Skip to content

GCP security

Securing Google Cloud the way GCP actually works: the resource hierarchy and org-policy guardrails, IAM with conditions and deny policies, killing service-account keys with Workload Identity Federation, VPC Service Controls perimeters against data exfiltration, Cloud KMS/EKM key custody, Security Command Center detection, and a rehearsed incident-response runbook.

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

IAM & resource hierarchy

3 lessonsTest yourself

01Resource hierarchy & org policyOrg → folders → projects, and inherited guardrails.30 min 02IAM, conditions & deny policiesAdditive allows, conditions, and enforceable denies.35 min 03Service accounts & impersonationKilling keys and scoping the escalation path.35 min

02

Network & VPC Service Controls

3 lessonsTest yourself

01VPC firewall & private accessSA-targeted rules, hierarchical policies, no public IPs.30 min 02Egress control & DNSDefault-deny outbound, Cloud NAT, DNS filtering.30 min 03VPC Service ControlsPerimeters that stop credentialed data exfiltration.35 min

03

Encryption, keys & secrets

3 lessonsTest yourself

01Cloud KMS & CMEKEnvelope encryption, key IAM, rotation, kill switch.35 min 02HSM, EKM & key custodyFIPS hardware and keys Google cannot read.30 min 03Secret Manager & rotationPer-secret IAM, runtime fetch, overlap rotation.30 min

04

Detection & Security Command Center

3 lessonsTest yourself

01Audit logs & immutable trailsAggregated sinks to a locked logging project.30 min 02Security Command CenterCSPM plus threat detection, org-wide.30 min 03Detection as code & responseLog metrics, Pub/Sub pipelines, auto-response.35 min

05

Workload identity & IR

3 lessonsTest yourself

01Workload Identity FederationKeyless CI and cross-cloud access, no static keys.35 min 02Org policy & landing zonesPreventive constraints and secure-by-default projects.30 min 03Incident response & forensicsContain, snapshot, revoke, hunt persistence.35 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam