Google Professional Cloud Security Engineer Certification

Explore how regions and zones organize Google Cloud data centers to optimize latency and enable disaster recovery across multiple global locations.

Explore Google cloud security services, including data encryption, key management, identity aware proxy, binary authorization, and data loss prevention API, plus VPC networking and security command center for secure resources.

Explore how Google secures your apps and data with GCP security, tools, and services across multiple layers. Understand the shared responsibility model, compliance standards, and how Google protects infrastructure.

Discover how Google secures GCP infrastructure with in-house hardware, restricted data-center access, centralized IAM, encryption at rest and in transit, IAP, data loss prevention, and Cloud Armor.

Explain the shared responsibility model for Google Cloud, detailing security duties split between Google and users across on-prem, IaaS, PaaS, and SaaS.

Explore cloud identity concepts and how to interact with Google Cloud Platform using identities: Google account, service account, Google Workspace, Cloud Identity domain, and Google Groups, creating accounts via accounts.google.com.

Explore Google Workspace and cloud identity domain, including domain verification, user management, and the admin console for organization-wide control and access to Gmail, Meet, and Drive.

Set up a free Cloud Identity Domain in Google Cloud Identity, manage users in the admin console, and sign up with a business domain.

Verify your domain in the Google admin console using TXT verification, DNS management, and propagation checks, then create users and attach cloud identity to Google Cloud.

Create a free trial Google Cloud Platform account by attaching Cloud Identity to an organization, set up billing, and start your $300 credit for 90 days.

Learn to create a GCP free tier account using a Google personal account, secure $300 credit for 90 days, and explore 20+ free products in the cloud dashboard.

Explore the Google Admin Console to manage users and groups, enforce security policies, and review reports and subscriptions for Cloud Identity and Google Cloud Platform.

Add users via the Google admin console, choosing manual or bulk CSV upload, assign organizational units like Learn Cloud Academy and HR, and configure passwords and sign-in options.

Create and configure Google groups in the Admin console, manage owners and members, and set join policies; then assign group roles in Google Cloud Platform to scale access.

Configure password policy and enforce two-step verification in the Google admin console to secure Google Workspace. Set minimum length, reuse rules, reset frequency, and device trust options.

Learn how Google Cloud Directory Sync (GCDS) synchronizes on-premises LDAP or Active Directory users and groups to Google Cloud Identity, a one-directional flow that excludes emails, calendars, and files.

Explore how SAML enables single sign-on by using an organization’s identity provider with Google as the service provider, enabling login to Google Cloud Platform after successful authentication.

Organize Google Cloud resources with a hierarchical structure: organization, folders for departments and teams, and projects for dev, test, and production environments, with resources tied to each project.

Explore creating folders and projects in GCP, building a nested organization with finance and HR folders, and provisioning resources for teams A and B.

Explore Google Cloud organization policies and enforce constraints like disabling service account creation at the organization level, with hierarchical scope and inherit policy guidance.

Learn to enforce uniform bucket-level access with organization policies in Google Cloud Storage at the project level, switching from fine-grain to uniform access and understanding policy inheritance.

Learn how to enforce the organization policy to skip default network creation when enabling the Compute Engine API, and use a custom VPC instead of the default network.

Explore identity and access management in Google Cloud, defining who can do what on which resources with identities, roles, and policy bindings.

Explore primitive roles in Google Cloud Platform, including owner, editor, and reader, and learn why project-level access breaks the principle of least privilege; compare permissions and impact on resources.

Explore predefined Google Cloud Platform roles, from storage admin to storage object roles, and learn how specific permissions map to each role for secure access control.

Assign primitive roles to users at the project level using IAM bindings, explore basic roles like viewer and editor, and ensure needed permissions (e.g., compute.instance.create) by adjusting roles.

Learn to assign predefined roles to users in Google Cloud IAM, granting granular access to services like cloud storage and cloud SQL, and verify policy propagation across resources.

Learn how to create a custom role in Google Cloud Platform by combining, removing, or adding permissions from predefined roles to allow object creation but prevent deletion or bucket creation.

Create a custom GCS role with permissions, test in alpha/beta, and propagate to users so they can list buckets and upload objects but cannot delete or create buckets before GA.

Assign roles at organization and folder levels to see hierarchical inheritance, where child permissions reflect parent access. When adding multiple roles at the same level, the union of permissions applies.

Explore Google Cloud privilege access manager for just-in-time elevation and entitlements. Learn to use organization accounts, audit logs, and the requester–approver workflow for limited-time access.

Perform a complete hands-on exercise with privilege access manager. Create an entitlement, assign requester and approver, set maximum duration, and configure notifications in Google Cloud IAM & Admin.

Explore hands-on privileged access manager workflows to grant and revoke temporary entitlements, assign project viewer roles, and manage requester approvals from IAM and organization accounts within Google Cloud.