GOOGLE CLOUDGoogle Cloud Professional Cloud Security Engineer
The Google Cloud Professional Cloud Security Engineer certification validates your ability to design, implement, and manage secure workloads and infrastructure on Google Cloud. It is intended for security practitioners who configure access, protect data, and respond to threats across cloud environments. Earning it demonstrates that you can translate security requirements into resilient, compliant cloud architectures.
364 practice questions · Updated 2026-07-30
5Domains
14Objectives
123Concepts
364Questions
PROFESSIONAL-CLOUD-SECURITY-ENGINEER Curriculum
Every domain, objective, and concept the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam measures.
- Google Cloud Directory Sync (GCDS) configuration
- Single sign-on (SSO) with third-party identity provider
- Super administrator account management
- User lifecycle automation
- Programmatic user and group administration
- Workforce Identity Federation configuration
- Service Account Fundamentals
- Default Service Accounts
- Creating and Managing Service Accounts
- Service Account Key Security
- Short-Lived Credentials
- Workload Identity Federation
- Service Account Impersonation
- Password Policy Configuration
- Session Management Policy
- SAML Authentication Setup
- OAuth Authorization Configuration
- 2-Step Verification Enforcement
- IAM Roles and Permissions
- Privileged Roles and Separation of Duties
- IAM and ACL Permissions
- IAM Conditions
- IAM Deny Policies
- Identity Types and Permission Grants
- Resource Hierarchy and Least Privilege
- Access Context Manager
- Policy Intelligence
- Group-Based Permission Management
- Privileged Access Manager Use Cases
- Privileged Access Manager Configuration
- Resource hierarchy overview
- Managing folders and projects at scale
- Organization policies overview
- Using pre-built organization policies
- Creating custom organization policies
- Policy inheritance and hierarchy
- Access control using resource hierarchy
- Cloud NGFW rules and policies
- Identity-Aware Proxy (IAP) configuration
- Load balancer security features
- Certificate Authority Service usage
- Layer 7 inspection on Cloud NGFW
- Private vs public IP addressing
- Google Cloud Armor configuration
- Secure Web Proxy deployment
- Cloud DNS security settings
- API monitoring and restriction
- VPC network security properties
- VPC peering configuration
- Shared VPC configuration
- Firewall rules configuration
- Network isolation for N-tier applications
- Data encapsulation for N-tier applications
- VPC Service Controls use cases
- VPC Service Controls configuration
- Shared VPC
- VPC Peering
- Private Google Access for on-premises hosts
- HA VPN
- Cloud Interconnect
- Private Google Access for VPC
- Restricted Google Access
- Private Service Connect
- Cloud NAT
- SDP discovery
- SDP redaction
- SDP pseudonymization
- Format-preserving encryption (FPE)
- BigQuery access control
- Cloud Storage access control
- Cloud SQL access control
- Secret Manager fundamentals
- Secret Manager rotation and lifecycle
- Compute instance metadata protection
- Google default encryption
- Customer-managed encryption keys (CMEK)
- Cloud External Key Manager (EKM)
- Software vs hardware keys
- Creating and managing CMEK keys
- Creating and managing EKM keys
- Key rotation and revocation
- Key import
- Applying encryption methods
- Cloud Storage object lifecycle policies
- Confidential Computing concepts
- Enabling Confidential Computing
- AI/ML Security Threat Landscape
- Data Privacy Controls for AI/ML
- Model Security Controls
- Secure ML Lifecycle Management
- IaaS Security for Training Models
- PaaS Security for Training Models
- Gemini Enterprise Agent Platform Security Controls
- Privacy Controls for Gemini Enterprise Agents
- Monitoring and Auditing AI Workloads
- CI/CD Security Scanning
- Binary Authorization for GKE
- Binary Authorization for Cloud Run
- Automated VM Image Creation
- Automated Container Image Creation
- VM Patch Management Automation
- Cloud Security Posture Management
- Custom Organization Policies
- Custom Modules for Security Health Analytics
- Drift Detection at Scale
- Network Log Sources
- Network Log Analysis
- Logging Strategy Design
- Incident Response Lifecycle
- Secure Log Access
- Log Export to External Systems
- Audit Log Configuration
- Security Command Center Monitoring
- Compute, Data, Network, and Storage Technical Requirements
- Shared Responsibility Model in Google Cloud
- Assured Workloads for Compliance
- Organizational Policies for Compliance
- Access Transparency and Access Approval
- Data and Service Regionalization
- Google Cloud Environment Scope for Regulatory Compliance
- Mapping Compliance Requirements to Google Cloud Services
- Network and Access Segmentation for Compliance
- Audit Log Coverage for Compliance
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for PROFESSIONAL-CLOUD-SECURITY-ENGINEER, so none is invented.