Cloud
Security
Engineer

Why identity drift becomes access drift

Module 1 showed that a grant can travel down thousands of resources. That makes the identity behind the grant just as important as its scope. If a departed employee survives in a forgotten directory, perfect IAM roles still protect the wrong person.

Cloud Identity is Google’s directory layer for users and groups. In an enterprise, the usual goal is not to create a second independent identity universe; it is to connect the authoritative HR or identity-provider lifecycle to Google Cloud.

Authentication proves who a user is. Authorization decides what that identity may do. SAML commonly carries enterprise sign-in assertions; OAuth delegates access to applications. Confusing those jobs is a reliable way to miss scenario questions.

Move from stored secrets to issued identity

Humans sign in interactively; workloads need a non-human principal. A service account supplies that identity. The dangerous shortcut is a downloadable service-account key: it is long-lived, copyable, hard to attribute once leaked, and valid wherever the file travels.

The preferred pattern is to attach a narrowly scoped service account to a Google Cloud workload and let the metadata service issue short-lived credentials. For administration, use service-account impersonation. For external clouds, CI systems, or Kubernetes identities, use Workload Identity Federation to exchange an external assertion for temporary Google credentials.

Layer the controls by question

IAM answers whether an identity may call an API. Networking answers whether packets can reach an endpoint. A secure design usually needs both. Private IPs reduce exposure, but “private” is not an authorization model.

Cloud NGFW filters network traffic and can perform layer-7 inspection. Cloud Armor protects internet-facing applications at the edge. IAP places identity-aware access in front of applications and administrative tunnels. VPC Service Controls reduce data-exfiltration risk around supported Google-managed services; they are not a replacement for IAM or a general packet firewall.

Private paths still have distinct jobs

Shared VPC centralizes network ownership across service projects. Private Google Access lets resources without external IPs reach Google APIs. Private Service Connect exposes services through private endpoints. Cloud NAT provides outbound internet access without inbound reachability. HA VPN encrypts traffic over the internet; Cloud Interconnect supplies private physical connectivity, with encryption added when required.

The exam often presents several secure products. Match the product to the threatened path: inbound web attack, administrative access, east-west segmentation, Google API exfiltration, or hybrid transport.

Start with the data, not the key

Google encrypts customer data at rest by default, but encryption alone does not tell you where sensitive data exists, who can access it, how long it remains, or whether an attacker can ask the authorized service to decrypt it.

Sensitive Data Protection discovers and transforms sensitive values through inspection, redaction, tokenization, pseudonymization, and format-preserving encryption. Secret Manager stores application secrets with versions, IAM, auditability, and rotation workflows. Storage lifecycle policies enforce retention or deletion behavior.

Choose key control for the requirement

Google-managed encryption is the operational default. CMEK gives the customer control over key location, IAM, rotation, and revocation in Cloud KMS. Cloud EKM keeps key material in an external key manager when contractual control requires it, at the cost of availability and operational complexity. Hardware-backed protection uses Cloud HSM.

Confidential Computing protects data in use by isolating memory during processing. It complements—not replaces—encryption at rest and in transit.

Security is a chain of evidence

A secure source repository does not guarantee the running container came from that source. The supply-chain question is: can you prove what was built, what was scanned, who approved it, and whether the runtime admitted exactly that artifact?

Scan dependencies and images for known vulnerabilities during CI/CD. Produce hardened, reproducible images. Sign or attest trusted artifacts. Use Binary Authorization to make GKE or Cloud Run reject images that lack required attestations. Patch running systems and use posture management to detect configuration drift after deployment.

AI workloads add data and model boundaries

AI security includes training-data access, model artifacts, prompt and response data, service perimeters, endpoint IAM, and protection against unintended model or data exposure. IaaS-hosted models give more infrastructure control and more patching responsibility; managed platforms shift infrastructure operation to Google but leave data, identity, configuration, and application risks with the customer.

The common misconception is that a model endpoint is “just another API.” It is also a data-processing system whose prompts, retrieval sources, tools, and outputs may cross trust boundaries.

Decide before the incident

Logging is not “turn everything on.” A useful strategy identifies which actions matter, where logs must be retained, who may read them, which detections require low latency, and how evidence leaves a compromised project.

Cloud Audit Logs record administrative and data-access activity; Data Access logs often require deliberate enablement and cost planning. Aggregated sinks at the folder or organization can route logs into a centralized project that workload administrators cannot alter. VPC Flow Logs show sampled network flows; Firewall Rules Logging records rule decisions; Packet Mirroring copies traffic for inspection; Cloud IDS detects network threats.

Security Command Center connects posture and threat

Security Command Center aggregates asset, vulnerability, misconfiguration, and threat findings. Findings are not remediation by themselves: an operating model needs triage ownership, severity criteria, playbooks, automation boundaries, and evidence preservation.

During an incident, contain without destroying the evidence you need. Prefer reversible isolation, snapshotting, credential revocation, and centralized logs. Then eradicate the cause, recover safely, and turn lessons into new preventive and detective controls.

Begin with shared responsibility

Google secures the cloud infrastructure; customers secure their data, identities, workloads, configurations, and use of services. Managed services move the dividing line, but they do not move accountability for choosing and configuring the service appropriately.

A compliance requirement becomes implementable only after you translate it into technical controls and evidence: resource scope, regions, access rules, network segmentation, key ownership, log coverage, approval workflow, and retention.

Know what the specialized controls prove

Assured Workloads helps configure regulated environments with supported guardrails. Access Transparency records actions by Google personnel. Access Approval lets customers approve eligible support access. Resource locations and service availability determine data residency—not a label in a policy document.

Audit readiness is continuous architecture. If a control cannot produce reliable evidence, the organization cannot confidently demonstrate that the control operated.