Chapter 4 of 5 · Google Cloud Professional Cloud Security Engineer
Managing operations
CI/CD scanning, Binary Authorization, logs and Security Command Center.
- 3topics
- 16 minfast track
- 1diagrams and exhibits
- 19%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1CI/CD Scanning, Binary Authorization, Image Hardening and PostureAutomate CVE scanning in CI/CD, enforce Binary Authorization on GKE and Cloud Run, harden and patch images, and detect policy…5 min
- 2Network Logs, Cloud IDS and a Secure Logging StrategyAnalyze VPC Flow Logs, firewall and Cloud NGFW logs, Packet Mirroring and Cloud IDS in Log Analytics, and plan a logging strategy…5 min
- 3Cloud Audit Logs, Log Sinks, Security Command Center and IncidentsConfigure Cloud Audit Logs and Data Access logs, export with aggregated sinks to a SIEM, monitor Security Command Center and…Diagram6 min
About this chapter
What this chapter covers
Managing operations is about 19% of the Google Cloud Professional Cloud Security Engineer exam. It covers keeping an environment secure day after day: automating security in pipelines and images, and seeing, detecting and responding to what happens.
It covers automation (CVE scanning in CI/CD, Binary Authorization for GKE and Cloud Run, hardened and patched VM and container images, and policy and drift detection with custom organization policies and Security Health Analytics custom modules) and logging, monitoring and detection (network logs, Packet Mirroring, Cloud IDS, Log Analytics, logging strategy, secure access to logs, Cloud Audit Logs, log sinks and aggregated sinks, export to external systems, Security Command Center and incident response).
The exam has 50 to 60 multiple choice and multiple select questions in 2 hours. Questions here often ask which log, detector or pipeline step would have caught a problem, or how to collect evidence across many projects at once.
How the topics fit together
Prevention in the pipeline reduces what reaches production. Logging and detection catch the rest, and good log design decides whether an incident can be investigated at all.
Distinguish prevent from detect. Organization policies, Binary Authorization and Cloud NGFW Enterprise block; Security Health Analytics, Cloud IDS and Event Threat Detection report.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and code examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.