
• Troubleshooting security misconfigurations
• Selecting appropriate encryption strategy
• Determining compliance requirements
• Optimizing security posture
• Incident response procedures

Time Management¶

• 2 hours for 50-60 questions = ~2 minutes per question
• Read questions carefully for keywords
• Eliminate obviously wrong answers
• Flag uncertain questions for review
• Don't spend more than 3-4 minutes on any question

Study Resources¶

• Official Google Cloud documentation (most important)
• Google Cloud Skills Boost (formerly Qwiklabs)
• Sample questions from Google
• Coursera Security specialization
• YouTube Google Cloud Tech channel
• Practice exams
• Community study groups

Important Command-Line Tools¶

gcloud CLI Security Commands¶

# IAM policy management
gcloud projects get-iam-policy PROJECT_ID
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=user:email@example.com --role=roles/viewer

# Service accounts
gcloud iam service-accounts create SA_NAME
gcloud iam service-accounts keys create key.json \
  --iam-account=SA_EMAIL

# Organization policies
gcloud resource-manager org-policies describe CONSTRAINT \
  --project=PROJECT_ID
gcloud resource-manager org-policies set-policy policy.yaml \
  --project=PROJECT_ID

# KMS operations
gcloud kms keys create KEY_NAME --keyring=KEYRING \
  --location=LOCATION --purpose=encryption
gcloud kms encrypt --key=KEY --keyring=KEYRING \
  --location=LOCATION --plaintext-file=file.txt \
  --ciphertext-file=file.enc

# Binary Authorization
gcloud container binauthz policy export
gcloud container binauthz attestations create

# Security Command Center
gcloud scc findings list ORGANIZATION_ID
gcloud scc assets list ORGANIZATION_ID

# VPC firewall rules
gcloud compute firewall-rules create RULE_NAME \
  --allow=tcp:80,tcp:443 --source-ranges=0.0.0.0/0
gcloud compute firewall-rules list

Quick Reference Tables¶

IAM Role Hierarchy¶

Encryption Options Comparison¶

Cloud Armor Rules Priority¶

Audit Log Types¶

Summary¶

This fact sheet covers the essential topics for the Google Cloud Professional Cloud Security Engineer certification exam:

Core Security Services: - Identity and Access Management (IAM) - VPC Service Controls and Access Context Manager - Cloud Key Management Service (KMS) - Data Loss Prevention (DLP) - Security Command Center - Binary Authorization - Cloud Armor

Key Competencies: - Designing secure infrastructure - Implementing defense-in-depth strategies - Configuring network security controls - Protecting sensitive data - Managing security operations - Ensuring compliance with regulations - Responding to security incidents - Assessing and mitigating vulnerabilities

Exam Success Factors: - Deep understanding of IAM and organization policies - Hands-on experience with security services - Knowledge of compliance frameworks - Ability to design secure architectures - Understanding shared responsibility model - Familiarity with security best practices - Strong troubleshooting skills

Next Steps: 1. Review official Google Cloud documentation thoroughly 2. Complete hands-on labs for each security service 3. Take practice exams to identify knowledge gaps 4. Join study groups or forums for peer learning 5. Schedule exam when consistently scoring 80%+ on practice tests

Good luck with your certification journey!