Google Cloud Professional Cloud Architect Designing for Security and Compliance Syllabus

Designing for Security and Compliance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Designing for Security and Compliance in Google Cloud Professional Cloud Architect, not a summary of it.

1. 1

   Identity and Access Management

   4 topics

   • IAM roles and policy structure
     • Primitive, predefined, and custom roles
     • Principle of least privilege
   • Service accounts and workload identity
     • Workload Identity Federation
     • Service account impersonation
   • Cloud Identity and directory federation
   • IAM Conditions and deny policies
2. 2

   Resource Hierarchy and Organization Controls

   4 topics

   • Organization, folders, and projects
     • Policy inheritance model
   • Organization policy constraints
   • Resource Manager and tagging
   • VPC Service Controls and perimeters
3. 3

   Data Protection and Encryption

   4 topics

   • Encryption at rest and in transit
   • Cloud KMS and key management
     • Customer-managed (CMEK) and customer-supplied (CSEK) keys
     • Cloud HSM and External Key Manager
   • Secret Manager
   • Sensitive Data Protection (DLP)
4. 4

   Network and Application Security

   4 topics

   • Cloud Armor and WAF policies
     • DDoS protection and rate limiting
   • Identity-Aware Proxy and BeyondCorp
   • Private Google Access and Private Service Connect
   • Certificate Manager and TLS
5. 5

   Compliance, Governance, and Threat Detection

   4 topics

   • Security Command Center
     • Threat and vulnerability findings
   • Compliance frameworks and Assured Workloads
   • Audit logging and Access Transparency
   • Penetration testing and shared responsibility

Designing for Security and Compliance flashcards for Google Cloud Professional Cloud Architect

18 of 61 cards from the Designing for Security and Compliance deck — real questions with worked answers.

1. In Google Cloud IAM, what are the three components of an IAM policy (role binding)?

   A principal (member: user, group, service account, or domain), a role (a collection of permissions), and the resource to which the binding is attached. Optionally an IAM Condition.

2. What are the three categories of IAM roles in Google Cloud, and how do they differ?

   Basic roles (Owner, Editor, Viewer) — broad, legacy, project-wide; Predefined roles — granular, Google-managed for specific services; Custom roles — user-defined sets of permissions tailored to least privilege.

3. What is the format of a Google Cloud IAM permission?

   service.resource.verb (e.g., compute.instances.delete or storage.objects.get).

4. How does IAM policy inheritance work in the Google Cloud resource hierarchy?

   Policies are inherited downward: a policy set at the organization applies to folders, projects, and resources beneath it. The effective policy on a resource is the union of its own policy plus all inherited ancestor policies.

5. What is the difference between a basic 'Editor' role and the principle of least privilege?

   Editor grants broad write access across most services, violating least privilege. Least privilege favors predefined or custom roles granting only the specific permissions a principal needs.

6. What is a Google Cloud service account and what two purposes does it serve?

   A special non-human identity used by applications/workloads. It serves as both an identity (a principal that can be granted IAM roles) and a resource (an object others can be granted access to impersonate).

7. What is the recommended alternative to downloading service account keys for workloads running on Google Cloud?

   Attach a service account directly to the resource (e.g., a VM or GKE workload) and use the metadata server / Application Default Credentials, avoiding long-lived key files.

8. What is Workload Identity Federation in Google Cloud?

   A mechanism that lets external identities (from AWS, Azure, or any OIDC/SAML provider) impersonate a Google service account using short-lived tokens, eliminating the need for exported service account keys.

9. What is GKE Workload Identity and why is it preferred?

   It binds a Kubernetes service account to a Google service account, letting pods authenticate to Google APIs without node-level keys. It is the recommended, most secure way for GKE workloads to access Google Cloud services.

10. What permission/role allows a principal to impersonate a service account by generating short-lived tokens?

    Service Account Token Creator (roles/iam.serviceAccountTokenCreator), which grants the iam.serviceAccounts.getAccessToken permission.

11. What is Cloud Identity and how does it relate to Google Workspace?

    Cloud Identity is a standalone Identity-as-a-Service (IDaaS) product providing managed user accounts, groups, and device/policy management — essentially Google Workspace identity features without the productivity apps.

12. What tool synchronizes users and groups from an on-premises Active Directory or LDAP to Cloud Identity?

    Google Cloud Directory Sync (GCDS), a one-way sync that provisions identities from the on-prem directory into Cloud Identity/Workspace.

13. In a federated SSO setup with Cloud Identity, which system acts as the IdP and which as the SP?

    With external federation, the third-party (e.g., Active Directory Federation Services / Okta) is typically the SAML Identity Provider (IdP) and Google acts as the Service Provider (SP), so authentication occurs against the external IdP.

14. What is an IAM Condition and what is it written in?

    An optional logic expression on a role binding that grants access only when the condition is true. It is written in Common Expression Language (CEL) and can test attributes like resource name, request time, or IP.

15. What is an IAM deny policy and how does it interact with allow policies?

    A deny policy lists denied permissions for principals; deny rules are evaluated before allow grants. If a request matches a deny rule, access is blocked regardless of any allow binding (deny takes precedence).

16. Give an example use case for an IAM Condition based on time.

    Granting temporary 'just-in-time' access: a binding with a condition like request.time < timestamp('2026-07-01T00:00:00Z') automatically expires access after that date.

17. What are the three levels of the Google Cloud resource hierarchy, from top to bottom?

    Organization (root node) → Folders (optional grouping, can nest) → Projects → Resources. The Organization is tied to a Cloud Identity/Workspace domain.

18. What is the purpose of a Google Cloud project?

    A project is the base-level organizing entity that groups resources, owns billing, enables APIs, and serves as a trust/quota boundary. Every resource belongs to exactly one project.

See more Designing for Security and Compliance flashcards →

Planning Designing for Security and Compliance for Google Cloud Professional Cloud Architect

Designing for Security and Compliance (Google Cloud Professional Cloud Architect) FAQ