Professional Cloud Security Engineer Course Notes

This domain is about identity, least privilege, and controlling privileged access. Prefer short-lived credentials and workload identity federation over long-lived service account keys. Use Cloud Identity federation and lifecycle controls for users, strong authentication for interactive access, IAM roles/conditions for scoped permissions, deny policies for explicit restrictions, and the resource hierarchy for inherited policy. Privileged Access Manager is for temporary elevation, not standing admin access.

• Treating long-lived service account keys as the default.

• Default mental model: key avoidance + short-lived credentials + least privilege.

Know which control protects which layer. Cloud NGFW controls network traffic; Cloud Armor protects web-facing applications at the edge; IAP authorizes application access using identity and context; VPCs and Shared VPC define network isolation and administration; VPC Service Controls create service perimeters to reduce data-exfiltration risk. For private connectivity, distinguish VPN/Interconnect, Private Google Access, Private Service Connect, and Cloud NAT. Cloud NAT gives private resources outbound connectivity without assigning them public IPs.

• Confusing Cloud NGFW with Cloud Armor.

• First identify the layer: user/app, network, service perimeter, private service access, or hybrid connectivity.

Protect sensitive data, secrets, cryptographic keys, data in use, and AI workloads. Sensitive Data Protection discovers and transforms sensitive data using techniques such as redaction and pseudonymization. Secret Manager stores secrets with IAM, auditing, versioning/rotation workflows, and revocation. Key choice depends on required control, location, separation of duties, rotation, availability, and external-key obligations. Confidential Computing protects data while it is being processed. AI security should consider the full workload: data, models, prompts, outputs, and supply chain.

• Confusing redaction with pseudonymization.

• Ask what state of data is being protected: stored secret, encrypted data, or data in use.

Operational security is about finding risk early, enforcing trusted deployment, detecting drift, centralizing findings, and preserving useful logs. Scan dependencies, artifacts, containers, and infrastructure before promotion. Binary Authorization evaluates trusted attestations at deployment time. Detect drift through posture/configuration monitoring and analysis. Build a logging strategy that defines required events, sensitive data access, retention, protection, routing, aggregation, analysis, and response. Security Command Center centralizes security findings. Log sinks route logs to centralized or external destinations.

• Scanning only the final image/artifact.

• Pipeline security: detect early, then gate deployment.

Compliance questions are about ownership, constraints, evidence, and mapping requirements to controls. Google and the customer share responsibility: Google secures underlying cloud infrastructure while customers remain responsible for their data, applications, identities, configurations, and use of cloud controls. Assured Workloads and organization policies help enforce location/control constraints. Access Transparency records provider access; Access Approval adds customer authorization for applicable provider access. Good compliance mapping links each requirement to controls, evidence, ownership, and ongoing monitoring.

• Assuming Google owns all compliance responsibilities.

• Start by identifying who owns the control.