Free study guide

Google Cloud Professional Cloud Security Engineer Study Guide

Google Cloud Certified - Professional Cloud Security Engineer

Google Cloud Professional Cloud Security Engineer is Google Cloud's professional-level certification for engineers who design, implement and manage secure workloads and infrastructure on Google Cloud. It covers identity and access, the resource hierarchy and policies, network boundary protection and private connectivity, data protection and encryption, securing AI workloads, security operations and monitoring, and compliance. Google recommends 3 or more years of industry experience, including more than 1 year designing and managing solutions on Google Cloud.

  • Professional level
  • 5 exam sections
  • 50 to 60 questions

This guide is free, with no sign-up. It explains every Google Cloud Professional Cloud Security Engineer exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 5chapters
  • 21topics
  • 6diagrams and exhibits
  • 1 h 55 minfast track
Start with Configuring access
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Configuring access7 topics · 38 min fast trackCloud Identity, service accounts, authentication, IAM and hierarchy.
  1. 1Cloud Identity, SSO and Workforce Identity Federation6 min
  2. 2Securing Service Accounts and Service Account Keys6 min
  3. 3Short-Lived Credentials, Impersonation and Workload Identity Federation6 min
  4. 4Password, Session, SAML, OAuth and 2-Step Verification5 min
  5. 5IAM Roles, ACLs, Conditions and Deny Policies5 min
  6. 6Access Context Manager, Policy Intelligence and PAM5 min
  7. 7Resource Hierarchy and Organization Policies5 min
Read the chapter overview →
2Securing communications and establishing boundary protection4 topics · 23 min fast trackCloud NGFW, IAP, Cloud Armor, VPC Service Controls and private access.
  1. 1Cloud NGFW, IAP, Load Balancers and Certificate Authority Service6 min
  2. 2Cloud Armor, Secure Web Proxy, Cloud DNS Security and API Restriction5 min
  3. 3VPC Segmentation, N-Tier Isolation and VPC Service Controls6 min
  4. 4Private Connectivity, Private Google Access and Cloud NAT6 min
Read the chapter overview →
3Ensuring data protection5 topics · 28 min fast trackSensitive Data Protection, secrets, Cloud KMS keys and AI security.
  1. 1Sensitive Data Protection, De-identification and Pseudonymization5 min
  2. 2Restricting Data Services, Secret Manager and Instance Metadata6 min
  3. 3Cloud KMS, CMEK, Cloud HSM and Cloud EKM6 min
  4. 4Encryption Use Cases, Object Lifecycle and Confidential Computing5 min
  5. 5Securing AI Workloads and Gemini Enterprise Agent Platform6 min
Read the chapter overview →
4Managing operations3 topics · 16 min fast trackCI/CD scanning, Binary Authorization, logs and Security Command Center.
  1. 1CI/CD Scanning, Binary Authorization, Image Hardening and Posture5 min
  2. 2Network Logs, Cloud IDS and a Secure Logging Strategy5 min
  3. 3Cloud Audit Logs, Log Sinks, Security Command Center and Incidents6 min
Read the chapter overview →
5Supporting compliance requirements2 topics · 10 min fast trackShared responsibility, scope, Assured Workloads, Access Approval and residency.
  1. 1Shared Responsibility, Compliance Scope and Control Mapping5 min
  2. 2Assured Workloads, Access Transparency, Access Approval and Residency5 min
Read the chapter overview →

Ready for more practice?

The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.