Google Cloud Professional Cloud Security Engineer — Fundamentals Study Guide

Security in the cloud isn't just a checkbox — it's a layered strategy that protects your data, infrastructure, and users from threats both external and internal. As a Google Cloud Security Engineer, you'll need to understand how services like IAM, VPC, KMS, and Cloud Armor work together to create a defense-in-depth posture. This guide walks through the core concepts you'll encounter in Quiz 1.

---

Networking Security: VPC, Firewall, and Shared VPC

Virtual Private Cloud (VPC)

A VPC is your private, isolated network within Google Cloud. Think of it like a walled office building — you control who enters, who can move between floors, and what exits the building.

Primary benefits of VPC:

Logical isolation of resources from other Google Cloud customers

Fine-grained control over IP ranges, subnets, and routing

Global by default (subnets are regional, but the VPC spans regions)

Firewall Rules

Firewall rules act as security guards at the door — they decide what traffic is allowed in or out of your VPC based on IP ranges, ports, and protocols.

# Example: Allow HTTPS traffic to web servers
name: allow-https
direction: INGRESS
priority: 1000
targetTags: ["web-server"]
allow:
  - protocol: tcp
    ports: ["443"]
sourceRanges: ["0.0.0.0/0"]

Key concepts:

Rules are stateful — if inbound traffic is allowed, the response is automatically permitted

Lower priority numbers = higher precedence

Default deny-all rule exists implicitly

Shared VPC

Shared VPC lets a host project share its VPC network with service projects. This is ideal for organizations that want centralized network control while allowing teams to deploy resources independently.

VPC Service Controls

VPC Service Controls create a security perimeter around Google Cloud APIs (like Cloud Storage or BigQuery) to prevent data exfiltration — the unauthorized transfer of data outside your organization. Even if credentials are stolen, data cannot leave the defined perimeter.

---

Identity and Access Management (IAM)

Principle of Least Privilege

The principle of least privilege means granting users and services *only* the permissions they need to do their job — nothing more. If a service only reads from a bucket, it should never have write or delete permissions.

IAM Roles

Service Accounts

A service account is an identity for applications and VMs — not humans. Best practices:

Use dedicated service accounts per application

Grant minimal roles

Avoid using the default compute service account for sensitive workloads

Rotate keys regularly or use workload identity instead of key files

Organization Policy

Organization Policies enforce guardrails at scale — for example, restricting which regions resources can be deployed in, or preventing public IPs on VMs. These apply across your entire organization hierarchy.

---

Encryption and Key Management

Encryption In Transit and At Rest

Google Cloud encrypts data at rest by default using AES-256. For data in transit, use HTTPS/TLS (SSL) to protect data moving between clients and servers or between services.

Cloud KMS (Key Management Service)

Cloud KMS lets you create, manage, rotate, and destroy cryptographic keys centrally. You can use:

Google-managed keys — automatic, zero configuration

Customer-managed keys (CMEK) — you control via Cloud KMS

Customer-supplied keys (CSEK) — you provide your own keys

Secret Manager

Secret Manager stores sensitive configuration values like API keys, passwords, and certificates — not encryption keys. Think of KMS as the locksmith and Secret Manager as the safe.

# Store a secret
echo -n "my-db-password" | gcloud secrets create db-password --data-file=-
Access a secret in code (Python)
from google.cloud import secretmanager
client = secretmanager.SecretManagerServiceClient()
response = client.access_secret_version(name="projects/my-proj/secrets/db-password/versions/latest")
print(response.payload.data.decode("UTF-8"))

---

Application Security: Cloud Armor, IAP, and Load Balancing

Cloud Armor and WAF

Cloud Armor is Google's DDoS protection and Web Application Firewall (WAF) service. It sits in front of your HTTP(S) Load Balancer and:

Blocks volumetric DDoS attacks

Filters malicious traffic using WAF rules (OWASP Top 10)

Supports IP restriction — allow or deny specific IP ranges

HTTPS Load Balancing and SSL

Google's HTTPS Load Balancer terminates SSL/TLS at the edge, distributing traffic to healthy backends. Always use managed SSL certificates for automatic renewal.

Identity-Aware Proxy (IAP)

IAP enforces authentication and authorization at the application layer — before traffic reaches your app. It verifies the user's Google identity and checks IAM permissions, replacing traditional VPN access for internal tools.

---

Auditing, Logging, and Incident Response

Cloud Audit Logs

Cloud Audit Logs record who did what, where, and when across your GCP environment:

Admin Activity logs — always on, free

Data Access logs — must be enabled, can be verbose

System Event logs — Google-generated actions

Cloud Monitoring and Logging

Use Cloud Logging to aggregate logs and Cloud Monitoring to set alerts on suspicious activity (e.g., unusual IAM changes or spike in denied firewall requests).

Security Scanner and Vulnerability Assessment

Cloud Security Scanner automatically crawls web applications to detect vulnerabilities like XSS, mixed content, and outdated libraries — a lightweight vulnerability assessment tool for App Engine and GKE apps.

Compliance and Incident Response

Google Cloud supports compliance frameworks (PCI DSS, HIPAA, SOC 2) through built-in controls. When an incident occurs:

Detect — via alerts and audit logs

Contain — revoke credentials, update firewall rules

Investigate — query audit logs

Remediate — patch, rotate secrets, update policies

---

Key Takeaways

VPC + Firewall + Shared VPC form the foundation of network isolation; use VPC Service Controls to prevent data exfiltration across API boundaries.

IAM + Least Privilege + Service Accounts ensure that humans and applications only have the permissions they need — use predefined or custom roles, never basic roles in production.

Cloud KMS encrypts keys; Secret Manager stores secrets — use CMEK for compliance-sensitive workloads and always enforce HTTPS/TLS for data in transit.

Cloud Armor provides DDoS and WAF protection at the load balancer level; combine with IAP to enforce identity-based access to internal applications.

Cloud Audit Logs are your forensic trail — enable Data Access logs for sensitive services, and build monitoring alerts to support rapid incident response.