Cloud Pro: Google Cloud Security and Identity: Choose, Compare and Launch

What's inside

1. Level 1: The Google Cloud Security Map on One PageFree
   Learners sort every Google Cloud security and identity service into seven job groups and note each one's current and former names, such as BeyondCorp Enterprise, which is now Chrome Enterprise Premium, and Cloud DLP, which is now Sensitive Data Protection.
2. Level 2: Build the Standard Security ProfileFree
   Learners build a reusable security profile covering identities, privilege model, data classification, key control, compliance and residency, detection and response, logging, zero trust posture, team skills and cost model, so every later service choice can be measured against it.
3. Level 3: Cloud IAM: Allow Policies, Roles and Conditions
   Learners see how IAM allow policies inherit down the organization, folder and project hierarchy, and when to use basic, predefined, custom and conditional roles. Each choice comes with its dated limits and its trade-offs.
4. Level 4: IAM Deny Policies and Access Boundaries
   Learners use deny policies and principal access boundary policies as guardrails that override allow grants, then finish the nine-part IAM lesson with a quick start, clean-up and choose-it-when guidance.
5. Level 5: Service Accounts and Workload Identity Federation
   Learners replace downloaded service account keys with short-lived credentials by using service account impersonation, Workload Identity Federation for external workloads, and Workload Identity for GKE.
6. Level 6: Organization Policy: Built-in Constraints
   Learners use built-in Organization Policy constraints to restrict what can be created anywhere in the hierarchy, such as resource locations, external IPs and service account keys, and learn how inheritance and overrides behave.
7. Level 7: Custom Constraints and Safe Policy Rollout
   Learners write custom Organization Policy constraints with CEL conditions and roll them out safely using dry-run and the policy simulator. This finishes the nine-part Organization Policy lesson.
8. Level 8: Cloud Identity and Workforce Identity Federation
   Learners choose how employees sign in to Google Cloud: Cloud Identity Free or Premium synced from an existing directory, or Workforce Identity Federation with an external IdP and no Google accounts at all.
9. Level 9: Identity Platform for Customer Identity
   Learners judge whether Identity Platform fits customer sign-in for their apps, covering multi-tenancy, MFA, blocking functions, pricing by monthly active users, and how it relates to Firebase Authentication.
10. Level 10: Cloud KMS and Customer-Managed Keys
    Learners use Cloud KMS key rings, keys, versions and rotation to apply customer-managed encryption keys (CMEK) to Google Cloud services, and learn the per-key-version and per-operation costs that grow at scale.
11. Level 11: Cloud HSM and Cloud External Key Manager
    Learners match key-control requirements to protection levels (software, Cloud HSM, and External Key Manager with an outside partner) and weigh compliance gains against latency, availability and cost.
12. Level 12: Secret Manager
    Learners store, version, rotate and access application secrets with Secret Manager, choosing between global and regional secrets, replication policies and CMEK, and avoiding common leaks.
13. Level 13: Certificate Authority Service
    Learners decide when to run a private CA with Certificate Authority Service. They choose between the DevOps and Enterprise tiers, design a CA pool hierarchy, and compare it with Certificate Manager and self-run PKI.
14. Level 14: Cloud Audit Logs and Access Transparency
    Learners set up Admin Activity, Data Access, System Event and Policy Denied audit logs, route them through organization-level sinks, and add Access Transparency to see when Google staff touch their data.
15. Level 15: Security Command Center: Tiers and Deprecations
    Learners compare Security Command Center's Standard, Premium and Enterprise tiers, including the Enterprise tier's deprecation on 21 May 2026 and planned shutdown on or after 21 May 2027, and pick an activation level that fits the profile.
16. Level 16: SCC Posture, Findings and Threat Detection
    Learners activate Security Command Center, work with findings from Security Health Analytics, Event Threat Detection and the other built-in detectors, apply security postures, and send findings to response tooling.
17. Level 17: VPC Service Controls: Perimeters
    Learners use VPC Service Controls service perimeters and access levels to stop data from leaving Google-managed services, even when an attacker has valid credentials.
18. Level 18: VPC-SC Ingress, Egress Rules and Dry-Run
    Learners roll out VPC Service Controls safely: dry-run mode first, then ingress and egress rules written from the violation logs, then enforcement without breaking pipelines.
19. Level 19: Identity-Aware Proxy
    Learners put Identity-Aware Proxy in front of web apps and use it for TCP forwarding to VMs, replacing VPNs and bastion hosts with access checked on identity and context for every request.
20. Level 20: Chrome Enterprise Premium (formerly BeyondCorp)
    Learners judge whether Chrome Enterprise Premium, formerly BeyondCorp Enterprise, is worth its per-user licence for device-aware access, threat and data protection in the browser, and app connectors to private apps.
21. Level 21: Sensitive Data Protection: Discover, Classify, De-identify
    Learn when Sensitive Data Protection (formerly Cloud DLP) fits for finding, classifying and de-identifying sensitive data, with its nine-part breakdown and a scoped quick start.
22. Level 22: Assured Workloads: Regulated Folders and Residency
    Decide when Assured Workloads compliance regimes and data-residency controls justify their limits on services and features, and launch a regulated folder safely.
23. Level 23: Confidential Computing: Protect Data in Use
    Learn what Confidential VMs, Confidential GKE Nodes and Confidential Space protect against, what they cost in price and performance, and when protecting data in use actually matters.
24. Level 24: Landing Zone: Resource Hierarchy and Foundations
    Combine the services from earlier levels into a landing zone: an organization, folder and project hierarchy with baseline Organization Policies, central logging, CMEK and networking built as code.
25. Level 25: Least-Privilege Design Across the Estate
    Turn the landing zone into a least-privilege access model using groups, predefined and custom roles, deny policies, IAM Conditions, Privileged Access Manager and workload identities without keys.
26. Level 26: Incident Response: Detection to Containment
    Run the first half of an incident on Google Cloud: triage an SCC finding, investigate with audit logs and Log Analytics, and contain the threat without destroying evidence.
27. Level 27: Incident Response: Eradication, Recovery, Review
    Finish the incident lifecycle: remove the attacker's access, rotate secrets and keys, restore services, and turn the lessons into automated detections and preventive controls.
28. Level 28: Compliance Mapping: Controls to Frameworks
    Map the landing zone's controls to frameworks such as ISO 27001, SOC 2, PCI DSS and regional residency rules, separating what Google attests to from what you must prove.
29. Level 29: Cost of Security Tooling at Scale
    Model what security costs across a large estate, including SCC tier pricing, log ingestion and retention, KMS and HSM operations, Secret Manager access calls and DLP scanning, and find the biggest cost levers.
30. Level 30: Weighted Selection Scorecard from the Profile
    Turn the Level 2 security profile into a weighted scorecard with criteria, weights, scoring rubrics and must-pass gates that can compare services and clouds fairly.
31. Level 31: Scoring Google Cloud with Dated Evidence
    Apply the scorecard to Google Cloud's security and identity services, backing every score with dated documentation, pricing and limits evidence.
32. Level 32: Scoring Google Cloud Against Another Cloud
    Score a second cloud, such as AWS or Azure, on the same scorecard by mapping each Google Cloud service to its nearest equivalent and noting real gaps rather than naming differences.
33. Level 33: Final Challenge: Decision Workshop and Selection Record Exam
    Run a full decision workshop on a realistic scenario, drawing on the whole course from the service map and profile to the scorecard, and finish with a one-page selection record.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →