Professional Cloud Security Engineer Certification

Professional Cloud Security Engineer

Section 1: Configuring access (~27% of the exam)

1.1 Managing Cloud Identity. Considerations include:

• Configuring Workforce Identity Federation
• Automating the user lifecycle management process
• Managing a super administrator account
• Administering user accounts and groups programmatically
• Setting up Google Cloud Directory Sync and third-party connectors

1.2  Managing service accounts. Considerations include:

• The topics covered include safeguarding and maintaining service accounts, including default service accounts;
• Recognising situations that call for service accounts;
• Setting up, enabling, and approving service accounts;
• Safeguarding, auditing, and reducing the use of service account keys;
• Managing and generating temporary credentials;
• Configuring Workload Identity Federation
• Controlling service account impersonation.

1.3 Managing authentication. Considerations include:

• Configuring and implementing two-step verification;
• establishing a password and session management policy for user accounts;
• configuring Security Assertion Markup Language (SAML) and OAuth;

1.4 Managing and implementing authorization controls. Considerations include:

• Separating responsibilities and controlling privileged roles using Identity and Access Management (IAM) roles and permissions
•  Handling IAM and access control list (ACL) permissions
• Giving permissions to various identity types, via IAM deny policies and IAM conditions    ● Creating identity roles at the level of the organisation, folder, project, and resource
• Setting up Access Context Manager
• Using Policy Intelligence for enhanced permission management
• Managing permissions via groups

1.5 Defining resource hierarchy. Considerations include:

• Establishing and overseeing large-scale organisations
• Managing policies for projects, resources, and organisation folders
• Utilising resource hierarchy for permits inheritance and access control

Section 2: Securing communications and establishing boundary protection (~21% of the exam)

2.1 Designing and configuring perimeter security. Considerations include:

• Setting up firewall rules, hierarchical firewall policies, load balancers, Identity-Aware Proxy (IAP), and Certificate Authority Service are examples of network perimeter controls.
•  Distinguishing between IP addresses that are private and public
• Setting up web application firewall (Google Cloud Armour)
•  Setting up Cloud DNS security settings
• Implementing Secure Web Proxy
• Monitoring and limiting defined APIs continuously

2.2 Configuring boundary segmentation. Considerations include:

• Setting up firewall rules, VPC peering, shared VPCs, and security features of a VPC network
• Setting up network isolation and data encapsulation for N-tier applications
• Setting up VPC service controls

2.3 Establishing private connectivity. Considerations include:

• Creating and setting up private connectivity for Google Cloud projects (Private Google Access for on-premises hosts, VPC peering, and shared VPC networks)
•  Creating and setting up private connections (HA-VPN, IPsec, MACsec, and Cloud Interconnect) between data centres and VPC networks
•  Setting up restricted Google access, private service connect, private Google access, and private Google access for on-premises hosts to establish private connectivity between VPC and Google APIs
•  Enabling outgoing traffic via Cloud NAT

Section 3: Ensuring data protection (~20% of the exam)

3.1 Protecting sensitive data and preventing data loss. Considerations include:

• Protecting and managing compute instance metadata;
• Ensuring continuous discovery of sensitive data (structured and unstructured);
• Configuring pseudonymization;
• Configuring format-preserving encryption;
• Limiting access to BigQuery, Cloud Storage, and Cloud SQL datastores;
• Securing secrets with Secret Manager;

3.2 Managing encryption at rest, in transit, and in use. Considerations include:

• Determine the applications for Cloud HSM, Cloud External Key Manager (EKM), customer-managed encryption keys (CMEK), and Google default encryption
  Making and keeping track of CMEK and EKM encryption keys.
• Implementing use cases for Google’s encryption technique
  Setting up object lifecycle rules for cloud storage.
•  Enabling Data Privacy Protection

3.3 Planning for security and privacy in AI. Considerations include:

• Setting up security measures for AI/ML systems (such as guarding against inadvertent data or model exploitation)
•  Establishing security specifications for training models hosted on PaaS and IaaS platforms.

Section 4: Managing operations (~22% of the exam)

4.1 Automating infrastructure and application security. Considerations include:

• Automating security scanning using a continuous integration and delivery (CI/CD) pipeline to find Common Vulnerabilities and Exposures (CVEs).
  Setting up Binary Authorisation to Protect Cloud Run or GKE Clusters
• Automating patch management, maintenance, hardening, and virtual machine image building
•  Automating patch management, maintenance, hardening, verification, and container image creation
•  Scaling up policy management and drift detection (custom organisation policies and custom Security Health Analytics modules)

4.2 Configuring logging, monitoring, and detection. Considerations include:

• Setting up and examining network logs (Firewall Rules Logging, VPC flow logs, Packet Mirroring, Cloud Intrusion Detection System [Cloud IDS], Log Analytics)
• Creating a strategy for efficient logging
• Recording, tracking, addressing, and resolving security incidents
• Creating a secure log-accessible environment
• Exporting logs to external security systems
• Setting up and reviewing Google Cloud audit logs and data access logs
• Setting up log exports (log sinks and aggregated sinks)
• Setting up and overseeing Security Command Centre

Section 5: Supporting compliance requirements (~10% of the exam)

5.1 Determining regulatory requirements for the cloud. Considerations include:

• Identifying issues with computation, data, networks, and storage
• Assessing the shared responsibility model
• Setting up security settings in cloud environments to meet compliance needs (data and service regionalisation)
  Determine which Google Cloud environment is in scope for regulatory compliance.
• Limiting computation and data for regulatory compliance (Assured Workloads, organisational policies, Access Transparency, Access Approval).