Home
Google Cloud
PCSE
Syllabus

PCSE syllabus

5 domains and 71 topics, updated November 2026

Overview Syllabus Notes Patterns Revision Sample questions Practise

The Professional Cloud Security Engineer exam is about protecting Google Cloud organizations: identity and the resource hierarchy, network boundaries, data and keys, detection and response, and regulatory controls. The outline follows the five official sections, mapped onto the five study domains. Tick topics off as you cover them. Your ticks are saved in this browser.

This outline follows the official PCSE exam guide (PDF). Check it for the exact wording.

Configuring access

25%

Cloud Identity, service accounts, authentication, authorization and the resource hierarchy. About 25% of the exam.

Cloud Identity and federation

Syncing users and groups from Active Directory or LDAP with Google Cloud Directory Sync
Single sign-on with a third-party identity provider through SAML
Protecting and limiting super administrator accounts
Automating the user lifecycle: provisioning, suspension and deletion
Managing users and groups programmatically with the Admin SDK and APIs
Workforce Identity Federation pools, providers, attribute mapping and conditions

Service accounts

Hardening service accounts, including default service accounts
When a workload needs a service account and when it does not
Creating, disabling, deleting and authorizing service accounts
Securing, auditing and eliminating service account keys with organization policies and Policy Intelligence
Short-lived credentials: access tokens, ID tokens, signBlob and signJwt
Workload Identity Federation for AWS, Azure, OIDC and SAML workloads, and Workload Identity for GKE
Service account impersonation, delegation chains, actAs versus Token Creator

Authentication policy

Password policy and session length (reauthentication) for Google Cloud
SAML and OAuth: SSO profiles, consent screens, trusted and blocked apps, domain-wide delegation
Configuring and enforcing 2-step verification, security keys and enrollment periods

Authorization controls

Basic, predefined and custom roles, and separation of duties for privileged roles
Allow policies, Cloud Storage ACLs and uniform bucket-level access
IAM conditions and IAM deny policies for different identity types
Least privilege at organization, folder, project and resource level
Access Context Manager access levels and access policies
Policy Intelligence: Troubleshooter, Analyzer, Simulator and Recommender
Granting permissions through groups
Privileged Access Manager entitlements, grants, approvals and use cases

Resource hierarchy and organization policy

Managing folders and projects at scale with automation
Prebuilt, managed and custom organization policy constraints, dry run and inheritance
Using the hierarchy for access inheritance and permissions

Read the notes Practise this domain

Securing communications and boundary protection

22%

Perimeter controls, VPC segmentation, VPC Service Controls and private connectivity. About 22% of the exam.

Perimeter security

Cloud NGFW rules and policies, Identity-Aware Proxy, load balancers and Certificate Authority Service
Layer 7 inspection with Cloud NGFW Enterprise: firewall endpoints, security profiles, TLS inspection
Private versus public IP addressing and limiting external IPs
Cloud Armor security policies, preconfigured WAF rules, rate limiting and Adaptive Protection
Secure Web Proxy for controlled egress
Cloud DNS security: DNSSEC, policies, response policies and logging
Monitoring and restricting enabled APIs and API keys

Boundary segmentation

Security properties of VPC networks, VPC peering, Shared VPC and firewall rules
Network isolation and data encapsulation for N-tier applications
VPC Service Controls perimeters, access levels, ingress and egress rules, dry run

Private connectivity

Private connectivity between VPCs and projects: Shared VPC, peering, Private Service Connect
Encrypted private links to data centers with HA VPN and Cloud Interconnect
Private Google Access, Private Google Access for on-premises hosts, restricted Google access and Private Service Connect for APIs
Cloud NAT for outbound traffic

Read the notes Practise this domain

Ensuring data protection

23%

Sensitive data, secrets, encryption keys, confidential computing and AI workload security. About 23% of the exam.

Sensitive data and data services

Sensitive Data Protection: discovering and redacting PII, pseudonymization and format-preserving encryption
Restricting access to BigQuery, Cloud Storage and Cloud SQL
Secret Manager: versions, rotation, IAM and audit
Protecting compute instance metadata, OS Login and the metadata server

Encryption at rest, in transit and in use

Google default encryption versus CMEK versus Cloud EKM, and when each fits
Software versus hardware (Cloud HSM) keys
Key rotation, revocation, destruction and key import
Matching encryption methods to use cases, including CSEK and Autokey
Cloud Storage lifecycle and retention policies
Confidential Computing: Confidential VMs, GKE nodes and Confidential Space

Securing AI workloads

Security and privacy controls that protect data and models in AI and ML systems
Security requirements for IaaS-hosted versus PaaS-hosted model training
Security controls for Gemini Enterprise Agent Platform, including Model Armor

Read the notes Practise this domain

Managing operations and threat detection

19%

Pipeline and platform security automation, logging, network telemetry and Security Command Center. About 19% of the exam.

Automating infrastructure and application security

Automating CVE scanning in CI/CD with Artifact Analysis and Cloud Build
Binary Authorization for GKE and Cloud Run: policies, attestors, dry run, continuous validation
Automating hardened VM and container image creation and VM patch management
Policy and drift detection at scale: posture management, custom organization policies and Security Health Analytics custom modules

Logging, monitoring and detection

Network logs: Cloud NGFW logs, VPC Flow Logs, Packet Mirroring, Cloud IDS and Log Analytics
Designing an effective logging strategy
Logging, monitoring, responding to and remediating security incidents
Designing secure access to logs
Exporting logs to external security systems
Cloud Audit Logs and Data Access logs: types, defaults and viewer roles
Log sinks and aggregated sinks, buckets and retention
Configuring and monitoring Security Command Center tiers, detectors, mute rules and exports

Read the notes Practise this domain

Supporting compliance requirements

11%

Regulatory requirements mapped to Google Cloud controls. About 11% of the exam.

Regulatory and industry requirements

Working out technical needs for compute, data, network and storage
Shared responsibility and shared fate
Assured Workloads, organization policies, Access Transparency, Access Approval and data regionalization
Deciding which projects and services are in scope for a regulation
Mapping requirements to controls: segmentation, access, audit log coverage, retention

Read the notes Practise this domain