GCP-PCSE

Google Cloud Professional Cloud Security Engineer (GCP-PCSE)

The Professional Cloud Security Engineer certification validates your ability to design and implement secure workloads and infrastructure on Google Cloud. This professional-level certification is designed for security engineers who configure and manage the security posture of Google Cloud environments. The exam covers configuring access within a cloud solution environment, managing operations within a cloud solution environment, configuring network security, ensuring compliance, and managing incident responses. Candidates are expected to have 3+ years of industry experience with at least 1 year designing and managing security solutions on Google Cloud. A deep understanding of IAM, network security, data protection, security operations, and regulatory compliance frameworks is essential for success.

Exam Details

Domain Weights

Study Tips

• Master IAM deeply: roles (basic, predefined, custom), policies, conditions, service accounts, Workload Identity Federation, and the principle of least privilege
• Understand the full encryption spectrum: Google-managed keys, CMEK, CSEK, Cloud KMS, Cloud HSM, and Cloud External Key Manager (EKM)
• Study Security Command Center (SCC) thoroughly: tiers (Standard vs Premium), findings, security health analytics, event threat detection, and container threat detection
• Know VPC Service Controls: perimeters, access levels, ingress/egress policies, bridge perimeters, and dry-run mode for testing
• Practice with organization policies and know the most common constraints: restricting external IPs, service account key creation, and resource locations
• Understand data loss prevention (DLP): inspection, de-identification, re-identification, and integration with Cloud Storage, BigQuery, and Datastore
• Study audit logging: Admin Activity, Data Access, System Event, and Policy Denied logs and their retention and configuration

Identity and Access Management (IAM)

Google Cloud IAM provides fine-grained access control to cloud resources. IAM follows the model of "who (principal) can do what (role/permissions) on which resource." Policies bind principals to roles at a specific scope in the resource hierarchy, and policies are inherited downward. Understanding IAM is the most critical topic for the security engineer exam, covering approximately 25% of the questions.

Service Account Security

Exam Tip: Workload Identity Federation is the recommended approach for authenticating external workloads to Google Cloud. It eliminates long-lived service account keys entirely. Know how to configure identity pools, providers, and attribute mappings for common external identity providers.

Cloud Identity and Authentication

Organization Policies

• constraints/compute.disableSerialPortAccess: Prevents serial port access to VMs; eliminates a potential attack vector for accessing VM consoles
• constraints/iam.disableServiceAccountKeyCreation: Blocks creation of user-managed SA keys; forces use of Workload Identity and attached SAs; critical for key hygiene
• constraints/compute.vmExternalIpAccess: Controls which VMs can have external IPs; allowlist specific VMs or deny all; reduces attack surface
• constraints/gcp.resourceLocations: Restricts where resources can be created; enforce data residency requirements; specify allowed regions or zones
• constraints/storage.uniformBucketLevelAccess: Enforces uniform bucket-level access on Cloud Storage; eliminates object-level ACLs; simplifies permissions management

Encryption Options on Google Cloud

Google Cloud encrypts all data at rest and in transit by default. Beyond the default encryption, customers can choose additional control over encryption keys using Cloud KMS, Cloud HSM, or Cloud External Key Manager. Understanding the encryption hierarchy and when to use each key management option is fundamental for the security engineer exam. The choice depends on compliance requirements, key custody preferences, and the level of control needed over the key lifecycle.

Cloud KMS Features

Exam Tip: Know the key destruction schedule in Cloud KMS: when a key version is scheduled for destruction, there is a 24-hour minimum waiting period (configurable up to 120 days) before it is actually destroyed. Once destroyed, data encrypted with that key version cannot be recovered. This is a critical compliance and data lifecycle concept.

Data Loss Prevention (DLP)

Secret Manager

• Purpose: Store and manage API keys, passwords, certificates, and other sensitive data; versioned secrets with automatic rotation support; fine-grained IAM access control per secret
• Encryption: Secrets encrypted with Google-managed keys by default; CMEK support for customer-managed encryption; regional or replicated secrets
• Access: Applications access secrets via API, gcloud CLI, or client libraries; integrate with Cloud Build, Cloud Run, Cloud Functions, and GKE; audit access via Cloud Audit Logs
• Rotation: Configure rotation schedules with Pub/Sub notifications; trigger Cloud Functions to generate and update new secret versions; no built-in rotation for external systems

Network Security Architecture

Network security on Google Cloud is implemented through multiple layers: VPC design, firewall rules and policies, load balancer security features, and network service perimeters. A defense-in-depth approach combines these controls to protect against both external threats and lateral movement within the network. The security engineer must understand how these layers interact and how to configure them for comprehensive protection.

VPC Service Controls

Exam Tip: VPC Service Controls prevent data exfiltration at the API level, not the network level. Even if someone has IAM permissions to copy data from BigQuery, VPC-SC can block the copy if the destination is outside the perimeter. Always use dry-run mode first to identify legitimate traffic that would be blocked before enforcing a perimeter.

Cloud Armor Security Policies

• Preconfigured WAF Rules: OWASP ModSecurity Core Rule Set covering SQL injection, cross-site scripting, remote code execution, local file inclusion, and more; sensitivity levels (1-4) control detection aggressiveness
• Custom Rules with CEL: Write custom security rules using Common Expression Language; match on headers, IP ranges, geographic location, request attributes, and more
• Rate Limiting: Throttle requests per client IP or per HTTP header value; return 429 Too Many Requests; configurable conform and exceed actions
• Adaptive Protection: ML-based anomaly detection for Layer 7 DDoS attacks; automatically generates suggested rules during attacks; available in Cloud Armor Managed Protection Plus
• Named IP Lists: Reference managed IP lists (e.g., known Tor exit nodes, specific CDN providers) in rules; simplifies policy management for dynamic IP ranges

Zero Trust Security

• Principle: Never trust, always verify; authenticate and authorize every request regardless of network location; eliminate the concept of a trusted internal network
• Identity-Aware Proxy (IAP): Proxies HTTP requests to applications; verifies user identity via Google Sign-In; checks IAM permissions per request; replaces VPN for application access
• Access Context Manager: Defines access levels based on device attributes (OS, patch level, disk encryption), IP address, user identity, and geographic location
• BeyondCorp Enterprise: Full zero-trust solution combining IAP, Access Context Manager, Endpoint Verification, and threat protection; continuous verification throughout session

Security Command Center (SCC)

Audit Logging

Compliance Frameworks

Exam Tip: Know the difference between SCC Standard and Premium tiers. Premium includes Event Threat Detection, Container Threat Detection, VM Threat Detection, compliance monitoring, and attack path simulation. Standard provides only basic security health analytics. Also understand that Assured Workloads enforces compliance controls at the organizational level.

Chronicle Security Operations

• SIEM Capability: Cloud-native security information and event management; ingest, store, and analyze security telemetry at scale; petabyte-scale retention; fixed-cost pricing model
• SOAR Capability: Security orchestration, automation, and response; automated playbooks for incident response; integrates with ticketing systems and communication tools
• Detection Engine: YARA-L rules for threat detection; correlate across multiple log sources; real-time and retroactive detection on historical data
• Threat Intelligence: Integration with Google Threat Intelligence, VirusTotal, and Mandiant; enriches alerts with context about known threats and indicators of compromise

Incident Response on Google Cloud

Security incident response on Google Cloud requires a combination of prevention, detection, investigation, containment, and remediation. The security engineer must understand how to use Google Cloud tools to detect threats, investigate their scope, contain the damage, and implement corrective measures. A well-defined incident response plan, regularly tested through tabletop exercises and simulations, is essential for minimizing the impact of security incidents.

Common Security Incident Scenarios

Forensic Investigation Tools

• Cloud Logging Analysis: Query audit logs with advanced filters; export to BigQuery for SQL-based analysis across large log volumes; retain logs beyond default retention periods using log sinks to Cloud Storage
• VM Disk Snapshots: Create snapshots of compromised VM disks for forensic analysis; attach to a separate forensic analysis VM; never analyze on the compromised instance itself
• VPC Flow Logs: Analyze network traffic patterns; identify lateral movement; correlate with firewall rule logs; export to BigQuery for time-based analysis of communication patterns
• Chronicle Timeline: Build a timeline of events across multiple data sources; correlate log entries from Cloud Logging, VPC Flow Logs, and third-party sources; search historical data for indicators of compromise
• Access Transparency Logs: View logs of Google staff accessing your data for support purposes; provides visibility into Google's access to your resources; required for certain compliance frameworks

Exam Tip: For incident response questions, always think in terms of the IR lifecycle: detect, investigate, contain, remediate, and learn. Know which Google Cloud tools map to each phase. Also understand that Access Transparency logs and Key Access Justifications provide visibility into when Google accesses your data and why.