Google Cloud Professional Cloud Security Engineer Exam Prep

What's inside

1. Level 1: Exam Orientation and Scenario Question CraftFree
   [Orientation – exam craft] Covers how the course maps to the five weighted sections of Google's Professional Cloud Security Engineer exam guide. The guide is Google's own document, is not reproduced here, and is free on Google's certification page. Check Google's exam page for length, price and languages. This course is independent of Google and not endorsed by it, and no pass is promised. The level also shows how to break down scenario 'best answer' and product-contrast questions.
2. Level 2: Cloud Identity and the Super Administrator AccountFree
   [Section 1: Configuring access] 1.1 Managing Cloud Identity: what Cloud Identity provides to Google Cloud, how it links to the organization resource, and how to manage and protect a super administrator account.
3. Level 3: Google Cloud Directory Sync
   [Section 1: Configuring access] 1.1 Managing Cloud Identity: setting up Google Cloud Directory Sync (GCDS) to provision users and groups one way from Active Directory or LDAP into Cloud Identity.
4. Level 4: SSO with a Third-Party IdP: SAML and OAuth
   [Section 1: Configuring access] 1.1 and 1.3: setting up single sign-on (SSO) with a third-party identity provider using Security Assertion Markup Language (SAML), and controlling OAuth access to Google Cloud and third-party apps.
5. Level 5: Automating User Lifecycle and Programmatic Admin
   [Section 1: Configuring access] 1.1 Managing Cloud Identity: automating the user lifecycle process (joiner, mover, leaver) and administering user accounts and groups programmatically.
6. Level 6: Workforce Identity Federation
   [Section 1: Configuring access] 1.1 Managing Cloud Identity: setting up Workforce Identity Federation so that employees and partners from an external IdP can use Google Cloud without being synced into Cloud Identity.
7. Level 7: Password, Session and 2-Step Verification Policy
   [Section 1: Configuring access] 1.3 Managing authentication: creating password and session management policies for user accounts, and setting up and enforcing 2-step verification.
8. Level 8: Service Accounts: Use Cases and Lifecycle
   [Section 1: Configuring access] 1.2 Managing service accounts: identifying scenarios that need service accounts, creating, disabling and authorizing them, and securing default service accounts.
9. Level 9: Securing and Auditing Service Account Keys
   [Section 1: Configuring access] 1.2 Managing service accounts: securing, auditing and reducing the use of service account keys.
10. Level 10: Short-Lived Credentials and Impersonation
    [Section 1: Configuring access] 1.2 Managing service accounts: creating and managing short-lived credentials, and managing service account impersonation.
11. Level 11: Workload Identity Federation
    [Section 1: Configuring access] 1.2 Managing service accounts: setting up Workload Identity Federation so that workloads on AWS, Azure, GitHub Actions or other OIDC/SAML sources can access Google Cloud without service account keys.
12. Level 12: IAM Roles, Groups, Separation of Duties and ACLs
    [Section 1: Configuring access] 1.4 Managing and implementing authorization controls: managing privileged roles and separation of duties with IAM roles and permissions, managing permissions through groups, and managing IAM versus access control list (ACL) permissions.
13. Level 13: IAM Conditions and IAM Deny Policies
    [Section 1: Configuring access] 1.4 Managing and implementing authorization controls: granting permissions to different types of identities using IAM conditions and IAM deny policies.
14. Level 14: Access Context Manager
    [Section 1: Configuring access] 1.4 Managing and implementing authorization controls: setting up Access Context Manager access levels for context-aware access based on IP, device and identity attributes.
15. Level 15: Policy Intelligence and Privileged Access Manager
    [Section 1: Configuring access] 1.4 Managing and implementing authorization controls: applying Policy Intelligence tools, and identifying use cases for and setting up Privileged Access Manager for just-in-time privileged access.
16. Level 16: Resource Hierarchy and Organization Policies
    [Section 1: Configuring access] 1.5 Defining the resource hierarchy: managing folders and projects at scale, using inheritance for access control, and managing pre-built and custom organization policies at organization, folder and project level.
17. Level 17: Cloud NGFW Rules and Firewall Policies
    [Section 2: Securing communications and establishing boundary protection] 2.1 Designing and configuring perimeter security: setting up Cloud Next Generation Firewall (Cloud NGFW) VPC firewall rules, hierarchical firewall policies, and global and regional network firewall policies.
18. Level 18: Layer 7 Inspection and Certificate Authority Service
    [Section 2: Securing communications and establishing boundary protection] 2.1 Designing and configuring perimeter security: setting up application layer (layer 7) inspection on Cloud NGFW Enterprise, and using Certificate Authority Service for TLS inspection and private certificates.
19. Level 19: Identity-Aware Proxy
    [Section 2: Securing communications and establishing boundary protection] 2.1 Designing and configuring perimeter security: using Identity-Aware Proxy (IAP) as a perimeter control for web applications and for TCP forwarding to VMs without external IPs.
20. Level 20: Load Balancer Security as a Perimeter Control
    [Section 2: Securing communications and establishing boundary protection] 2.1 Designing and configuring perimeter security: using Google Cloud load balancers as perimeter controls, including TLS termination, SSL policies and certificate management.
21. Level 21: Google Cloud Armor as a web application firewall
    [Section 2: Securing communications and establishing boundary protection] Serves 2.1 'Configuring web application firewalls (e.g., Google Cloud Armor)': you attach Cloud Armor security policies to external Application Load Balancer backends and build rules from preconfigured WAF rules, rate limiting, IP and geo allowlists and denylists, and preview mode, then weigh false positives against the protection each rule gives.
22. Level 22: Secure Web Proxy for controlled egress
    [Section 2: Securing communications and establishing boundary protection] Serves 2.1 'Deploying Secure Web Proxy': you deploy Secure Web Proxy so workloads reach the web only through an explicit proxy with identity-aware and URL-based policies and optional TLS inspection, and compare it with Cloud NAT and firewall egress rules.
23. Level 23: Cloud DNS security and restricting configured APIs
    [Section 2: Securing communications and establishing boundary protection] Serves 2.1 'Configuring Cloud DNS security settings' and 'Continually monitoring and restricting configured APIs': you secure DNS with DNSSEC, private zones, DNS policies, DNS logging and DNS Armor threat detection, then restrict which Google APIs projects can enable and use.
24. Level 24: VPC, VPC peering and Shared VPC security properties
    [Section 2: Securing communications and establishing boundary protection] Serves 2.2 'Configuring security properties of a VPC network, VPC peering, Shared VPC, and firewall rules': you compare custom-mode and auto-mode VPCs, what peering does and does not share (no transitive peering, firewall rules not exchanged), and the separation of duties Shared VPC creates between host and service projects.
25. Level 25: Network isolation for N-tier applications
    [Section 2: Securing communications and establishing boundary protection] Serves 2.2 'Configuring network isolation and data encapsulation for N-tier applications': you split web, application and data tiers into separate subnets, use secure tags or service accounts in firewall policies so only the next tier can talk to the one below it, and encrypt traffic between tiers.
26. Level 26: VPC Service Controls perimeters
    [Section 2: Securing communications and establishing boundary protection] Serves 2.2 'Identifying use cases and configuring VPC Service Controls': you build service perimeters around projects to stop data exfiltration through Google APIs, using access levels, ingress and egress rules, dry-run mode and perimeter bridges.
27. Level 27: Private connectivity between VPCs and projects
    [Section 2: Securing communications and establishing boundary protection] Serves 2.3 'Designing and configuring private connectivity between VPC networks and Google Cloud projects (Shared VPC, VPC peering, and Private Google Access for on-premises hosts)': you design hub-and-spoke layouts across projects and give on-premises hosts private access to Google APIs over hybrid links.
28. Level 28: Encrypted hybrid links: HA VPN and Cloud Interconnect
    [Section 2: Securing communications and establishing boundary protection] Serves 2.3 'Designing and configuring private connectivity and encryption between data centers and VPC network (e.g., HA VPN, Cloud Interconnect)': you compare HA VPN, Dedicated and Partner Interconnect, HA VPN over Cloud Interconnect and MACsec, focusing on which links encrypt traffic and how.
29. Level 29: Private Google access paths, IP addressing and Cloud NAT
    [Section 2: Securing communications and establishing boundary protection] Serves 2.3 'Establishing private connectivity between VPC and Google APIs' and 'Using Cloud NAT to enable outbound traffic', plus 2.1 'Differentiating between private and public IP addressing': you compare Private Google Access, restricted Google access and Private Service Connect endpoints, and give private-IP-only VMs controlled outbound access with Cloud NAT.
30. Level 30: Sensitive Data Protection: discovering PII
    [Section 3: Ensuring data protection] Serves 3.1 'Configuring Sensitive Data Protection (SDP)', the discovery part: you use built-in and custom infoTypes, inspection templates, inspection jobs and discovery scan configurations to find PII across BigQuery, Cloud Storage and Cloud SQL.
31. Level 31: SDP de-identification: redaction, pseudonymization, FPE
    [Section 3: Ensuring data protection] Serves 3.1 'discovering and redacting personally identifiable information (PII), configuring pseudonymization and format preserving encryption': you compare redaction, masking, deterministic encryption, cryptographic hashing and format preserving encryption, and keep the wrapped keys they need in Cloud KMS.
32. Level 32: Restricting access to BigQuery, Cloud Storage, Cloud SQL
    [Section 3: Ensuring data protection] Serves 3.1 'Restricting access to Google Cloud data services (e.g., BigQuery, Cloud Storage, and Cloud SQL datastores)': you apply BigQuery dataset, table, column-level (policy tags) and row-level controls, authorized views, uniform bucket-level access and public access prevention, and Cloud SQL private IP, Cloud SQL Auth Proxy and IAM database authentication.
33. Level 33: Securing secrets with Secret Manager
    [Section 3: Ensuring data protection] Serves 3.1 'Securing secrets with Secret Manager': you store, version, rotate and grant access to secrets with per-secret IAM, CMEK, replication policies and rotation notifications, and remove credentials from code and environment files.
34. Level 34: Protecting compute instance metadata
    [Section 3: Ensuring data protection] Serves 3.1 'Protecting and managing compute instance metadata': you see what the metadata server exposes, including service account tokens, startup scripts and SSH keys, and lock it down with OS Login, blocked project-wide SSH keys, GKE metadata concealment and organization policies.
35. Level 35: Default encryption vs CMEK vs Cloud EKM
    [Section 3: Ensuring data protection] Serves 3.2 'Identifying use cases for Google default encryption, customer-managed encryption keys (CMEK), and Cloud External Key Manager (EKM)': you compare who holds and controls the key in each model, what each one costs to run, and which compliance or sovereignty needs justify moving from the default.
36. Level 36: Software vs hardware keys: Cloud HSM
    [Section 3: Ensuring data protection] Serves 3.2 'Determining when to use software and hardware keys': you compare the SOFTWARE, HSM and EXTERNAL protection levels in Cloud KMS, what FIPS 140-2 validation level each meets, and when Cloud HSM is worth its higher cost.
37. Level 37: Key lifecycle: rotation, revocation and import
    [Section 3: Ensuring data protection] Serves 3.2 'Creating and managing encryption keys for CMEK and EKM (e.g., key rotation and revocation, key import)': you set automatic rotation schedules, disable and destroy key versions (and see what that does to the data), import your own key material with import jobs, and manage Cloud EKM keys.
38. Level 38: Applying encryption methods to use cases
    [Section 3: Ensuring data protection] Serves 3.2 'Applying encryption methods to various use cases': you match encryption at rest, in transit and at the application layer to scenarios, including customer-supplied encryption keys (CSEK), client-side encryption with Tink and Cloud KMS, and Google's default encryption in transit.
39. Level 39: Cloud Storage object lifecycle and retention
    [Section 3: Ensuring data protection] Serves 3.2 'Configuring object lifecycle policies for Cloud Storage': you write lifecycle rules that delete objects or change their storage class by age, version count or condition, and combine them with object versioning, soft delete, retention policies and Bucket Lock.
40. Level 40: Enabling Confidential Computing
    [Section 3: Ensuring data protection] Serves 3.2 'Enabling Confidential Computing' (encryption in use): you enable Confidential VMs, Confidential GKE Nodes and Confidential Space, compare the AMD SEV, SEV-SNP and Intel TDX technologies, and use attestation to prove a workload runs in a trusted execution environment.
41. Level 41: Securing IaaS- and PaaS-Hosted Model Training
    [Section 3: Ensuring data protection, 3.3 Securing AI workloads] Learn the security and privacy controls that stop training data or models from being exposed by accident, and how the security requirements differ when you train on infrastructure you run (Compute Engine or GKE with accelerators) versus a managed service (custom training on Gemini Enterprise Agent Platform).
42. Level 42: Security Controls for Gemini Enterprise Agent Platform
    [Section 3: Ensuring data protection, 3.3 Securing AI workloads] Apply Google Cloud's documented controls for Gemini Enterprise Agent Platform: data residency, CMEK, VPC Service Controls and Access Transparency, plus hardened Agent Platform Workbench and Colab Enterprise runtimes, Model Armor, and the AI Protection framework in Security Command Center.
43. Level 43: Automating CVE Scanning in CI/CD with Artifact Analysis
    [Section 4: Managing operations, 4.1 Automating infrastructure and application security] Use Artifact Analysis automatic and on-demand scanning in a Cloud Build pipeline to find Common Vulnerabilities and Exposures (CVEs) in container images and stop vulnerable builds before they ship.
44. Level 44: Binary Authorization for GKE and Cloud Run
    [Section 4: Managing operations, 4.1 Automating infrastructure and application security] Configure Binary Authorization policies, attestors and attestations so that only trusted, verified images can deploy to GKE clusters or Cloud Run services.
45. Level 45: Automated VM Image Hardening and Patch Management
    [Section 4: Managing operations, 4.1 Automating infrastructure and application security] Automate the build of hardened virtual machine images, control which images can be used, and run VM patch management at scale with VM Manager.
46. Level 46: Automating Container Image Creation and Maintenance
    [Section 4: Managing operations, 4.1 Automating infrastructure and application security] Automate building and maintaining container images: minimal, hardened base images, rebuilds triggered when a base image changes, and keeping GKE node images current, so that images stay patched without manual work.
47. Level 47: Posture Management and Drift Detection at Scale
    [Section 4: Managing operations, 4.1 Automating infrastructure and application security] Manage policy and detect drift across an organization with Security Command Center security posture (cloud security posture management), custom organization policies and custom modules for Security Health Analytics.
48. Level 48: Network Logs: NGFW, Flow Logs, Packet Mirroring, Cloud IDS
    [Section 4: Managing operations, 4.2 Configuring logging, monitoring, and detection] Configure and analyze network telemetry from Cloud NGFW firewall logging, VPC Flow Logs, Packet Mirroring and Cloud IDS, and query it with Log Analytics.
49. Level 49: Cloud Audit Logs and Data Access Logs
    [Section 4: Managing operations, 4.2 Configuring logging, monitoring, and detection] Configure and analyze Google Cloud Audit Logs: Admin Activity, Data Access, System Event and Policy Denied logs, including turning Data Access logs on with exemptions and managing their cost.
50. Level 50: Logging Strategy and Secure Access to Logs
    [Section 4: Managing operations, 4.2 Configuring logging, monitoring, and detection] Design an effective logging strategy and secure access to logs, using log buckets, retention, bucket locks, log views, CMEK for logs and least-privilege Logging roles.
51. Level 51: Log Sinks, Aggregated Sinks and External Export
    [Section 4: Managing operations, 4.2 Configuring logging, monitoring, and detection] Configure log sinks and aggregated sinks at the organization and folder level, and export logs to external security systems through Pub/Sub, BigQuery or Cloud Storage destinations.
52. Level 52: Configuring and Monitoring Security Command Center
    [Section 4: Managing operations, 4.2 Configuring logging, monitoring, and detection] Configure and monitor Security Command Center: service tiers, built-in services such as Security Health Analytics, Event Threat Detection and Container Threat Detection, findings, mute rules, and continuous exports.
53. Level 53: Responding to and Remediating Security Incidents
    [Section 4: Managing operations, 4.2 Configuring logging, monitoring, and detection] Log, monitor, respond to and remediate security incidents by combining log-based alerts, Security Command Center findings and automated responses into a containment playbook.
54. Level 54: Evaluating the Shared Responsibility Model
    [Section 5: Supporting compliance requirements, 5.1 Adhering to regulatory and industry standards] Evaluate the shared responsibility model across IaaS, PaaS and SaaS on Google Cloud to decide which controls the customer must provide and which Google provides.
55. Level 55: Determining the Environment in Scope for Compliance
    [Section 5: Supporting compliance requirements, 5.1 Adhering to regulatory and industry standards] Work out which part of a Google Cloud environment is in scope for a regulation, and shrink that scope with the resource hierarchy, separate projects and network boundaries.
56. Level 56: Technical Needs for Compute, Data, Network, Storage
    [Section 5: Supporting compliance requirements, 5.1 Adhering to regulatory and industry standards] Turn regulatory requirements into technical needs for compute, data, network and storage, such as sole-tenant nodes, Confidential VMs, CMEK or Cloud HSM, private connectivity and retention policies.
57. Level 57: Assured Workloads and Regionalization of Data
    [Section 5: Supporting compliance requirements, 5.1 Adhering to regulatory and industry standards] Configure Assured Workloads folders for a compliance framework and enforce regionalization of data and services with resource location organization policies.
58. Level 58: Access Transparency and Access Approval
    [Section 5: Supporting compliance requirements, 5.1 Adhering to regulatory and industry standards] Configure Access Transparency and Access Approval so you can see, and approve or deny, Google personnel access to customer content.
59. Level 59: Mapping Compliance Requirements to Controls
    [Section 5: Supporting compliance requirements, 5.1 Adhering to regulatory and industry standards] Map compliance requirements to Google Cloud services and security controls, such as network and access segmentation, organizational policies and audit log coverage, and prove the mapping with evidence.
60. Level 60: Timed Mock Exam (50 questions, 120 minutes) Timed mock
    A timed mock exam of 50 original scenario questions in 120 minutes, pass mark 70%, weighted across all five sections of the Professional Cloud Security Engineer exam guide.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →