About the Professional Cloud Security Engineer exam

The Google Cloud Professional Cloud Security Engineer certification validates that you can design and implement secure workloads and infrastructure on Google Cloud. The exam covers five Domains: configuring access with Cloud Identity and IAM; securing communications and establishing boundary protection, including VPC Service Controls; ensuring data protection with customer-managed encryption keys (CMEK) and Sensitive Data Protection; managing security operations and logging; and supporting compliance requirements.

Professional Cloud Security Engineer exam domains

Exam Study Guide

Managing service accounts

Securing and protecting service accounts means giving every workload its own identity with only the permissions its task needs. In Google Cloud, Identity and Access Management (IAM) binds roles directly to that service account, and the account is attached to the resource running the code, such as a Cloud Build job, App Engine version, or Google Kubernetes Engine (GKE) pod. User-managed accounts use the form SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com and are created for one purpose, while default service accounts are auto-created, shared, and historically over-permissioned.

Continue with this study guide: Managing service accounts

Defining the resource hierarchy

Managing folders and projects at scale is the design of a Google Cloud resource hierarchy that enforces governance from a single root down to workloads. The hierarchy starts at a single organization node as the root, branches into folders that group related work, and ends in projects that host resources such as virtual machines, storage buckets, and networking. Projects within folders act as the core billing and trust boundary, while folders act as policy attach points and isolation boundaries for delegation.

Continue with this study guide: Defining the resource hierarchy

Managing Cloud Identity

Google Cloud Directory Sync (GCDS) is a provisioning bridge that copies users and groups from on-premises Active Directory to Cloud Identity or Google Workspace without copying passwords. Data flows from Active Directory to the GCDS host over Lightweight Directory Access Protocol (LDAP), then from the GCDS host to Google over HTTPS to the Directory API and Domain Shared Contacts API. Because the Google APIs are publicly reachable, traffic from GCDS to Google needs little firewall change, while traffic from GCDS to Active Directory requires direct LDAP network access.

Continue with this study guide: Managing Cloud Identity

Managing authentication

Creating a password and session management policy for user accounts means combining strong sign-in defaults in Identity Platform with short-lived sessions and boundary checks that limit stolen credentials. Cloud Identity issues cached credentials after login, session policies force periodic re-authentication, and per-request and perimeter controls limit where a valid token can be used. Together these controls govern the full user session lifecycle from enrollment to expiry.

Continue with this study guide: Managing authentication

Managing and implementing authorization controls

Managing privileged roles and separation of duties means no single identity can both grant sensitive access and use that access without oversight. Identity and Access Management (IAM) binds a principal such as a user, group, or service account to a role at a defined scope, and every request is checked against that binding. A toxic combination occurs when one principal holds grant permissions like resourcemanager.projects.setIamPolicy together with use permissions like data edit rights.

Continue with this study guide: Managing and implementing authorization controls

Exam Study Guide

Designing and configuring perimeter security

Configuring network perimeter controls combines private certificates, distributed firewalls, identity checks, and edge load balancing into one enforcement chain. Traffic flows from internet clients to the edge, then through identity verification, then to network filtering on the destination workload. Each layer evaluates a different signal so a failure in one layer does not grant full access.

Continue with this study guide: Designing and configuring perimeter security

Establishing private connectivity

VPC Network Peering is a bilateral connection that provides internal IP connectivity between two Virtual Private Cloud (VPC) networks. The two networks can be in the same project, in different projects, or in different organizations, and can mix IPv4-only, dual-stack, and IPv6-only subnets. Traffic flows only between the two directly peered networks because peering is non-transitive and never forwards traffic to a third network.

Continue with this study guide: Establishing private connectivity

Configuring boundary segmentation

Configuring security properties of a VPC network, VPC peering, Shared VPC, and firewall rules means deciding who owns the network, which routes cross network boundaries, and which traffic is filtered. Shared VPC centralizes subnets, routes, and filtering in a host project while workload teams own instances in service projects. VPC Network Peering connects two Virtual Private Cloud (VPC) networks for internal communication without merging their firewalls or identities, and firewall rules enforce distributed filtering at each virtual machine (VM).

Continue with this study guide: Configuring boundary segmentation

Exam Study Guide

Securing AI workloads

Implementing security and privacy controls for AI/ML systems means preventing training data, prompts, and models from leaking or being misused by accident. The control plane combines governance of data flows, encryption of pipelines and storage, and integrity checks on models from collection through training to inference. Training data carries the highest risk for bias and leakage, so minimization, de-identification, lineage, and audit logging apply across the full lifecycle.

Continue with this study guide: Securing AI workloads

Protecting sensitive data and preventing data loss

Sensitive Data Protection (SDP) is the Google Cloud service for discovering, classifying, and protecting sensitive data such as personally identifiable information (PII). Cloud Data Loss Prevention (Cloud DLP) is now part of Sensitive Data Protection, while the API name remains the Cloud Data Loss Prevention API (DLP API). SDP scans data where it is stored, so data does not leave its region of origin during inspection or profiling.

Continue with this study guide: Protecting sensitive data and preventing data loss

Managing encryption at rest, in transit, and in use

Google default encryption is automatic protection for customer data that requires no key configuration. Data moving to Google Cloud is protected in transit with Transport Layer Security (TLS) before transmission, and data is protected at rest once stored. Keys for this baseline are Google-owned and Google-managed keys that Google creates, stores, protects, and operates, and those keys are FIPS 140-2 compliant.

Continue with this study guide: Managing encryption at rest, in transit, and in use

Exam Study Guide

Configuring logging, monitoring, and detection

Configuring and analyzing network logs means combining firewall decisions, sampled flows, full-packet copies, and intrusion alerts in Cloud Logging for detection and forensics. Cloud Next Generation Firewall (Cloud NGFW) enforces policy inline and can block threats, while Cloud Intrusion Detection System (Cloud IDS) detects threats passively from mirrored traffic. VPC Flow Logs and Packet Mirroring provide the underlying traffic evidence, and Log Analytics makes all of it queryable with SQL.

Continue with this study guide: Configuring logging, monitoring, and detection

Automating infrastructure and application security

Automated CVE scanning in a CI/CD pipeline means container images and language packages are checked for known vulnerabilities before they can be deployed. In Google Cloud, On-Demand Scanning scans images during the build before storage, Artifact Analysis stores vulnerability occurrences for images in Artifact Registry, and Cloud Build orchestrates the build, scan, gate, and push. Together they enforce a severity gate, produce triage data, and keep results fresh across rebuilds.

Continue with this study guide: Automating infrastructure and application security

Exam Study Guide

Adhering to regulatory and industry standards requirements for the cloud

Determining technical needs relative to compute, data, network, and storage means translating regulatory mandates into specific Google Cloud controls for isolation, encryption, location, and workload integrity. Regulated data must stay inside approved projects, networks, regions, and key boundaries, while compute must prove it runs only trusted code. The design pairs API-level perimeters with private networking, customer-controlled encryption, immutable retention, and hardened execution environments.

Continue with this study guide: Adhering to regulatory and industry standards requirements for the cloud

About the Professional Cloud Security Engineer exam

Professional Cloud Security Engineer exam domains

Exam Study Guide

Professional Cloud Security Engineer: Google Cloud Security

About the Professional Cloud Security Engineer exam

Professional Cloud Security Engineer at a glance

Professional Cloud Security Engineer exam domains

Managing service accounts

Defining the resource hierarchy

Managing Cloud Identity

Managing authentication

Managing and implementing authorization controls

Designing and configuring perimeter security

Establishing private connectivity

Configuring boundary segmentation

Securing AI workloads

Protecting sensitive data and preventing data loss

Managing encryption at rest, in transit, and in use

Configuring logging, monitoring, and detection

Automating infrastructure and application security

Adhering to regulatory and industry standards requirements for the cloud

Equivalent exams at other providers

Professional Cloud Security Engineer: Google Cloud Security

About the Professional Cloud Security Engineer exam

Professional Cloud Security Engineer at a glance

Professional Cloud Security Engineer exam domains

Managing service accounts

Defining the resource hierarchy

Managing Cloud Identity

Managing authentication

Managing and implementing authorization controls

Designing and configuring perimeter security

Establishing private connectivity

Configuring boundary segmentation

Securing AI workloads

Protecting sensitive data and preventing data loss

Managing encryption at rest, in transit, and in use

Configuring logging, monitoring, and detection

Automating infrastructure and application security

Adhering to regulatory and industry standards requirements for the cloud

Equivalent exams at other providers

Professional Cloud Security Engineer: Google Cloud Security

About the Professional Cloud Security Engineer exam

Professional Cloud Security Engineer at a glance

Professional Cloud Security Engineer exam domains

1Configuring access~25%

1.1Managing service accounts

1.2Defining the resource hierarchy

1.3Managing Cloud Identity

1.4Managing authentication

1.5Managing and implementing authorization controls

2Securing communications and establishing boundary protection~22%

2.1Designing and configuring perimeter security

2.2Establishing private connectivity

2.3Configuring boundary segmentation

3Ensuring data protection~23%

3.1Securing AI workloads

3.2Protecting sensitive data and preventing data loss

3.3Managing encryption at rest, in transit, and in use

4Managing operations~19%

4.1Configuring logging, monitoring, and detection

4.2Automating infrastructure and application security

5Supporting compliance requirements~11%

5.1Adhering to regulatory and industry standards requirements for the cloud

Equivalent exams at other providers

Professional Cloud Security Engineer: Google Cloud Security

About the Professional Cloud Security Engineer exam

Professional Cloud Security Engineer at a glance

Professional Cloud Security Engineer exam domains

1Configuring access~25%

1.1Managing service accounts

1.2Defining the resource hierarchy

1.3Managing Cloud Identity

1.4Managing authentication

1.5Managing and implementing authorization controls

2Securing communications and establishing boundary protection~22%

2.1Designing and configuring perimeter security

2.2Establishing private connectivity

2.3Configuring boundary segmentation

3Ensuring data protection~23%

3.1Securing AI workloads

3.2Protecting sensitive data and preventing data loss

3.3Managing encryption at rest, in transit, and in use

4Managing operations~19%

4.1Configuring logging, monitoring, and detection

4.2Automating infrastructure and application security

5Supporting compliance requirements~11%

5.1Adhering to regulatory and industry standards requirements for the cloud

Equivalent exams at other providers

Managing service accounts

Defining the resource hierarchy

Managing Cloud Identity

Managing authentication

Managing and implementing authorization controls

Designing and configuring perimeter security

Establishing private connectivity

Configuring boundary segmentation

Securing AI workloads

Protecting sensitive data and preventing data loss

Managing encryption at rest, in transit, and in use

Configuring logging, monitoring, and detection

Automating infrastructure and application security

Adhering to regulatory and industry standards requirements for the cloud

Managing service accounts

Defining the resource hierarchy

Managing Cloud Identity

Managing authentication

Managing and implementing authorization controls

Designing and configuring perimeter security

Establishing private connectivity

Configuring boundary segmentation

Securing AI workloads

Protecting sensitive data and preventing data loss

Managing encryption at rest, in transit, and in use

Configuring logging, monitoring, and detection

Automating infrastructure and application security

Adhering to regulatory and industry standards requirements for the cloud