Google Cloud Professional Cloud Architect Designing for Security and Compliance Syllabus

What are the two main types of Organization Policy constraints?

List constraints (allow or deny specific values, e.g., allowed locations or service accounts) and Boolean constraints (enforce a true/false rule, e.g., disable serial port access).

Name a commonly used Organization Policy constraint for restricting where resources can be created.

constraints/gcp.resourceLocations — a list constraint that limits resource creation to specified regions/locations, useful for data residency/compliance.

What is Google Cloud Resource Manager?

The service that programmatically manages the resource hierarchy — creating and managing organizations, folders, and projects, and the IAM policies and metadata attached to them.

What are Resource Manager tags and how do they differ from labels?

Tags are key-value pairs (defined org-wide) that can be referenced in IAM Conditions and Organization Policies for conditional enforcement. Labels are simpler key-value metadata used mainly for organization, billing, and filtering — not for policy decisions.

What is VPC Service Controls and what problem does it solve?

A security feature that defines a service perimeter around Google-managed resources (like Cloud Storage, BigQuery) to mitigate data exfiltration, preventing data from moving outside the perimeter even by authorized identities with valid credentials.

In VPC Service Controls, what is the difference between a perimeter bridge and an access level?

A perimeter bridge allows controlled communication of projects across two separate perimeters. An access level (from Access Context Manager) defines conditions (IP range, device, identity) under which requests from outside the perimeter are permitted in via ingress rules.

What are ingress and egress rules in a VPC Service Controls perimeter?

Ingress rules define which external sources/identities may access resources inside the perimeter; egress rules define which outside resources/services principals inside the perimeter may reach. They provide fine-grained boundary control.

By default, is data at rest in Google Cloud encrypted, and with what?

Yes. All data at rest is automatically encrypted by default using Google-managed encryption keys (AES-256), with no action required by the customer.

Compare GMEK, CMEK, and CSEK for encryption at rest in Google Cloud.

GMEK (Google-Managed Encryption Keys): default, Google handles keys. CMEK (Customer-Managed): you create/manage keys in Cloud KMS, controlling rotation and access. CSEK (Customer-Supplied): you provide your own raw key material with each API call; Google does not store it.

How is data encrypted in transit within Google Cloud and across the internet?

In transit, data is protected with TLS. Traffic between Google data centers is encrypted, and traffic to Google APIs uses TLS. Application-layer and ALTS (Application Layer Transport Security) protect internal service-to-service communication.

What is Cloud KMS and what key types can it manage?

Cloud Key Management Service is a centralized cloud service to create, use, rotate, and destroy cryptographic keys. It supports symmetric keys, asymmetric keys (encryption and signing), and integration with HSM and external key managers.

What is the difference between Cloud KMS software, Cloud HSM, and Cloud EKM protection levels?

SOFTWARE: keys protected in software. HSM: keys generated and used in FIPS 140-2 Level 3 certified hardware security modules. EKM (External Key Manager): key material stays in a third-party external key manager outside Google.

What is key rotation in Cloud KMS and why does it matter?

Rotation creates a new key version that becomes primary for new encryption while old versions remain to decrypt existing data. Automatic rotation on a schedule limits the amount of data protected by a single key version, improving security.

What is the hierarchy of objects in Cloud KMS?

Project → Key Ring (regional grouping of keys) → CryptoKey → CryptoKey Versions. The key ring's location is fixed at creation and determines where keys reside.

What is Secret Manager and what does it store?

A managed service for storing, versioning, and accessing sensitive data such as API keys, passwords, certificates, and database credentials, with IAM-controlled access and audit logging. Secrets are encrypted at rest.

How does versioning work in Secret Manager?

Each secret has immutable versions; you reference a specific version number or 'latest'. Versions can be enabled, disabled, or destroyed, allowing controlled rotation and rollback of secret values.

What is Sensitive Data Protection (formerly Cloud DLP) used for?

To discover, classify, and protect sensitive data (PII like credit card numbers, SSNs, emails). It supports inspection, and de-identification techniques such as masking, tokenization, and redaction.

What are infoTypes in Sensitive Data Protection (DLP)?

Predefined or custom detectors that identify specific categories of sensitive data (e.g., CREDIT_CARD_NUMBER, US_SOCIAL_SECURITY_NUMBER, EMAIL_ADDRESS) during inspection scans.

What de-identification technique in DLP replaces sensitive values with reversible surrogate tokens?

Format-preserving tokenization / pseudonymization (cryptographic tokenization, e.g., FPE or deterministic encryption), which can be reversed with the proper key, unlike irreversible redaction or masking.

What is Google Cloud Armor and at which layer does it primarily operate?

A network security service providing DDoS protection and a Web Application Firewall (WAF) at the edge, integrated with external HTTP(S) load balancers (Layer 7), filtering traffic before it reaches backends.

What pre-configured WAF rules does Cloud Armor offer to address common web attacks?

Pre-configured rules based on the OWASP ModSecurity Core Rule Set, protecting against SQL injection (SQLi), cross-site scripting (XSS), local/remote file inclusion, and other OWASP Top 10 threats.

In a Cloud Armor security policy, how are rules evaluated?

Rules are evaluated in ascending priority order (lower number = higher priority). The first matching rule's action (allow/deny/rate-limit) is applied, and evaluation stops.

What is Identity-Aware Proxy (IAP) and what does it secure?

IAP enforces identity-based access control to applications and VMs without a VPN. It verifies user identity and context at the application layer, granting access only to authorized principals via the IAP-secured Web App User role.

How does IAP embody Google's BeyondCorp / zero-trust model?

BeyondCorp shifts access controls from the network perimeter to individual users and devices. IAP enforces this by authenticating and authorizing each request based on identity and context, so trust is never granted merely by network location.

What is Private Google Access and what does it enable?

It allows VM instances that have only internal IP addresses (no external IP) to reach Google APIs and services (like Cloud Storage) through Google's network, rather than over the public internet.

What is Private Service Connect (PSC)?

A capability that lets you privately consume Google APIs or services published by other VPCs/producers using internal IP endpoints within your VPC, keeping traffic on Google's backbone and avoiding external IPs.

What is Certificate Manager used for in Google Cloud?

To acquire, store, and deploy TLS/SSL certificates (Google-managed or self-managed) for load balancers and services, supporting large numbers of certificates and wildcard/SAN certs for HTTPS termination.

What is Security Command Center (SCC) and what is its purpose?

Google Cloud's centralized security and risk management platform that provides asset inventory, vulnerability and misconfiguration detection, threat detection, and compliance monitoring across the organization.

What are the two main service tiers of Security Command Center and how do they differ?

Standard tier: free, basic findings (Security Health Analytics, asset discovery). Premium/Enterprise tier: paid, adds Event Threat Detection, Container Threat Detection, compliance reporting, attack path simulation, and advanced threat detection.

What is Assured Workloads in Google Cloud?

A service that lets you create and manage workloads meeting specific compliance and sovereignty requirements (e.g., FedRAMP, CJIS, IL4, data residency) by enforcing controls like personnel/data location and approved products automatically.

What are the four types of Cloud Audit Logs in Google Cloud?

Admin Activity logs (config changes, always on), Data Access logs (reads/writes of data, mostly off by default), System Event logs (Google system actions), and Policy Denied logs (access blocked by security policy).

Which Cloud Audit Log type is enabled by default and cannot be disabled?

Admin Activity audit logs — they record administrative/config-changing actions, are always written, and incur no charge. Data Access logs, by contrast, must be explicitly enabled (except for BigQuery).

What is Access Transparency and how does it differ from audit logs?

Access Transparency provides logs of actions taken by Google personnel (e.g., support staff) when they access your content, with justification. It logs Google-side access, whereas Cloud Audit Logs record actions by your own users and services.

What is Access Approval in Google Cloud?

A control that requires your explicit approval before Google support or engineering personnel can access your data for support purposes, giving customers a gate over administrative access by Google.

Under the shared responsibility model, who is responsible for 'security OF the cloud' vs 'security IN the cloud'?

Google (the provider) is responsible for security OF the cloud — physical infrastructure, hardware, and managed services. The customer is responsible for security IN the cloud — data, IAM configuration, access controls, and OS/application patching (varies by service type).

How does the shared responsibility split change between IaaS, PaaS, and SaaS?

Moving from IaaS to SaaS, the customer's responsibility decreases and Google's increases. In IaaS the customer manages OS/patching; in PaaS Google manages the OS/runtime; in SaaS Google manages nearly everything except data and access.

Does Google require advance notification before you conduct penetration testing on your own Google Cloud resources?

No. Google does not require you to notify or request permission to pentest your own projects, but you must comply with the Acceptable Use Policy and Terms of Service and only test resources you own.

What is the difference between authentication and authorization in the context of GCP IAM?

Authentication verifies WHO a principal is (proving identity, e.g., via Cloud Identity or a service account key/token). Authorization determines WHAT that authenticated principal is allowed to do (governed by IAM policies and roles).

What is Access Context Manager and how does it support security perimeters?

A service that defines and manages access levels based on attributes like IP ranges, device policy, and geolocation. These access levels are consumed by VPC Service Controls and IAP Conditions to enforce context-aware access.

What is the recommended approach to centrally enforce that no Compute Engine VM can have an external/public IP address?

Apply the Organization Policy constraint constraints/compute.vmExternalIpAccess (a list constraint set to deny all) at the org or folder level, blocking external IP assignment across all projects beneath it.

What is envelope encryption as used by Cloud KMS?

Data is encrypted with a Data Encryption Key (DEK), and the DEK is itself encrypted (wrapped) by a Key Encryption Key (KEK) stored in Cloud KMS. Only the wrapped DEK is stored alongside the data; the KEK never leaves KMS.