Chapter 2 of 5 · Google Cloud Professional Cloud Security Engineer
Securing communications and establishing boundary protection
Cloud NGFW, IAP, Cloud Armor, VPC Service Controls and private access.
- 4topics
- 23 minfast track
- 1diagrams and exhibits
- 22%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Cloud NGFW, IAP, Load Balancers and Certificate Authority ServiceConfigure Cloud NGFW policies and layer 7 inspection, IAP for apps and SSH, load balancer TLS, private CAs and private versus…6 min
- 2Cloud Armor, Secure Web Proxy, Cloud DNS Security and API RestrictionProtect apps with Cloud Armor WAF rules, filter egress with Secure Web Proxy, secure Cloud DNS with DNSSEC, and monitor and…5 min
- 3VPC Segmentation, N-Tier Isolation and VPC Service ControlsSegment Google Cloud networks with VPC design, peering, Shared VPC and firewall rules, isolate N-tier apps, and stop exfiltration…6 min
- 4Private Connectivity, Private Google Access and Cloud NATConnect VPCs, data centers and Google APIs privately with Shared VPC, peering, HA VPN, Interconnect, Private Google Access, PSC…Diagram6 min
About this chapter
What this chapter covers
Securing communications and establishing boundary protection is about 22% of the Google Cloud Professional Cloud Security Engineer exam. It covers how traffic reaches your workloads, how workloads are separated from each other, and how data moves privately between networks and Google APIs.
It covers perimeter security (Cloud NGFW rules and policies, layer 7 inspection, IAP, load balancers, Certificate Authority Service, Cloud Armor, Secure Web Proxy, Cloud DNS security and API restriction), boundary segmentation (VPC design, peering, Shared VPC, N-tier isolation and VPC Service Controls) and private connectivity (HA VPN, Cloud Interconnect, Private Google Access, Private Service Connect and Cloud NAT).
The exam has 50 to 60 multiple choice and multiple select questions in 2 hours. Questions here are usually architecture scenarios: a traffic flow, a threat or a compliance rule, and several designs of which only one blocks the risk without breaking the flow.
How the topics fit together
Each layer stops a different kind of attack. Firewalls and Cloud Armor handle packets and requests, while VPC Service Controls handles access to Google APIs, which firewalls cannot see.
Watch for the words "exfiltration" and "even with valid credentials". They point to VPC Service Controls, not to firewall rules or IAM alone.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and code examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.