Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 50 to 60 multiple choice and multiple select questions in 2 hours. Registration fee is $200 plus tax. Offered in English and Japanese, online proctored or at a test centre. Google reports pass or fail and doesn’t publish a passing score.
- Recommended: 3+ years of industry experience including 1+ year designing and managing solutions on Google Cloud. No prerequisites.
- Roughly two minutes per question. Don’t leave blanks. Flag and return.
- Section weights: configuring access ~25%, securing communications and boundary protection ~22%, ensuring data protection ~23%, managing operations ~19%, supporting compliance requirements ~11%.
- Official AI and supply chain topics now sit in these sections: AI workloads under data protection, Binary Authorization and image pipelines under operations.
How to read a question
Read the last sentence first, then look for the constraint words.
| The question says | Lean toward |
|---|---|
| Least privilege | Predefined or custom role at the lowest level, on a group |
| No keys, no long-lived credentials | Attached SA, impersonation, Workload Identity Federation |
| Temporary, just-in-time, approval | Privileged Access Manager |
| Prevent everywhere | Organization policy (or IAM deny for permissions) |
| Stop data exfiltration even with valid credentials | VPC Service Controls |
| Customer controls the key | CMEK. Key outside Google: Cloud EKM |
| Hardware key, FIPS 140-2 Level 3 | Cloud HSM |
| Least operational overhead | Managed, built-in feature (Autokey, SCC, Cloud Armor, Audit Manager) |
| Detect versus prevent | Detect: SCC, IDS, logs. Prevent: org policy, firewall, Binary Authorization |
Elimination: service account keys, basic roles, public IPs, project-wide Owner, and “disable the control” are almost always wrong. Answers that grant roles to individual users lose to groups. For Choose two, each answer should be a different part of one solution.
Identity quick facts
| Fact | Detail |
|---|---|
| GCDS | One-way, on-premises to Cloud Identity. Not SSO |
| SAML SSO | Authenticates only. Doesn’t create users |
| Workforce Identity Federation | People, no Cloud Identity accounts, org-level pool |
| Workload Identity Federation | Software outside Google, pool + provider + attribute condition |
| Access token lifetime | 1 hour default, up to 12 hours with org policy |
| actAs | serviceAccountUser: attach or run as an SA |
| Token Creator | Mint tokens and sign as an SA (impersonation) |
| Evaluation | Deny policies first, then allow. Allow is inherited and additive |
| Custom roles | Org or project level, 300 each, no folder-level |
| PAM | Entitlement, request, approval, time-bound binding, audit |
| Key org policies | iam.disableServiceAccountKeyCreation, iam.automaticIamGrantsForDefaultServiceAccounts, iam.allowedPolicyMemberDomains |
Network quick facts
| Fact | Detail |
|---|---|
| Firewall order | Org policy, folder policy, VPC rules / global policy, regional policy. Lower number wins. Implied: deny ingress, allow egress |
| Safer targets | Service accounts or secure tags, not network tags |
| IAP TCP range | 35.235.240.0/20 |
| restricted.googleapis.com | 199.36.153.4/30 (VPC-SC APIs only). private.googleapis.com is 199.36.153.8/30 |
| Cloud Armor | In front of the LB only. WAF, rate limit, Adaptive Protection, preview mode |
| Cloud IDS | Detects only. Cloud NGFW Enterprise blocks (IPS, TLS inspection with CA Service) |
| Secure Web Proxy | Managed explicit proxy for outbound, URL and TLS control |
| VPC peering | Non-transitive, no firewall sharing |
| Shared VPC | Host and service projects, compute.networkUser per subnet |
| PSC | Private access to a published service or Google APIs with your own IP |
| HA VPN | IPsec, 99.99% SLA with two interfaces. Interconnect is not encrypted by default (add MACsec or HA VPN over it) |
| VPC-SC | Perimeter + access levels + ingress/egress rules. Use dry run first |
Data and key quick facts
| Option | Key held by | Notes |
|---|---|---|
| Default | AES-256 envelope, automatic | |
| CMEK | You (Cloud KMS) | Rotation, revoke, audit |
| CMEK Cloud HSM | You (HSM) | FIPS 140-2 Level 3 |
| EKM | External manager | Key Access Justifications possible |
| CSEK | You, per request | Only Compute disks and Cloud Storage |
- Rotation creates a new version and does not re-encrypt old data. Destroy schedule defaults to 30 days. Imported keys rotate manually.
- Key admin (
cloudkms.admin) can’t encrypt. UsecryptoKeyEncrypterDecrypterfor use. Keep keys in a separate project and matching location. - DLP techniques: FPE and deterministic encryption are reversible. Hash, mask, redact, bucketing are not.
- BigQuery column control = policy tags. Row control = row access policy.
- Secret Manager:
secretAccessorper secret, rotation by Pub/Sub, enable Data Access logs to see reads. - Confidential VMs protect data in use. Shielded VMs protect boot integrity.
- Storage: uniform bucket-level access, public access prevention, Bucket Lock is irreversible.
Operations quick facts
| Fact | Detail |
|---|---|
| Admin Activity, System Event | Always on, 400 days in _Required |
| Data Access logs | Off by default (not BigQuery), not retroactive, need privateLogViewer |
_Default bucket |
30 days, adjustable. User buckets up to 3,650 days |
| Sinks | Need writer identity granted on the destination. Aggregated sinks use includeChildren. Not retroactive |
| SIEM export | Pub/Sub + Dataflow, or Google Security Operations |
| VPC Flow Logs | Per subnet, sampled (default 50%), flows only |
| Packet Mirroring | Full packets to a collector behind an ILB |
| SCC tiers | Standard (basic), Premium (threat detection, SHA, posture), Enterprise (multi-cloud, SOAR) |
| Binary Authorization | Deploy time, attestors with KMS keys, dry-run, break-glass, continuous validation |
| Artifact Analysis | Scan on push, on-demand scan, continuous re-scan, provenance |
| Patching | VM Manager patch jobs and deployments |
Compliance quick facts
- Google certifications cover Google’s layer only. You prove your own configuration.
- Assured Workloads = folder with regime controls (locations, services, keys, personnel). Doesn’t build VPC-SC.
- Access Transparency logs Google staff access. Access Approval lets you approve it. KAJ gates the external key by reason.
gcp.resourceLocationsblocks new resources in other locations. Not retroactive and not every service.- Retention proof: Data Access logs on, org aggregated sink, locked bucket.
- Audit evidence tools: Compliance Reports Manager, Audit Manager, SCC compliance dashboard.
Last checks before you click
- Does the answer meet every requirement, including cost and operational effort?
- Is it preventive where the question says prevent?
- Does it avoid keys, basic roles and public exposure?
- Is the control placed at the right level (organization, folder, project)?
- If two answers look alike, pick the one with less custom code.