Google Cloud – Professional Cloud Security Engineer Certification learning path

Continuing on the Google Cloud Journey, have just cleared the Professional Cloud Security certification. Google Cloud – Professional Cloud Security Engineer certification exam focuses on almost all of the Google Cloud security services with storage, compute, networking services with their security aspects only.

Google Cloud – Professional Cloud Security Engineer Certification Summary

• Has 50-60 questions to be answered in 2 hours.
• Registration fee: $200 (plus tax where applicable)
• Available in English and Japanese
• Can be taken online-proctored or at a testing center
• Covers a wide range of Google Cloud services mainly focusing on security and network services
• Recommended experience: 3+ years of industry experience including 1+ years designing and managing solutions using Google Cloud
• As mentioned for all the exams, Hands-on is a MUST, if you have not worked on GCP before make sure you do lots of labs else you would be absolutely clueless about some of the questions and commands
• Certification is valid for 3 years and can be renewed within the renewal eligibility period
• The exam now covers five key domains:
  • Configuring Access (~25%)
  • Securing Communications and Establishing Boundary Protection (~22%)
  • Ensuring Data Protection (~23%)
  • Managing Operations (~19%)
  • Supporting Compliance Requirements (~11%)

Google Cloud – Professional Cloud Security Engineer Certification Resources

• Courses
  • Google Cloud Skills Boost – Professional Cloud Security Engineer Learning Path (Official Google training)
  • Udemy – Google Professional Cloud Security Engineer Certification
  • Coursera – Preparing for Google Cloud Certification: Cloud Security Engineer Professional Certificate
  • Coursera – Security Best Practices in Google Cloud
  • Coursera – Preparing for Your Professional Cloud Security Engineer Journey
  • Pluralsight Cloud+ (formerly A Cloud Guru) – Google Cloud Security courses
• Practice tests
  • Udemy – Google Professional Cloud Security Engineer – Practice Exams
  • Official Google Sample Questions
• Use Google Cloud Free Tier and Cloud Skills Boost (formerly Qwiklabs) as much as possible.

Google Cloud – Professional Cloud Security Engineer Certification Topics

Security Services

• Google Cloud – Security Services Cheat Sheet
• Cloud Key Management Service – KMS
  • Cloud KMS provides a centralized, scalable, fast cloud key management service to manage encryption keys
  • KMS Key is a named object containing one or more key versions, along with metadata for the key.
  • KMS KeyRing provides grouping keys with related permissions that allow you to grant, revoke, or modify permissions to those keys at the key ring level without needing to act on each key individually.
  • Supports Autokey (GA 2024) for automatic key provisioning and assignment to protect data at rest
  • Supports Cloud External Key Manager (EKM) for using keys managed in supported external key management partners
• Cloud Armor
  • Cloud Armor protects the applications from multiple types of threats, including DDoS attacks and application attacks like XSS and SQLi
  • works with the external HTTP(S) load balancer to automatically block network protocol and volumetric DDoS attacks such as protocol floods (SYN, TCP, HTTP, and ICMP) and amplification attacks (NTP, UDP, DNS)
  • Cloud Armor Enterprise (formerly Managed Protection Plus) is the premium tier with advanced DDoS protection, Threat Intelligence, and Adaptive Protection features
  • Adaptive Protection uses ML to detect and mitigate L7 DDoS attacks automatically, trained locally on application traffic patterns
  • Hierarchical Security Policies (GA 2025) enable centralized control and delegation of security policy management across organizations
  • Enhanced WAF inspection now supports up to 64 KB request body inspection (up from 8 KB) for preconfigured WAF rules
  • with GKE needs to be configured with GKE Ingress
  • can be used to blacklist IPs
  • supports preview mode to understand patterns without blocking the users
• Cloud Identity-Aware Proxy
  • Identity-Aware Proxy IAP allows managing access to HTTP-based apps both on Google Cloud and outside of Google Cloud.
  • IAP uses Google identities and IAM and can leverage external identity providers as well like OAuth with Facebook, Microsoft, SAML, etc.
  • Signed headers using JWT provide secondary security in case someone bypasses IAP.
  • IAP is a core component of Google’s BeyondCorp zero-trust model, now delivered through Chrome Enterprise Premium

• Sensitive Data Protection (formerly Cloud Data Loss Prevention – DLP)
  • Cloud Data Loss Prevention (DLP) is now part of Sensitive Data Protection, a family of services designed to help discover, classify, and protect sensitive data.
  • The API name remains Cloud Data Loss Prevention API (DLP API)
  • provides two key features
    • Classification is the process to inspect the data and know what data we have, how sensitive it is, and the likelihood.
    • De-identification is the process of removing, masking, redaction, replacing information from data.
  • supports text, image, and storage classification with scans on data stored in Cloud Storage, Datastore, and BigQuery
  • supports scanning of binary, text, image, Microsoft Word, PDF, and Apache Avro files
  • Discovery service (data profiler) continuously monitors data resources and classifies data into infoTypes, assessing sensitivity and risk levels
  • Deeply integrated with Security Command Center Enterprise risk engine for continuous data monitoring
  • Supports automatic discovery of unencrypted secrets and data profiling across organizations, folders, or projects
• Web Security Scanner
  • Web Security Scanner identifies security vulnerabilities in the App Engine, GKE, and Compute Engine web applications.
  • scans provide information about application vulnerability findings, like OWASP, XSS, Flash injection, outdated libraries, cross-site scripting, clear-text passwords, or use of mixed content
• Security Command Center – SCC
  • is a Security and risk management platform that helps generate curated insights and provides a unique view of incoming threats and attacks to the assets
  • displays possible security risks, called findings, that are associated with each asset.
  • Available in three tiers:
    • Standard tier – Free, now automatically enabled for eligible customers; provides basic security and compliance management
    • Premium tier – Pay-as-you-go; includes Security Health Analytics, Event Threat Detection, Container Threat Detection, and VM Threat Detection
    • Enterprise tier – Subscription-based; extends protection across multiple clouds with Google SecOps integration and automated responses (Note: Enterprise tier shuts down May 21, 2027; organizations will move to Premium tier)
  • Premium and Enterprise tiers include Risk Engine for attack path simulation and toxic combination detection
• Forseti Security
  ⚠️ DEPRECATED/ARCHIVED – Forseti Security repository was archived by Google on January 11, 2025 due to low community engagement and limited development activity. It is now read-only and no longer supported.
  
  Alternative: Use Security Command Center (SCC) for centralized security posture management, asset inventory, and compliance monitoring.
  • Was an open-source security toolkit for GCP resource inventory and policy enforcement
  • Kept track of the environment with inventory snapshots of GCP resources on a recurring cadence
• Chrome Enterprise Premium (formerly BeyondCorp Enterprise)
  • BeyondCorp Enterprise was renamed to Chrome Enterprise Premium in April 2024
  • Provides zero-trust access security integrated directly within the Chrome browser
  • Enables granular access policies for personally-owned and managed devices
  • Combines threat protection, data protection, and zero-trust access in the browser
  • Works with Identity-Aware Proxy (IAP) and Access Context Manager for context-aware access
• Access Context Manager
  • Access Context Manager allows organization administrators to define fine-grained, attribute-based access control for projects and resources
  • Access Context Manager helps reduce the size of the privileged network and move to a model where endpoints do not carry ambient authority based on the network.
  • Access Context Manager helps prevent data exfiltration with proper access levels and security perimeter rules
  • Works with VPC Service Controls to create security perimeters around Google Cloud resources
• VPC Service Controls
  • Creates security perimeters that protect resources and data of explicitly specified services
  • Prevents data exfiltration by restricting the movement of data across perimeter boundaries
  • Critical for Vertex AI security – controls access to AI/ML endpoints and training data
  • Supports ingress and egress rules for fine-grained access policies
  • Major exam topic – understand perimeter configuration, access levels, and service restrictions

AI Security (New Exam Topic)

• Securing Vertex AI Workloads
  • Approximately ⅓–¼ of the current exam covers Vertex AI security topics
  • Understand network security for AI endpoints (private vs public endpoint configurations)
  • Use VPC Service Controls to protect training data and model artifacts
  • Configure IAM roles for Vertex AI (roles/aiplatform.*) with least privilege
  • Understand Customer-Managed Encryption Keys (CMEK) for AI data encryption
  • Secure model serving endpoints with authentication and authorization
• Confidential Computing
  • Provides hardware-based memory encryption for data-in-use protection
  • Confidential VMs encrypt data while processing, offering protection from cloud operator access
  • Supports secure collaboration and federated learning without revealing individual data
  • Available for Compute Engine, GKE, and AI/ML workloads

Software Supply Chain Security (New Exam Topic)

• Binary Authorization
  • Deploy-time security control that ensures only trusted container images are deployed on GKE or Cloud Run
  • Enforces signature verification policies before deployment
• Artifact Registry
  • Universal package manager for container images and language packages
  • Supports vulnerability scanning with Artifact Analysis
  • Replaces Container Registry (deprecated)
• Software Delivery Shield
  • End-to-end software supply chain security solution
  • Covers source code, build, deploy, and runtime phases
  • Integrates Cloud Build, Artifact Registry, Binary Authorization, and GKE security features

Compliance

• FIPS 140-2 Validated
  • FIPS 140-2 Validated certification was established to aid in the protection of digitally stored unclassified, yet sensitive, information.
  • Google Cloud uses a FIPS 140-2 validated encryption module called BoringCrypto in the production environment. This means that both data in transit to the customer and between data centers, and data at rest are encrypted using FIPS 140-2 validated encryption.
  • BoringCrypto module that achieved FIPS 140-2 validation is part of the BoringSSL library.
  • BoringSSL library as a whole is not FIPS 140-2 validated
• PCI/DSS Compliance
  • PCI/DSS compliance is a shared responsibility model
  • Egress rules cannot be controlled for App Engine, Cloud Functions, and Cloud Storage. Google recommends using Compute Engine and GKE to ensure that all egress traffic is authorized.
  • Antivirus software and File Integrity monitoring must be used on all systems commonly affected by malware to protect systems from current and evolving malicious software threats including containers
  • For payment processing, the security can be improved and compliance proved by isolating each of these environments into its own VPC network and reduce the scope of systems subject to PCI audit standards
• Assured Workloads
  • Enables compliance and sovereignty controls for regulated workloads on Google Cloud
  • Supports FedRAMP, IL4, CJIS, ITAR, and regional compliance requirements
  • Automatically applies organization policy constraints and resource location restrictions

Networking Services

• Refer Google Cloud Security Services Cheat Sheet
• Virtual Private Cloud
  • Understand Virtual Private Cloud (VPC), subnets, and host applications within them
  • Firewall rules control the Traffic to and from instances. HINT: rules with lower integers indicate higher priorities. Firewall rules can be applied to specific tags.
  • Know implied firewall rules which deny all ingress and allow all egress
  • Understand the difference between using Service Account vs Network Tags for filtering in Firewall rules. HINT: Use SA over tags as it provides access control while tags can be easily inferred.
  • VPC Peering allows internal or private IP address connectivity across two VPC networks regardless of whether they belong to the same project or the same organization. HINT: VPC Peering uses private IPs and does not support transitive peering
  • Shared VPC allows an organization to connect resources from multiple projects to a common VPC network so that they can communicate with each other securely and efficiently using internal IPs from that network
  • Private Access options for services allow instances with internal IP addresses can communicate with Google APIs and services.
  • Private Google Access allows VMs to connect to the set of external IP addresses used by Google APIs and services by enabling Private Google Access on the subnet used by the VM’s network interface.
  • Private Service Connect provides private connectivity between VPCs and services, including Google APIs and third-party services, without exposing traffic to the public internet
  • VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes.
  • Firewall Rules Logging enables auditing, verifying, and analyzing the effects of the firewall rules
• Hybrid Connectivity
  • Understand Hybrid Connectivity options in terms of security.
  • Cloud VPN provides secure connectivity from the on-premises data center to the GCP network through the public internet. Cloud VPN does not provide internal or private IP connectivity
  • Cloud Interconnect provides direct connectivity from the on-premises data center to the GCP network
• Cloud NAT
  • Cloud NAT allows VM instances without external IP addresses and private GKE clusters to send outbound packets to the internet and receive any corresponding established inbound response packets.
  • Requests would not be routed through Cloud NAT if they have an external IP address
• Cloud DNS
  • Understand Cloud DNS and its features
  • supports DNSSEC, a feature of DNS, that authenticates responses to domain name lookups and protects the domains from spoofing and cache poisoning attacks
• Cloud Load Balancing
  • Google Cloud Load Balancing provides scaling, high availability, and traffic management for your internet-facing and private applications.
  • Understand Google Load Balancing options and their use cases esp. which is global, internal and does they support SSL offloading
    • Network Load Balancer – regional, external, pass through and supports TCP/UDP
    • Internal TCP/UDP Load Balancer – regional, internal, pass through and supports TCP/UDP
    • HTTP/S Load Balancer – regional/global, external, and supports HTTP/S
    • Internal HTTP/S Load Balancer – regional/global, internal, and supports HTTP/S
    • SSL Proxy Load Balancer – regional/global, external, proxy, supports SSL with SSL offload capability
    • TCP Proxy Load Balancer – regional/global, external, proxy, supports TCP without SSL offload capability

Identity Services

• Resource Manager
  • Understand Resource Manager the hierarchy Organization -> Folders -> Projects -> Resources
  • IAM Policy inheritance is transitive and resources inherit the policies of all of their parent resources.
  • Effective policy for a resource is the union of the policy set on that resource and the policies inherited from higher up in the hierarchy.
• Identity and Access Management
  • Identify and Access Management – IAM provides administrators the ability to manage cloud resources centrally by controlling who can take what action on specific resources.
  • A service account is a special kind of account used by an application or a virtual machine (VM) instance, not a person.
  • Service Account, if accidentally deleted, can be recovered if the time gap is less than 30 days and a service account by the same name wasn’t created
  • Understand IAM Best Practices
    • Use groups for users requiring the same responsibilities
    • Use service accounts for server-to-server interactions.
    • Use Organization Policy Service to get centralized and programmatic control over the organization’s cloud resources.
  • Domain-wide delegation of authority to grant third-party and internal applications access to the users’ data for e.g. Google Drive etc.
  • Workforce Identity Federation allows external identities (from Azure AD, Okta, etc.) to access Google Cloud resources without needing Google Cloud credentials
  • Workload Identity Federation allows external workloads to access Google Cloud resources without using service account keys
  • IAM Conditions enable attribute-based access control (ABAC) for fine-grained, conditional permissions
• Cloud Identity
  • Cloud Identity provides IDaaS (Identity as a Service) and provides single sign-on functionality and federation with external identity providers like Active Directory.
  • Cloud Identity supports federating with Active Directory using GCDS (Google Cloud Directory Sync) to implement the synchronization

Compute Services

• Compute services like Google Compute Engine and Google Kubernetes Engine are lightly covered more from the security aspects
• Google Compute Engine
  • Google Compute Engine is the best IaaS option for compute and provides fine-grained control
  • Managing access using OS Login or project and instance metadata
  • Compute Engine is recommended to be used with Service Account with the least privilege to provide access to Google services and the information can be queried from instance metadata.
  • Shielded VMs provide verifiable integrity of instances through Secure Boot, vTPM, and integrity monitoring
  • Confidential VMs provide hardware-based memory encryption for data-in-use protection
• Google Kubernetes Engine
  • Google Kubernetes Engine, enables running containers on Google Cloud
  • Understand Best Practices for Building Containers
    • Package a single app per container
    • Properly handle PID 1, signal handling, and zombie processes
    • Optimize for the Docker build cache
    • Remove unnecessary tools
    • Build the smallest image possible
    • Scan images for vulnerabilities using Artifact Analysis
    • Restrict using Public Image
    • Managed Base Images
    • Use Binary Authorization to enforce deployment policies
  • GKE Security Posture dashboard provides visibility into security configurations and vulnerabilities
  • Workload Identity is the recommended way to access Google Cloud services from GKE pods (replaces node SA)

Storage Services

• Cloud Storage
  • Cloud Storage is cost-effective object storage for unstructured data and provides an option for long term data retention
  • Understand Cloud Storage Security features
    • Understand various Data Encryption techniques including Envelope Encryption, CMEK, and CSEK. HINT: CSEK works with Cloud Storage and Persistent Disks only. CSEK manages KEK and not DEK.
    • Cloud Storage default encryption uses AES256
    • Understand Signed URL to give temporary access and the users do not need to be GCP users
    • Understand access control and permissions – IAM (Uniform) vs ACLs (fine-grained control)
    • Bucket Lock feature allows configuring a data retention policy for a bucket that governs how long objects in the bucket must be retained. The feature also allows locking the data retention policy, permanently preventing the policy from being reduced or removed
    • Object Versioning and Soft Delete for protection against accidental deletion

Monitoring

• Google Cloud Monitoring (formerly Stackdriver)
  • provides monitoring, alert, error reporting, metrics, diagnostics, debugging, trace.
• Google Cloud Logging (formerly Stackdriver Logging)
  • Audit logs are provided through Cloud Logging using Admin Activity and Data Access Audit logs
  • VPC Flow logs and Firewall Rules logs help monitor traffic to and from Compute Engine instances.
  • log sinks can export data to external providers via Cloud Pub/Sub, BigQuery, Cloud Storage, or third-party SIEM solutions
  • Cloud Audit Logs include Admin Activity, Data Access, System Event, and Policy Denied audit logs
• Google Security Operations (formerly Chronicle)
  • Cloud-native SIEM and SOAR platform for threat detection, investigation, and response
  • Built on Google infrastructure for petabyte-scale security telemetry analysis
  • Integrated with Security Command Center Enterprise tier
  • Note: There is a separate Professional Security Operations Engineer certification (launched Sept 2025) for deep SecOps specialization

All the Best !!