Domain 3: Designing for Security and Compliance (~17.5%)

This domain tests your ability to design secure architectures that meet compliance requirements. The v6.1 update adds AI security (Model Armor, Sensitive Data Protection for AI workloads) and expands software supply chain security.

3.1 Designing for Security

Resource Hierarchy and IAM

Google Cloud's resource hierarchy determines how IAM policies are inherited:

Organization (domain-level)
  └── Folders (departments, teams, environments)
       └── Projects (billing boundary, resource container)
            └── Resources (VMs, buckets, datasets)

Key rule: IAM policies are additive only — you cannot remove a permission granted at a higher level. A user granted Editor at the folder level has Editor on every project in that folder.

Exam Trap: You cannot use a deny policy at a lower level to override an allow policy from a higher level using standard IAM. Use IAM Deny Policies (separate mechanism) to explicitly deny specific permissions regardless of allow policies.

IAM Roles

Separation of duties — critical for the exam:

• No single person should have both iam.serviceAccountAdmin and iam.serviceAccountKeyAdmin
• Separate the roles that create resources from those that manage access to them
• Use Organization Policy constraints to enforce boundaries

Exam Trap: Primitive roles (Owner, Editor, Viewer) should almost never be the answer. The exam strongly favors predefined roles with least privilege. If a question asks how to grant "minimal permissions," a primitive role is wrong.

Authentication Methods

Service account best practices:

• Prefer attached service accounts (metadata server) over service account keys
• Use Workload Identity on GKE — maps Kubernetes SAs to Google Cloud SAs
• Disable default Compute Engine and App Engine service accounts (too permissive)
• Use short-lived credentials via generateAccessToken when possible

Exam Trap: Default service accounts have the Editor role. The exam expects you to know this is overly permissive and that best practice is to create custom service accounts with minimal permissions.

Workload Identity Federation

Enables external identities (AWS IAM, Azure AD, OIDC providers, SAML) to access Google Cloud resources without service account keys:

1. Create a Workload Identity Pool
2. Add a Provider (AWS, Azure AD, OIDC, SAML)
3. Map external attributes to Google Cloud attributes
4. Grant IAM roles on the service account to the federated identity

Key benefit: Eliminates long-lived service account keys for cross-cloud workloads.

VPC Service Controls

VPC Service Controls create security perimeters around Google Cloud resources to prevent data exfiltration:

Exam Trap: VPC Service Controls protect against data exfiltration at the API level, not at the network level. They complement (don't replace) firewall rules. A user with valid IAM permissions can still be blocked by VPC Service Controls if they're outside the perimeter.

Organization Policies

Organization Policy Service enforces constraints across the resource hierarchy:

Policies are inherited down the hierarchy. Override is possible at lower levels if allowed by the constraint type (list constraints support merging, boolean constraints support override).

Identity-Aware Proxy (IAP)

IAP provides context-aware access to applications without a VPN:

• Verifies user identity AND device context before granting access
• Works with App Engine, Compute Engine (via load balancer), GKE
• Supports BeyondCorp zero-trust model
• Uses OAuth 2.0 for authentication
• Integrates with Access Context Manager for device posture checks

Exam Trap: IAP replaces VPN for application access in zero-trust architectures. If a question asks about secure access to internal web apps without VPN, IAP is the answer.

Cloud Armor

Cloud Armor provides WAF and DDoS protection:

Cloud Armor attaches to external HTTP(S) load balancers and external proxy load balancers only. It does not protect internal load balancers.

Encryption

Cloud KMS key management:

Key rotation: Automatic rotation is supported. Old key versions are retained for decryption but new data uses the primary version.

Exam Trap: Default encryption (Google-managed) is always on — you cannot disable it. CMEK adds customer control over key lifecycle. CSEK means Google never stores the key. Know the trade-offs: CSEK offers maximum control but key loss = permanent data loss.

Secret Manager

Secret Manager stores API keys, passwords, certificates:

• Automatic versioning — pin to specific version or use latest
• IAM-based access control (per-secret granularity)
• Automatic rotation via Cloud Functions
• Regional and multi-regional replication policies
• Audit logging of all access

Securing AI (NEW in v6.1)

Security Command Center (SCC)

Security Command Center is Google Cloud's centralized security and risk management platform. It provides visibility into security posture, threat detection, and compliance monitoring across your organization.

Key features for the exam:

• Security Health Analytics: Identifies misconfigurations (public buckets, open firewall rules, unencrypted disks)
• Event Threat Detection: Detects threats in real-time from Cloud Logging data (cryptomining, malware, data exfiltration attempts)
• Container Threat Detection: Monitors GKE for suspicious container behavior (reverse shells, unexpected binaries)
• Attack path simulation: Identifies paths an attacker could take to reach high-value resources

Exam Trap: SCC Standard is free but limited to misconfiguration detection. SCC Premium adds threat detection (ETD) and compliance monitoring. If a scenario asks about detecting active threats (not just misconfigurations), the answer requires SCC Premium or Enterprise tier.

Access Context Manager

Access Context Manager defines fine-grained, attribute-based access policies. It is the policy engine behind VPC Service Controls access levels and IAP context-aware access.

Access Context Manager integrates with:

• VPC Service Controls: Defines who can cross a service perimeter
• IAP: Defines context requirements for application access
• Chrome Enterprise Premium: Device trust assessment

Chrome Enterprise Premium

Formerly BeyondCorp Enterprise. Extends zero-trust to endpoints:

• Device trust assessment (managed, encrypted, patched)
• URL filtering and malware protection
• Data loss prevention in the browser
• Integrates with IAP for context-aware access

Software Supply Chain Security

Exam Trap: Binary Authorization enforces that only attested (signed) images deploy to GKE or Cloud Run. It does NOT scan for vulnerabilities — that's Container Analysis / Artifact Registry scanning. They work together but are separate services.

3.2 Designing for Compliance

Compliance Frameworks

Shared Responsibility Model

Cloud DLP / Sensitive Data Protection

Sensitive Data Protection (formerly Cloud DLP) inspects and transforms sensitive data:

Supported data sources: Cloud Storage, BigQuery, Datastore, and any text/image via API.

Cloud Audit Logs

Exam Trap: Data Access logs are OFF by default (except for BigQuery, which has them on by default). You must explicitly enable them. They can generate high volume and cost. Admin Activity logs are always on and free.

Data Residency and Sovereignty

Assured Workloads creates compliance-controlled environments:

• Enforces data residency via organization policies
• Restricts personnel access by nationality (for government workloads)
• Supports FedRAMP, IL4/IL5, CJIS, ITAR, and regional compliance
• Automatic guardrails — prevents misconfiguration that would violate compliance

Exam Trap: Assured Workloads is the answer when questions ask about meeting government compliance requirements (FedRAMP, IL4) on Google Cloud. It's not just a label — it enforces actual technical controls.

Audit Readiness

Preparing for compliance audits on Google Cloud:

1. Enable Data Access logs for all sensitive services
2. Export logs to Cloud Storage (long-term retention) and BigQuery (analysis)
3. Use Access Transparency to see when Google staff access your data
4. Configure Access Approval to require your approval before Google support access
5. Maintain asset inventory with Cloud Asset Inventory
6. Run Security Command Center for continuous security posture assessment
7. Document all controls, exceptions, and risk acceptances

Exam Traps — Quick Reference

References

• IAM Overview
• Resource Hierarchy
• VPC Service Controls
• Cloud KMS Concepts
• Default Encryption at Rest
• Compliance Offerings
• Sensitive Data Protection Overview
• Cloud Audit Logs
• Binary Authorization
• Identity-Aware Proxy
• Cloud Armor Overview
• Organization Policy Service
• Workload Identity Federation
• Secret Manager
• Assured Workloads