Why start with the exam itself
Before we touch IAM or firewalls, it helps to know what you are preparing for. In code terms, the Professional Cloud Security Engineer exam is the test suite and this course is the code we write to pass it. If you know what the tests check, you spend your time in the right places.
Three ground rules first:
- The exam guide belongs to Google. It is not reproduced in this course. You can download it free from the certification page at
cloud.google.com/learn/certification/cloud-security-engineer. Keep it open as you study, because it is the official list of what can be tested. - This course is independent. Google does not endorse it, and no course can promise you a pass.
- Check the logistics yourself. At the time of writing, Google's exam page lists a 2-hour exam with 50–60 multiple choice and multiple select questions. The fee is $200 plus tax where it applies. You can take it in English or Japanese, either online-proctored from home or onsite at a testing centre. There are no prerequisites, and Google recommends 3+ years of industry experience including 1+ year on Google Cloud. All of these details change, so read the live page before you book.
Gotcha: For Associate and Professional exams, Google's program policies allow four attempts in two years. The waits between failed attempts get longer: 14 days, then 60, then 365. You pay for every attempt. Book when you are ready, not to "see what it's like".
The five sections and their weights
The guide splits the exam into five sections, each with an approximate weight:
| Section | Weight | What it covers (guide's wording, abridged) |
|---|---|---|
| 1. Configuring access | ~25% | Cloud Identity, service accounts, authentication, authorization controls, resource hierarchy |
| 2. Securing communications and establishing boundary protection | ~22% | Perimeter security, boundary segmentation, private connectivity |
| 3. Ensuring data protection | ~23% | Sensitive Data Protection, encryption at rest/in transit/in use, securing AI workloads |
| 4. Managing operations | ~19% | Automating infrastructure and application security; logging, monitoring and detection |
| 5. Supporting compliance requirements | ~11% | Regulatory and industry standards, shared responsibility model, Assured Workloads, Access Transparency |
This course has 60 levels, split roughly in the same proportion: about 15 on access, 13 on boundaries, 14 on data protection, 11 on operations and 7 on compliance. Within each section we follow the guide's own items and its exact product names. Google renames products, and the exam uses the current names. For example, the guide's AI item refers to the Gemini Enterprise Agent Platform, the 2026 successor to Vertex AI.
Best practice: The weights are approximate ("~"), and Google revises the guide. When you download it, check the percentages against this table.
Turning weights into a study plan
The weights tell you where the marks are. Here is a quick way to share out your study hours:
# Split a study budget by the guide's section weights
weights = {
"1 Access": 0.25,
"2 Boundaries": 0.22,
"3 Data protection": 0.23,
"4 Operations": 0.19,
"5 Compliance": 0.11,
}
budget_hours = 40 # your total, e.g. 8 weeks x 5 hours
for section, w in weights.items():
print(f"{section:<18} {w*budget_hours:5.1f} h")
# Output:
# 1 Access 10.0 h
# 2 Boundaries 8.8 h
# 3 Data protection 9.2 h
# 4 Operations 7.6 h
# 5 Compliance 4.4 h
Then adjust for what you already know. If you run Cloud Armor every day but have never set up Cloud KMS, move hours from section 2 to section 3. The trade-off is that the weights show where the marks are, while your gaps show where you can gain the most. Use both. Never skip compliance because it is only ~11%. On 50–60 questions, that is still about 6 questions.
Anatomy of a scenario question
Most questions are short scenarios that ask for the best answer. Usually more than one option would work. Your job is to find the one that fits every word of the scenario. Read each one like a ticket from a demanding customer and pull out three things:
- Requirement: what has to be achieved.
- Constraint: limits on how, such as cost, operational overhead, compliance, "no public IPs" or "without code changes".
- Keywords: words that point towards one product or away from another, such as least privilege, centrally, short-lived, exfiltration or Google-recommended.
Worked example
Your developers need SSH access to Compute Engine VMs that have no external IP addresses. The security team wants access controlled by IAM identity, and wants to avoid managing additional infrastructure. What should you do?
A. Give each VM an external IP and restrict port 22 to the office IP range with a firewall rule. B. Deploy a bastion host VM with an external IP and let developers jump through it. C. Use Identity-Aware Proxy (IAP) TCP forwarding, allow ingress from IAP's range on port 22, and grant the IAP-secured Tunnel User role. D. Set up an HA VPN from the office and SSH over the private network.
Break it down:
Requirement : SSH to VMs
Constraint : no external IPs; no extra infrastructure to manage
Keywords : "controlled by IAM identity"
A -> breaks "no external IPs" (rules out)
B -> works, but a bastion is extra infra to patch (weaker)
D -> works, but VPN gateways are extra infra, and
access is by network, not identity (weaker)
C -> meets every requirement and constraint (best)
B and D are the plausible distractors. They would work in real life, and many teams use them. They lose only because they fail one constraint. That is how most wrong answers on this exam are built.
Product-contrast questions
Some questions put two similar products side by side, for example two ways to restrict access or two kinds of encryption key. Ask yourself which layer each product controls (identity, network, data or organisation policy) and which layer the scenario is actually about. We will build these contrasts level by level.
Pitfall: Don't pick an answer just because you have used that product before. Choose the option that matches the scenario's constraints, even if your own team does it differently.
Key takeaways
- The exam guide is Google's own document and is free on the certification page. This course is independent, not endorsed by Google, and promises no pass.
- Check length, price, languages and delivery on Google's live exam page. At the time of writing: 2 hours, 50–60 questions, $200, English or Japanese, online or onsite.
- The five sections are weighted about 25/22/23/19/11%. Course levels and your study hours should follow those weights, adjusted for your own gaps.
- For every scenario, pull out the requirement, the constraint and the keywords before you read the options.
- The best answer satisfies every constraint. Plausible distractors usually work but fail one condition.
What the exam asks about this: nothing directly. You won't get a question about the exam itself. But every question tests the method from this level: a short scenario, several workable options and one that fits all the constraints. It also expects Google's current product names.