Chapter 1 of 5 · Google Cloud Professional Cloud Security Engineer
Configuring access
Cloud Identity, service accounts, authentication, IAM and hierarchy.
- 7topics
- 38 minfast track
- 2diagrams and exhibits
- 25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Cloud Identity, SSO and Workforce Identity FederationManage Cloud Identity for Google Cloud: Directory Sync, SAML SSO, super admin protection, user lifecycle automation and Workforce…6 min
- 2Securing Service Accounts and Service Account KeysSecure Google Cloud service accounts: default accounts, when to use them, creating, disabling and authorizing them, and auditing…6 min
- 3Short-Lived Credentials, Impersonation and Workload Identity FederationReplace service account keys with short-lived tokens, impersonation and Workload Identity Federation for AWS, Azure, GitHub…Diagram6 min
- 4Password, Session, SAML, OAuth and 2-Step VerificationSet password and session policies for Google Cloud users, configure SAML SSO and OAuth app access, and enforce 2-Step…5 min
- 5IAM Roles, ACLs, Conditions and Deny PoliciesApply least privilege on Google Cloud with predefined and custom IAM roles, groups, ACLs, IAM conditions, deny policies and…5 min
- 6Access Context Manager, Policy Intelligence and PAMUse Access Context Manager access levels, Policy Intelligence analysis and Privileged Access Manager for just-in-time access on…5 min
- 7Resource Hierarchy and Organization PoliciesDesign the Google Cloud resource hierarchy, manage folders and projects at scale, and apply predefined and custom organization…Diagram5 min
About this chapter
What this chapter covers
Configuring access is about 25% of the Google Cloud Professional Cloud Security Engineer exam, the largest section. It covers who can reach Google Cloud and what they can do once they are in.
It covers identity (Cloud Identity, Google Cloud Directory Sync, SSO, super admin protection, user lifecycle and Workforce Identity Federation), service accounts (default accounts, keys, short-lived credentials, impersonation and Workload Identity Federation), authentication (password and session policy, SAML, OAuth and 2-Step Verification), authorization (IAM roles, ACLs, conditions, deny policies, Access Context Manager, Policy Intelligence and Privileged Access Manager) and the resource hierarchy with organization policies.
The exam has 50 to 60 multiple choice and multiple select questions in 2 hours. Most questions here describe an access requirement and ask for the control that meets it with the least privilege and the least ongoing effort.
How the topics fit together
Identity comes first, because every grant names a principal. The hierarchy comes last but shapes everything: where you grant a role or set a policy decides how far it reaches.
When two answers both work, prefer the one without long-lived credentials or standing privilege: federation over keys, impersonation over direct grants, PAM over permanent admin roles.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and code examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.