IBM Cloud Security Engineer Certification - Fact Sheet¶

Quick Reference¶

Certification: IBM Certified Security Engineer - Cloud v2
Exam Code: C1000-173
Duration: 90 minutes
Questions: 60 multiple choice
Passing Score: 70%
Cost: $200 USD
Language: English
Delivery: Pearson VUE (online or test center)
Prerequisites: None (recommended 2+ years security experience)
Recertification: Every 3 years
Target Audience: Security engineers, cloud security specialists, security architects, compliance engineers

Official Resources¶

Exam Domains¶

1. Identity and Access Management (IAM) (25%)¶

IAM architecture and components
User and service ID management
Access groups and policies
API key management and rotation
Service-to-service authorization
Context-based restrictions
Trusted profiles
Multi-factor authentication (MFA)
Single sign-on (SSO) integration
Access policy design and best practices
Privilege escalation prevention
Identity federation

IAM Resources: - 📖 IAM Overview - 📖 IAM Concepts - 📖 IAM Roles - 📖 IAM Access Policies - 📖 Service IDs - 📖 API Keys - 📖 Access Groups - 📖 Context-Based Restrictions - 📖 Trusted Profiles - 📖 Multi-Factor Authentication - 📖 Service-to-Service Authorization - 📖 IAM Best Practices - 📖 Identity Federation

2. Data Protection and Encryption (20%)¶

Encryption at rest and in transit
Key management strategies
Key Protect service
Hyper Protect Crypto Services (HPCS)
Bring Your Own Key (BYOK)
Keep Your Own Key (KYOK)
Certificate management
Data classification and labeling
Data loss prevention (DLP)
Tokenization and masking
Secure data deletion

Data Protection Resources: - 📖 Data Encryption - 📖 Key Protect - 📖 Key Protect API - 📖 Hyper Protect Crypto Services - 📖 HPCS API - 📖 Bring Your Own Key - 📖 Keep Your Own Key - 📖 Certificate Manager - 📖 Secrets Manager - 📖 Secrets Manager API - 📖 SSL/TLS Certificates - 📖 Data Classification

Network Security Resources: - 📖 VPC Security - 📖 Security Groups - 📖 Security Group Rules - 📖 Network ACLs - 📖 VPN Gateway - 📖 VPN Security - 📖 Direct Link Security - 📖 Transit Gateway - 📖 Virtual Private Endpoints - 📖 Cloud Internet Services - 📖 DDoS Protection - 📖 Web Application Firewall - 📖 Network Segmentation

4. Security Monitoring and Compliance (15%)¶

Security and Compliance Center
Posture management
Compliance profiles and controls
Security event monitoring
Activity Tracker for auditing
Log Analysis for security logs
Threat detection and response
Vulnerability management
Security Information and Event Management (SIEM)
Compliance reporting
Security metrics and KPIs

Monitoring and Compliance Resources: - 📖 Security and Compliance Center - 📖 Compliance Posture Management - 📖 Compliance Profiles - 📖 Custom Profiles - 📖 Activity Tracker - 📖 Activity Tracker Events - 📖 Log Analysis - 📖 Security Monitoring - 📖 Flow Logs - 📖 Compliance Programs - 📖 ISO 27001 - 📖 SOC 2 - 📖 GDPR Compliance - 📖 HIPAA Compliance - 📖 PCI DSS

5. Application and Container Security (10%)¶

Container image security
Vulnerability Advisor
Image signing and verification
Kubernetes security best practices
Pod security policies
Network policies in Kubernetes
Secret management in containers
Security contexts and runtime security
App ID for application authentication
OAuth and OpenID Connect
API security

Application Security Resources: - 📖 Container Security - 📖 Vulnerability Advisor - 📖 Image Signing - 📖 Kubernetes Security - 📖 Pod Security - 📖 Network Policies - 📖 Secrets in Kubernetes - 📖 App ID - 📖 App ID Authentication - 📖 OAuth 2.0 - 📖 OpenID Connect - 📖 API Security

6. Specialized Security Services (10%)¶

Hyper Protect Services (DBaaS, Virtual Servers)
IBM Cloud Security Advisor (deprecated, now SCC)
Cloud Shell security
Satellite security
Watson AI service security
Database security and encryption
Object Storage security
Backup security and encryption

Specialized Services Resources: - 📖 Hyper Protect DBaaS - 📖 Hyper Protect Virtual Servers - 📖 Cloud Shell - 📖 Satellite Security - 📖 Database Encryption - 📖 Object Storage Encryption - 📖 Object Storage Access Control - 📖 Backup Encryption

Core Security Services¶

Identity and Access Services¶

Encryption and Key Management¶

Network Security Services¶

Monitoring and Compliance Services¶

Security Architecture Patterns¶

Zero Trust Architecture¶

Principle: Never trust, always verify

Implementation: - Verify every access request - Use least privilege access - Implement micro-segmentation - Continuous monitoring and validation - Multi-factor authentication - Assume breach mindset

Resources: - 📖 Zero Trust Architecture - 📖 Zero Trust Security

Defense in Depth¶

Layers: 1. Physical security 2. Network security (security groups, ACLs, VPN) 3. Host security (OS hardening, patch management) 4. Application security (secure coding, authentication) 5. Data security (encryption, DLP) 6. User security (IAM, MFA)

Resources: - 📖 Defense in Depth Strategy

Least Privilege Access¶

Implementation: - Grant minimum necessary permissions - Use access groups for role-based access - Regular access reviews - Time-bound access grants - Separate duties

Resources: - 📖 Least Privilege Best Practices

Secure by Design¶

Principles: - Security from the start - Threat modeling - Secure defaults - Privacy by design - Security testing in CI/CD

Resources: - 📖 Secure Application Development

Common Security Scenarios¶

Scenario 1: Securing Multi-Tier Application¶

Challenge: Secure a three-tier web application (web, app, database).

Security Controls: - Network Layer: - VPC with three subnets (web, app, data) - Security groups for each tier - Network ACLs for subnet isolation - Load balancer with SSL/TLS - No public access to app and data tiers

Access Control:
IAM policies with least privilege
Service IDs for app-to-service communication
MFA for administrative access
Context-based restrictions
Data Protection:
Encryption at rest with Key Protect
Encryption in transit (TLS 1.2+)
Certificate Manager for SSL certificates
Secrets Manager for credentials
Monitoring:
Activity Tracker for audit logs
Log Analysis for security logs
Flow logs for network traffic
Security and Compliance Center scans

Resources: - 📖 Multi-Tier Security

Scenario 2: Kubernetes Cluster Security¶

Challenge: Secure a Kubernetes cluster running microservices.

Security Controls: - Cluster Security: - Private cluster endpoint - Pod security policies - Network policies for pod isolation - RBAC for cluster access - Image vulnerability scanning

Image Security:
Private Container Registry
Vulnerability Advisor scanning
Image signing and verification
Base image hardening
Regular image updates
Runtime Security:
Security contexts for pods
Read-only root filesystems
Non-root containers
Resource limits
AppArmor/Seccomp profiles
Secret Management:
Secrets Manager integration
Encrypted secrets at rest
Short-lived credentials
Regular credential rotation

Resources: - 📖 Kubernetes Security Best Practices - 📖 Container Security

Scenario 3: Hybrid Cloud Security¶

Challenge: Secure connectivity between on-premises and IBM Cloud.

Security Controls: - Network Connectivity: - Direct Link with BGP authentication - VPN as backup with IPsec - Transit Gateway for multi-VPC - Private endpoints for services

Access Control:
Federated identity with SAML
Centralized IAM policies
Context-based restrictions
Network-based access control
Data Protection:
End-to-end encryption
KYOK for sensitive workloads
Data residency controls
Cross-site data replication security
Monitoring:
Centralized logging
Unified SIEM
Activity tracking across environments
Network flow monitoring

Resources: - 📖 Hybrid Cloud Security - 📖 Direct Link Security

Scenario 4: Compliance and Governance¶

Challenge: Implement controls for HIPAA compliance.

Security Controls: - Access Control: - MFA for all users - Role-based access control - Access request workflow - Regular access reviews

Data Protection:
Encryption for PHI data
Key management with HPCS
Data classification and labeling
Secure data deletion
Audit and Monitoring:
Activity Tracker for all events
Log retention for 7 years
Security event correlation
Compliance reporting
Network Security:
Network segmentation
Dedicated VPC for HIPAA workloads
VPN for remote access
DDoS protection
Continuous Compliance:
Security and Compliance Center
HIPAA profile scanning
Remediation tracking
Regular audits

Resources: - 📖 HIPAA Compliance - 📖 Compliance Automation

Scenario 5: API Security¶

Challenge: Secure public APIs for partner integration.

Security Controls: - Authentication: - OAuth 2.0 with client credentials - API key management - JWT token validation - App ID for user authentication

Authorization:
Scope-based access control
Rate limiting per client
Quota management
IP whitelisting
API Gateway:
API Connect for management
Request/response validation
Schema enforcement
Input sanitization
Monitoring:
API usage analytics
Anomaly detection
Security event logging
Performance monitoring
Data Protection:
TLS for all endpoints
Response data filtering
PII data masking
Secure credential exchange

Resources: - 📖 API Security - 📖 OAuth 2.0 Implementation

Security Best Practices¶

IAM Best Practices¶

Use Access Groups: Group users with similar roles
Least Privilege: Grant minimum necessary access
Service IDs: Use for application authentication
API Key Rotation: Rotate keys every 90 days
MFA Enforcement: Enable for all users
Context-Based Restrictions: Limit access by network
Regular Audits: Review access quarterly
Separation of Duties: No single user has full control

Resources: - 📖 IAM Best Practices Guide

Encryption Best Practices¶

Encryption at Rest: Enable for all data stores
Encryption in Transit: Use TLS 1.2 or higher
Key Rotation: Rotate keys annually
Key Backup: Backup root keys securely
BYOK/KYOK: Use for sensitive workloads
Certificate Management: Automate certificate renewal
Algorithm Selection: Use AES-256 or equivalent

Resources: - 📖 Encryption Best Practices

Network Security Best Practices¶

Network Segmentation: Isolate workloads by security level
Defense in Depth: Security groups + ACLs
Private Endpoints: Use VPE for services
Bastion Hosts: Control administrative access
Flow Logs: Monitor network traffic
DDoS Protection: Enable with CIS
WAF Rules: Protect web applications
Regular Scanning: Vulnerability assessments

Resources: - 📖 Network Security Best Practices

Container Security Best Practices¶

Minimal Base Images: Use distroless or minimal images
Vulnerability Scanning: Scan before deployment
Image Signing: Verify image integrity
Non-Root Containers: Run as non-privileged user
Read-Only Filesystem: Mount root as read-only
Resource Limits: Set CPU and memory limits
Network Policies: Restrict pod communication
Secret Management: Use Secrets Manager

Resources: - 📖 Container Security Guide

Compliance Best Practices¶

Security Posture: Regular SCC scans
Compliance Profiles: Use predefined profiles
Remediation: Track and fix findings
Evidence Collection: Automate compliance evidence
Audit Logging: Comprehensive Activity Tracker
Log Retention: Meet compliance requirements
Regular Assessments: Quarterly compliance reviews
Documentation: Maintain security documentation

Resources: - 📖 Compliance Best Practices

Security Tools and CLIs¶

IBM Cloud CLI Security Commands¶

# IAM commands
ibmcloud iam users
ibmcloud iam access-groups
ibmcloud iam service-ids
ibmcloud iam api-keys

# Key Protect commands
ibmcloud kp keys
ibmcloud kp key create
ibmcloud kp key rotate

# Container Registry commands
ibmcloud cr images
ibmcloud cr vulnerability-assessment

Resources: - 📖 IBM Cloud CLI - 📖 Key Protect CLI

Security Scanning Tools¶

Exam Tips and Strategies¶

General Preparation¶

Hands-On Practice: Configure security controls in IBM Cloud
Documentation: Focus on security service documentation
IAM Mastery: Deep understanding of IAM concepts
Compliance: Understand compliance frameworks
Security Patterns: Study security architecture patterns

Key Study Areas¶

IAM policies and access control design
Encryption services (Key Protect, HPCS, Secrets Manager)
Network security (security groups, ACLs, VPN)
Container and Kubernetes security
Security monitoring and logging
Compliance automation with SCC
Certificate and key management
App ID and application authentication
DDoS and WAF configuration
Security best practices for all services

Common Pitfalls to Avoid¶

Confusing security groups (stateful) with ACLs (stateless)
Not understanding IAM policy structure
Missing encryption key rotation requirements
Overlooking compliance requirements
Not implementing defense in depth
Ignoring audit logging requirements
Misconfiguring network security rules
Not using service-to-service authorization
Hardcoding credentials instead of using Secrets Manager

Exam Day Tips¶

Read security scenarios carefully
Identify all security requirements (confidentiality, integrity, availability)
Consider defense in depth approach
Look for least privilege principle
Think about compliance implications
Consider monitoring and auditing needs
Evaluate encryption requirements
Think about incident response
Consider cost vs security trade-offs
Review flagged questions

Additional Learning Resources¶

Training and Courses¶

Documentation and Guides¶

Community and Support¶

Compliance Resources¶

Important Exam Topics by Priority¶

High Priority (Study First)¶

IAM policies and access control
Key Protect and encryption at rest
Security groups and network ACLs
Security and Compliance Center
Activity Tracker and audit logging
Container image security
Secrets Manager usage
Certificate management
VPN and network security
Multi-factor authentication

Medium Priority (Study Second)¶

Hyper Protect Crypto Services
App ID authentication
Context-based restrictions
VPC security architecture
Kubernetes security controls
DDoS protection with CIS
WAF configuration
Flow logs and monitoring
Compliance profiles
Virtual Private Endpoints

Lower Priority (If Time Permits)¶

Hyper Protect Virtual Servers
Advanced HPCS features
Satellite security
Advanced compliance automation
SIEM integration details
Advanced network security scenarios

Security Checklists¶

Pre-Deployment Security Checklist¶

Ongoing Security Operations Checklist¶

Final Preparation Checklist¶

Good luck with your IBM Cloud Security Engineer certification exam!

Remember: Security is not a product but a process. Focus on defense in depth, least privilege, and continuous monitoring. Think like an attacker to defend like a professional.