Trust and Security with Google Cloud · Topic 5 of 5
Security Products and Customer Trust
Google Cloud security products from VPC, VPN and Cloud Armor to IAP and Confidential Computing, and how Google earns trust with audits, sovereignty and residency.
- 4 min
- VPC isolates networks; firewalls filter traffic; Cloud VPN is encrypted over the internet; Cloud Interconnect is private and dedicated.
- Cloud Armor: DDoS and web attack protection.
- IAP: identity and context-based access to apps without a VPN.
What it is
Beyond threat detection, Google Cloud offers products that protect networks, applications, identities and data. The exam lists them and expects you to match each to a use case. It also asks how Google Cloud earns and maintains customer trust: transparency, third-party audits, digital sovereignty, data residency and compliance resources.
How it works
Network and connectivity security
| Product | What it does | Use case |
|---|---|---|
| Virtual Private Cloud (VPC) | A private, isolated network for your Google Cloud resources | Separate production from development; keep databases off the internet |
| Firewalls | Rules that allow or deny traffic to and from resources | Allow web traffic to web servers only |
| Cloud VPN | Encrypted tunnel over the internet between your network and Google Cloud | Connect an office to Google Cloud securely at low cost |
| Cloud Interconnect | Private, high-bandwidth connection to Google's network, either direct (Dedicated Interconnect) or through a service provider (Partner Interconnect) | Large, steady traffic between a data center and Google Cloud |
| Cloud Armor | Protects internet-facing applications from DDoS attacks and web attacks such as SQL injection | Keep an online shop up during an attack |
VPN uses the public internet with encryption. Interconnect is a private connection that does not cross the public internet and carries more bandwidth.
Identity, data and operations security
| Product | What it does | Use case |
|---|---|---|
| Identity and Access Management (IAM) | Controls who can do what on which resource | Apply least privilege |
| Identity-Aware Proxy (IAP) | Lets users reach internal applications based on identity and context, without a VPN | Give remote staff secure access to an internal app |
| Sensitive Data Protection | Discovers, classifies and de-identifies (for example masks) sensitive data | Find card numbers in files and mask them |
| Confidential Computing | Keeps data encrypted while it is processed in memory | Process highly sensitive data with extra protection |
| Certificate Manager | Obtains, deploys and manages TLS certificates | Keep website certificates valid and renewed |
| Cloud Logging | Collects and stores logs, including audit logs | Investigate who changed what |
How Google Cloud earns trust
| Practice | What it means |
|---|---|
| Transparency reports | Google publishes how it handles government requests for data, and gives customers visibility into access, such as logs when Google staff access customer content (Access Transparency) |
| Third-party audits | Independent auditors verify Google Cloud against standards such as ISO 27001 and SOC 2 |
| Compliance resources | Google publishes certifications and audit reports customers can download for their own compliance, for example through Compliance Reports Manager |
| Digital sovereignty | Customers keep control over their data, operations and software, for example through sovereign cloud offerings and customer-managed encryption keys |
| Data residency | Customers choose the region where data is stored to meet local rules |
Google's commitments also include that customer data belongs to the customer, and Google does not use it for advertising.
A worked scenario
A European insurer moves its customer portal to Google Cloud. Cloud Armor protects it from DDoS attacks, staff reach internal tools through IAP instead of a VPN, Sensitive Data Protection masks policy numbers in support logs, and offices connect over Cloud VPN. For regulators, it stores data in EU regions (data residency), downloads Google's third-party audit reports, and uses customer-managed keys for digital sovereignty.
How the exam asks about this
- "Protect a website from DDoS and SQL injection." Cloud Armor.
- "Give remote employees access to an internal app without a VPN." Identity-Aware Proxy.
- "Find and mask personal data in datasets." Sensitive Data Protection.
- "Store data in a specific country." Data residency, by choosing the region.
- "How can a customer verify Google's security claims?" Third-party audit reports and certifications.
What to remember for the exam
- VPC isolates networks; firewalls filter traffic; Cloud VPN is encrypted over the internet; Cloud Interconnect is private and dedicated.
- Cloud Armor: DDoS and web attack protection.
- IAP: identity and context-based access to apps without a VPN.
- Sensitive Data Protection: find and de-identify sensitive data.
- Confidential Computing: data in use; Certificate Manager: TLS certificates.
- Trust: transparency, third-party audits, compliance resources, digital sovereignty, data residency.
Data residency is about where data is stored. It is set by choosing locations, not by encryption alone.
Common mistakes
Choosing Cloud VPN when the need is high, steady bandwidth. Cloud Interconnect fits.
Thinking IAP is a firewall. IAP decides access by user identity and context.
Treating compliance as Google's job alone. Google provides certified infrastructure and reports; the customer must still use it compliantly.
Check yourself
Which product protects internet-facing apps from DDoS and web attacks?
Cloud Armor.
Which product gives users access to internal apps based on identity, without a VPN?
Identity-Aware Proxy (IAP).
How can an organization meet a rule that data must stay in its country?
Store the data in a Google Cloud region in that country (data residency).
Topic 5 of 5 in Trust and Security with Google Cloud
Test yourself on Trust and Security with Google Cloud
The full Google Cloud Digital Leader question bank has 512 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.