Chapter 3 of 6 · Google Cloud Professional Cloud Architect
Designing for security and compliance
IAM and hierarchy, keys and secrets, perimeters and access, supply chain, AI security and regulations.
- 5topics
- 19 minfast track
- 1diagrams and exhibits
- 17.5%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1IAM, Resource Hierarchy and Separation of DutiesDesigning IAM with least privilege, the organization, folder and project hierarchy, organization policies, separation of duties…3 min
- 2Encryption Keys, Secrets and Data ProtectionDefault encryption, CMEK with Cloud KMS, Cloud HSM, Cloud EKM, CSEK, Secret Manager and Sensitive Data Protection for discovery…4 min
- 3Perimeters, Context-Aware and Remote AccessVPC Service Controls against exfiltration, context-aware access, IAP, hierarchical firewall policies and keyless access with…Diagram4 min
- 4Software Supply Chain and Securing AISecuring builds and deployments with Artifact Registry, Binary Authorization and Policy Controller, and securing AI apps with…4 min
- 5Designing for Compliance and AuditsMeeting health, children's and data privacy laws, data sovereignty, card data and PII rules, SOC 2 and audits with Assured…4 min
About this chapter
What this chapter covers
This section is worth about 17.5 percent of the exam, and security appears inside many questions from other sections too. It asks you to protect identities, data, networks, software and AI systems, and to show auditors that rules are met.
It covers designing for security (IAM, the resource hierarchy, separation of duties, key management, secrets, VPC Service Controls, context-aware access, organization policies, hierarchical firewall policies, secure remote access, the software supply chain and securing AI) and designing for compliance (health, children's and data privacy laws, sovereignty, card data and PII, certifications such as SOC 2, and audit logs).
How the topics fit together
Expect stems with contracts and regulations: "keys must live outside Google", "Google support access only from EU personnel", "no standing admin access", "no public buckets, evidence for PCI DSS". Each phrase maps to a specific control.
Separate preventing from detecting. Organization policies, VPC Service Controls and IAM prevent; audit logs, Security Command Center findings and alerts detect. Choose the one the stem asks for.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Google Cloud Professional Cloud Architect question bank has 877 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.