Google Cloud’s security model, world-scale infrastructure, and unique capability to innovate will help keep your organization secure and compliant.
2025 is the first year where we’ll genuinely see the second phase of AI in action with security.” – Sunil Potti. VP/GM, Google Cloud Security
To meet worldwide demand, a study by ISC2 estimated the cybersecurity workforce needs to grow by 145%. You can get started with security engineering in the cloud by understanding key risk mitigation and response tactics to potential threats such as DDoS attacks or phishing.
This Security in Google Cloud Platform course gives participants a broad study of security controls and techniques on Google Cloud. Security use cases covered include mitigation techniques for attacks at many points in a Google Cloud-based infrastructure, including distributed denial-of-service (DDoS) attacks, phishing attacks, and threats involving content classification and use.
Overview
Learn best practices in cloud security and how the Google Cloud security model can help protect your technology stack. Security Engineers actively assess existing Google Cloud implementations, identifying potential security issues, and prioritizing solutions.
This Google Cloud certification uses lectures, demos, and hands-on labs to teach you about a variety of Google Cloud security controls and techniques. You’ll explore the components of Google Cloud and deploy a secure solution on the platform. You’ll also learn how to mitigate attacks at several points in a Google Cloud-based infrastructure, including distributed denial-of-service attacks, phishing attacks, and threats involving content classification and use.
Explore more about cybersecurity certifications with our cybersecurity training and certifications guide.
Skills Covered
This course teaches participants the following skills:
- Identify the foundations of Google Cloud security
- Manage administration identities with Google Cloud
- Implement user administration with Identity and Access Management (IAM)
- Configure Virtual Private Clouds (VPCs) for isolation, security, and logging
- Apply techniques and best practices for securely managing Compute Engine
- Apply techniques and best practices for securely managing Google Cloud data
- Apply techniques and best practices for securing Google Cloud applications
- Apply techniques and best practices for securing Google Kubernetes Engine (GKE) resources
- Manage protection against distributed denial-of-service attacks (DDoS)
- Manage content-related vulnerabilities
- Implement Google Cloud monitoring, logging, auditing, and scanning solutions
Prerequisites
To get the most out of this course, participants should have:
- Prior completion of Google Cloud Platform Fundamentals: Core Infrastructure or equivalent experience
- Prior completion of Networking in Google Cloud Platform or equivalent experience
- Knowledge of foundational concepts in information security:
- Fundamental concepts: vulnerability, threat, attack surface confidentiality, integrity, availability
- Common threat types and their mitigation strategies
- Public-key cryptography
- Public and private key pairs
- Certificates Cipher types
- Key width Certificate authorities
- Transport Layer Security/Secure Sockets
- Layer encrypted communication
- Public key infrastructures Security policy
- Basic proficiency with command-line tools and Linux operating system environments
- Systems Operations experience, including deploying and managing applications, either on-premises or in a public cloud environment
- Reading comprehension of code in Python or JavaScript
Target Audience
This class is intended for the following job roles:
- Cloud information security analysts, architects, and engineers.
- Information security/cybersecurity specialists.
- Cloud infrastructure architects.
- Additionally, the course is intended for Google and partner field personnel who work with customers in those job roles.
- The course should also be useful to developers of cloud applications.
Module 01: Foundations of Google Cloud Security
- The approach of Google Cloud to security
- The shared security responsibility model
- Threats mitigated by Google and Google Cloud
- Access transparency
- Explain the shared security responsibility model of Google Cloud
- Describe how Google Cloud approaches security
- Recognize threats mitigated by Google and Google Cloud
- Identify Google Cloud’s commitments to regulatory compliance
Module 02: Securing Access to Google Cloud
- Cloud Identity
- Google Cloud Directory Sync
- Managed Microsoft AD
- Google authentication versus SAML-based SSO
- Identity Platform
- Authentication best practices
- Describe what Cloud Identity is and what it does
- Explain how Google Cloud Directory Sync securely syncs users and permissions between your on-premises LDAP or AD server and the cloud
- Explore and apply best practices for managing groups, permissions, domains, and administrators with Cloud Identity
- Demo: Defining Users with Cloud Identity Console
Module 03: Identity and Access Management (IAM)
- Resource Manager
- IAM roles
- Service accounts
- IAM and Organization policies
- Workload identity federation
- Policy Intelligence
- Identify IAM roles and permissions that can be used to organize resources in Google Cloud
- Explain the management-related features of Google Cloud projects
- Define IAM policies, including organization policies
- Implement access control with IAM
- Provide access to Google Cloud resources by using predefined and custom IAM roles
- Lab: Configuring IAM
Module 04: Configuring Virtual Private Cloud for Isolation and Security
- VPC firewalls
- Load balancing and SSL policies
- Cloud Interconnect
- VPC Network Peering
- VPC Service Controls
- Access Context Manager
- VPC Flow Logs
- Cloud IDS
- Describe the function of VPC networks
- Recognize and implement best practices for configuring VPC firewalls (both ingress and egress rules)
- Secure projects with VPC Service Controls
- Apply SSL policies to load balancers
- Enable VPC flow logging, and then use Cloud Logging to access logs
- Deploy Cloud IDS, and view threat details in the Google Cloud console
- Lab: Configuring VPC Firewalls
- Lab: Configuring and Using VPC Flow Logs in Cloud Logging
- Demo: Securing Projects with VPC Service Controls
- Lab: Getting Started with Cloud IDS
Module 05: Securing Compute Engine: Techniques and Best Practices
- Service accounts, IAM roles, and API scopes
- Managing VM logins
- Organization policy controls
- Shielded VMs and Confidential VMs
- Certificate Authority Service
- Compute Engine best practices
- Create and manage service accounts for Compute Engine instances (default and customer-defined)
- Detail IAM roles and scopes for VMs
- Explore and apply best practices for Compute Engine instances
- Explain the function of the Organization Policy Service
- Lab: Configuring, Using, and Auditing VM Service Accounts and Scopes
Module 06: Securing Cloud Data: Techniques and Best Practices
- Cloud Storage IAM permissions and ACLs
- Auditing cloud data
- Signed URLs and policy documents
- Encrypting with Customer-managed encryption keys (CMEK) and Customer-supplied encryption keys (CSEK)
- Cloud HSM
- BigQuery IAM roles and authorized views
- Storage best practices
- Storage best practices
- Use IAM permissions and roles to secure cloud resources
- Create and wrap encryption keys using the Compute Engine RSA public key certificate
- Encrypt and attach persistent disks to Compute Engine instances
- Manage keys and encrypted data by using Cloud Key Management Service (Cloud KMS) and Cloud HSM
- Create BigQuery authorized views
- Recognize and implement best practices for configuring storage options
- Lab: Using Customer-Supplied Encryption Keys with Cloud Storage
- Lab: Using Customer-Managed Encryption Keys with Cloud Storage and Cloud KMS
- Lab: Creating a BigQuery Authorized View
Module 07: Securing Applications: Techniques and Best Practices
- Types of application security vulnerabilities
- Web Security Scanner
- Threat: Identity and OAuth phishing
- Identity-Aware Proxy
- Secret Manager
- Recall various types of application security vulnerabilities
- Detect vulnerabilities in App Engine applications by using Web Security Scanner
- Secure Compute Engine Applications by using BeyondCorp Enterprise
- Secure application credentials by using Secret Manager
- Identify the threats of OAuth and Identity Phishing
- Lab: Identify Application Vulnerabilities with Security Command Center
- Lab: Securing Compute Engine Applications with BeyondCorp Enterprise
- Lab: Configuring and Using Credentials with Secret Manager
Module 08: Securing Google Kubernetes Engine: Techniques and Best Practices
- Types of application security vulnerabilities
- Web Security Scanner
- Threat: Identity and OAuth phishing
- Identity-Aware Proxy
- Secret Manager
- Explain the differences between Kubernetes service accounts and Google service accounts
- Recognize and implement best practices for securely configuring GKE
- Explain logging and monitoring options in Google Kubernetes Engine
Module 09: Protecting against Distributed Denial-of-Service Attacks (DDoS)
- How DDoS attacks work
- Google Cloud mitigations
- Types of complementary partner products
- Identify the four layers of DDoS Mitigation
- Identify methods Google Cloud uses to mitigate the risk of DDoS for its customers
- Use Google Cloud Armor to blocklist an IP address and restrict access to an HTTP Load Balancer
- Lab: Configuring Traffic Blocklisting with Google Cloud Armor
Module 10: Content-Related Vulnerabilities: Techniques and Best Practices
- Threat: Ransomware
- Ransomware mitigations
- Threats: data misuse, privacy violations, sensitive content
- Content-related mitigation
- Redacting Sensitive Data with the DLP API
- Discuss the threat of ransomware
- Explain ransomware mitigations strategies (backups, IAM, Cloud Data Loss Prevention API)
- Highlight common threats to content (data misuse; privacy violations; sensitive, restricted, or unacceptable content)
- Identify solutions for threats to content (classification, scanning, and redacting)
- Detect and redact sensitive data by using the Cloud DLP API
- Lab: Redacting Sensitive Data with the DLP API
Module 11: Monitoring, Logging, Auditing, and Scanning
- Security Command Center
- Cloud Monitoring and Cloud Logging
- Cloud Audit Logs
- Cloud security automation
- Explain and use the Security Command Center
- Apply Cloud Monitoring and Cloud Logging to a project
- Apply Cloud Audit Logs to a project
- Identify methods for automating security in Google Cloud environments
- Lab: Configuring and Using Cloud Monitoring and Cloud Logging
- Lab: Configuring and Viewing Cloud Audit Logs
Dates & Locations
November 10, 2026 - November 12, 2026
November 10, 2026 - November 12, 2026
February 10, 2027 - February 12, 2027
February 10, 2027 - February 12, 2027
May 10, 2027 - May 12, 2027
May 10, 2027 - May 12, 2027
August 23, 2027 - August 25, 2027
August 23, 2027 - August 25, 2027
November 22, 2027 - November 24, 2027
November 22, 2027 - November 24, 2027
Exam & Certification
Google Professional Cloud Security Engineer.
The Google Professional Cloud Security Engineer certification is one of the most highly sought-after certifications in the cloud security industry. With this certification, individuals can demonstrate a comprehensive set of skills and understanding of deploying, monitoring, and managing Google Cloud Platform security building blocks.
Professionals who earn this certification have proven their expertise and ability to build comprehensive and secure solutions that use Google Cloud Platform products and services. As the demand for cloud security continues to grow rapidly across industries, this certification will help equip individuals with the necessary skills to keep data safe and secure.
Training & Certification Guide
Frequently Asked Questions
Speak to a Training Consultant
All courses are HRD Claimable.
Get in touch with our team via the form or WhatsApp us on +6011-5119 6631
