Trust and Security with Google Cloud · Topic 2 of 5
Security Terms, Encryption and Identity
Key cloud security terms, encryption at rest, in transit and in use, authentication versus authorization versus auditing, and SecOps terms for Cloud Digital Leader.
- 4 min
- Least privilege: only the access needed. Zero trust: verify every request.
- DLP finds and protects sensitive data.
- Encryption at rest, in transit and in use; Confidential Computing protects data in use.
What it is
This page covers the security vocabulary the exam uses: terms such as least privilege and zero trust, how encryption protects data in its three states, the difference between authentication, authorization and auditing, and the basic security operations (SecOps) terms.
How it works
Key security terms
| Term | Meaning |
|---|---|
| Data loss prevention (DLP) | Finding sensitive data (such as card numbers) and preventing it from leaking, for example by masking it |
| Privileged access | Powerful access such as administrator rights; it needs extra protection and monitoring |
| Least privilege | Give each person or service only the access needed for its job, and nothing more |
| Zero-trust architecture | Never trust by network location; verify every user, device and request every time |
| Security by default | Products ship with secure settings already on, such as encryption enabled by default |
| Security posture | The overall strength of an organization's security at a point in time |
| Cyber resilience | The ability to keep operating during an attack and recover quickly afterwards |
| Firewall | Rules that allow or block network traffic |
| Encryption | Turning readable data into unreadable ciphertext using a key |
| Decryption | Turning ciphertext back into readable data with the right key |
Zero trust replaces "inside the network means trusted". Every request is checked on identity and context, wherever it comes from.
Encryption in three states
| State | Meaning | How it is protected in Google Cloud |
|---|---|---|
| At rest | Stored data on disks, databases, backups | Google Cloud encrypts customer data at rest by default; customers can also manage their own keys |
| In transit | Data moving across networks | Encrypted connections such as TLS, and Google encrypts traffic between its facilities |
| In use | Data being processed in memory | Confidential Computing keeps data encrypted even while it is processed |
Encryption protects confidentiality: even if someone obtains the data, they cannot read it without the key. Managing keys well is as important as encrypting.
Authentication, authorization and auditing
| Concept | Question | Examples |
|---|---|---|
| Authentication | Who are you? Prove your identity | Password plus multi-factor authentication (MFA) or two-step verification (2SV) such as a security key or phone prompt |
| Authorization | What are you allowed to do? | Identity and Access Management (IAM) roles granting specific permissions on specific resources |
| Auditing | What did you do, and when? | Audit logs recording who accessed or changed what |
MFA and 2SV require a second proof beyond a password, so a stolen password alone is not enough. IAM in Google Cloud grants roles (collections of permissions) to principals (users, groups, service accounts) on resources, which is how least privilege is applied.
SecOps terms
| Term | Meaning |
|---|---|
| Security operations (SecOps) | The people, processes and tools that monitor, detect and respond to threats |
| Security posture | How well protected the environment is: configurations, vulnerabilities, controls |
| Threat intelligence | Information about attackers, their methods and indicators of attack, used to anticipate and detect threats |
| Threat response | The actions taken to contain, remove and recover from a detected threat |
A worked scenario
An accounting firm moves client files to Google Cloud. Data is encrypted at rest by default and in transit with TLS. Staff sign in with 2SV (authentication). IAM gives each accountant access only to their own clients' folders (authorization and least privilege). Audit logs record every access for regulators (auditing). Access is checked on identity and device for every request, following zero trust.
How the exam asks about this
- "Verify the user's identity with a second factor." Authentication with MFA or 2SV.
- "Grant only the permissions needed." Least privilege with IAM.
- "Protect data while it is being processed." Encryption in use with Confidential Computing.
- "Record who changed a resource." Auditing with audit logs.
- "Never trust a request because it comes from inside the network." Zero trust.
What to remember for the exam
- Least privilege: only the access needed. Zero trust: verify every request.
- DLP finds and protects sensitive data.
- Encryption at rest, in transit and in use; Confidential Computing protects data in use.
- Authentication proves identity; authorization grants permissions; auditing records actions.
- IAM grants roles to principals on resources.
- SecOps terms: posture, threat intelligence, threat response.
Authentication and authorization are different. Logging in successfully does not mean you may do everything.
Common mistakes
Swapping authentication and authorization. Authentication is who; authorization is what.
Thinking encryption at rest protects data in memory. Data in use needs Confidential Computing.
Granting broad roles for convenience. It breaks least privilege and increases breach impact.
Check yourself
What is the difference between authentication and authorization?
Authentication proves who you are; authorization decides what you are allowed to do.
Which Google Cloud technology protects data while it is being processed?
Confidential Computing.
What does least privilege mean?
Giving each user or service only the access needed for its job and nothing more.
Topic 2 of 5 in Trust and Security with Google Cloud
Test yourself on Trust and Security with Google Cloud
The full Google Cloud Digital Leader question bank has 512 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.