Google Professional Cloud Security Engineer Full Course 2026

Explore on-prem data centers, hardware, virtualization, OS, networking, and storage, plus disaster recovery, then map them into infrastructure, platform, and application layers for cloud comparison.

Define cloud computing as on-demand, pay-as-you-go access to servers, storage, platform, and software. Explain service models from IaaS to AI as a service, including PaaS, SaaS, FaaS, containers, and databases.

Explore the IaaS, PaaS, and SaaS responsibility model, where the provider handles hardware and operating systems while users deploy apps, containers, and services like ServiceNow.

Learn how Google Cloud Platform groups services into compute, storage, databases, networking, security, AI/ML, data processing, and operations, with examples like Compute Engine, GKE, Cloud Run, and BigQuery.

Understand how regions and zones define boundaries and availability in GCP, with regions containing multiple zones. Learn about zonal, regional, multi-regional, and global resources.

Identify risks across OS, network, application, and database layers to guide security decisions, from outdated operating systems and kernel exploits to Wasp top 10, encryption, and access controls.

Learn Google's shared responsibility model across IaaS, PaaS, and SaaS, and how security duties shift from Google to the customer. Grasp who handles network, OS, web security, deployment, and access policy.

Learn how Google manages its security, from privileged access to data centers and Titan chips to hardened OS, plus default encryption and zero-trust networking within Google's own fiber network.

Create a free Google Cloud account with a Gmail id at cloud.google.com, and claim $300 in free credits for three months to explore services without charge.

Navigate the Google Cloud Console after first login, using the My First Project and the backup window to access services like BigQuery.

Explore how a project in Google Cloud serves as a logical boundary that isolates services and access between users, allowing multiple owned projects.

Explore how resource hierarchy, with organization, folders, and projects, separates departments and environments while enforcing production and non-production boundaries and access control.

Discover how to create a project, understand its place in the resource hierarchy, and use project name, ID, and number (globally unique) to manage resources in the console.

Learn to manage an enterprise Google Cloud account by organizing projects and folders under an organization, with domain k8spoint.in, and creating prod, non-prod, and website folders.

Learn how to create a Google Cloud VM instance, install nginx, expose http traffic, and access a running web server, while assessing security risks and basic configuration.

Identify risks of exposing a VM to the internet, including an external IP, unsecured port 80, SSH from anywhere on port 22, and broad service account permissions.

Understand what an identity service is and how it creates corporate email IDs under a single domain. Compare Google Identity with on-prem solutions like Microsoft Active Directory and Entra.

Leverage a centralized identity service for common authentication, robust access control, and centralized user and group management; enable multi-factor authentication and single sign-on with third‑party and corporate auditing.

Explore Google Cloud Identity as an identity as a service that can operate independently and integrate with Google Cloud and Google services, accounts inheriting admin access, domains, and users.

Set up cloud identity with your domain, create an admin account, and verify ownership via a txt record; choose the free version or Google Workspace for more features.

Explore cloud identity administration by logging into admin.google.com, then create users, organizational units, groups, and configure mfs and ssos within cloud identity.

Learn how to create and manage domain users in the admin console, organize them into organizational units, and enforce security with multi-factor authentication.

Create and manage a group in the admin console to streamline email lists and permissions. Understand group roles (owner, manager, member), join options, and posting rules to control access.

Configure two-step verification and mfa for specific organizational units, including third-party vendors, enforcing methods and trusted devices. Enable sso options and post-sso verification for enhanced security across the organization.

Understand how cloud identity enables single sign-on across Google Cloud, Google Workspace apps, and third-party services, with on-prem and cloud integrations through Google Cloud Directory Sync.

Explore implementing SSO with Google Cloud Identity as the source of truth or a third-party IDP, via the Google Admin console with SAML and OIDC.

Explore how Google Cloud Directory Sync keeps Cloud Identity in sync with on-prem Active Directory or LDAP, enabling on-prem source of truth with cloud access and SSO to Google Cloud.

Understand identity and access management (IAM) in Google Cloud. See how roles like developer, operations, and business determine access to resources: VM instance, DB instance, and bucket.

Identify who can access Google Cloud, including Google users, Cloud Identity users, groups, service accounts, and federation, and understand access scopes for applications and unauthenticated users.

Define permissions as unit tasks and roles as combinations of those permissions in Google Cloud. Use a database example to show admins and users with specific allowed actions.

Explore the Google Cloud Platform IAM console to view roles and permissions, filter by resource and permission, and understand basic, predefined, and custom roles in GCP.

Examine basic roles in Google Cloud, comparing legacy roles (owner, editor, viewer) with alpha roles (admin, writer, reader), and why they require careful use.

Understand predefined roles as collections of permissions created to serve a specific purpose, such as compute admin. Assign multiple predefined roles as needed; there are 2,024 roles in GCP.

Create custom roles to grant only necessary permissions, such as stopping and starting VM instances, by building on the compute viewer and applying the principle of least privilege.

Assign roles to principals in Google Cloud IAM, such as storage admin and compute viewer, at project, folder, and organization levels, and verify access with a sample user.

Learn to configure conditional access with IAM conditions, granting time-limited permissions and resource-based rules using and/or logic and the Common Expression Language editor.

Assign roles to a group in Cloud Identity and Cloud IAM to streamline permissions for developers, reducing repetitive work, easing onboarding and offboarding, and enforcing least privilege with group-based access.

Learn how to assign a viewer role across an organization, folders, and projects and how access propagates and inherits down the hierarchy for auditing.

Explore how granting access at the resource level, not the project level, enforces least privilege by restricting a group's access to specific buckets and resources.

Explore how to use IAM deny policies to prevent bucket deletion by a storage admin group, including creating a deny rule for storage.googleapis.com buckets delete and its precedence over allow.

Learn how organization policy enforces constraints across resources to control actions, regions, and security settings, complementing IAM and enabling guardrails, compliance, and cost control.

Create org policies at the organization level only, then enable or disable them at any level, and have them automatically propagate to all subfolders, subprojects, and nth-level components.

Explore how to locate and manage organization policies in the console, enable or disable them across org, folder, and project levels, and apply overrides with proper permissions.

Explore how to create and enforce a custom constraint with an org policy to restrict VM instance creation to zones containing Asia South, across all projects.

Create and enforce a custom constraint to restrict GCP compute instances to E2 machines only, using CEL conditions and YAML, with policy testing and organization-level management.

Learn how to disable and overwrite constraints at the prod folder or project level, manage policy inheritance, and permit end-to-end machines within a cloud organization.

Explore service accounts for machine-to-machine access in GCP, covering user-managed, default, and service agent types, creation, management, IAM permissions, and best-use scenarios.

Discover how enabling a service creates a default Compute Engine service account, the security risks of automatic IAM grants, and how to assign explicit roles like storage admin.

Learn how service agents, including compute engine and instance group agents, are Google managed internal helpers with extensive compute permissions that are not controllable and access cloud APIs internally.

create a service account for a project, review its email pattern (project-id.iam.gserviceaccount.com), and attach the storage object user role to enable a program to read a bucket.

Learn how to use service accounts by provisioning two VMs with different IAM permissions to access a storage bucket, and verify access with gcloud storage commands, applying least privilege.

Create a service account key to access cloud resources using a program. Choose JSON format for the key, download it, and manage keys by deleting or recreating if lost.

Use a service account key to access a cloud storage bucket by listing objects with a simple Python program.

Learn why service account keys pose security risks, avoid downloading them, and apply best practices like workload identity federation, key rotation, and org policy constraints with Google Secret for storage.

Learn how to impersonate a service account to eliminate a key file, using a two-account setup with a storage object user role and short-lived tokens.

Demonstrates how to impersonate a service account to access a storage bucket, grant the service account token creator role, and explains why project-level impersonation is a security risk.

Learn how to enable cross-project access by granting a backend project's service account storage object user permissions in the target project to access buckets across projects.

Explore workload identity federation, using SAML or OpenID Connect to obtain short-lived access tokens for authenticating external workloads with a Google service account, avoiding keys and impersonation overhead.

Set up workload identity federation by creating a pool, adding an AWS provider, configuring provider mapping, and granting GCP access via federated identities or service accounts.

Explore how workload identity federation links Kubernetes service accounts to Google Cloud service accounts in GKE, enabling pods to access cloud resources with inherited permissions.

Learn how to manage the life cycle of a service account by enabling, disabling, and deleting accounts to decommission unused services and prevent impersonation.

Explore asset inventory to view all resources across your project, folder, and organization in one place. Filter by resource type, download a csv, and review IAM policies at any level.

Explore policy analyzer to query permissions, roles, and principals across projects, enabling quick, customizable IAM reports and identifying who can impersonate service accounts or delete buckets.