GCP Security Engineer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IAM policy inheritance

Allow policies flow down the resource hierarchy from organization to folder to project to resource. Child policies add grants but cannot revoke an inherited grant, so effective access is the union of all ancestors.

Deny policy precedence

Deny policies are evaluated before allow policies. Any matching deny rule blocks the permission even if an allow binding grants it, except for principals explicitly listed as exceptions.

IAM Conditions

A conditional role binding includes a CEL expression evaluated at request time, such as request.time or resource.name. If the condition cannot be evaluated, the binding is not applied.

Custom role scope

Custom roles define a set of permissions and can be created at project or organization level. They can be in launch or GA stage, and permissions must be supported for the target resource.

Workload Identity Federation

Lets external workloads such as AWS or OIDC-authenticated services obtain Google credentials without service account keys. It uses workload identity pools and providers with attribute mappings.

Service account key block

The organization policy constraint iam.disableServiceAccountKeyCreation prevents new service account keys from being created, forcing short-lived credentials or federation instead.

Firewall rule priority

VPC firewall rules are stateful and evaluated by priority from 0 to 65535, with lower numbers taking precedence. The first matching rule decides allow or deny.

Hierarchical firewall policies

Firewall policies attached at organization or folder level are evaluated before VPC firewall rules. They use allow, deny, and goto_next actions and apply to all descendant resources.

VPC Service Controls perimeter

A service perimeter restricts access to supported Google APIs so data cannot be copied outside the perimeter. Access levels define which clients may cross the boundary.

Private Google Access

Allows VM instances without external IP addresses to reach Google APIs and services using internal routing. It does not provide general internet access; Cloud NAT is needed for that.

Cloud Armor security policy

Attaches to a backend service and provides WAF preconfigured rules, IP and geo allow/deny lists, and rate limiting. It protects external HTTP(S) load balancer traffic.

Shared VPC roles

A host project owns the VPC network and subnets; service projects attach to it. Network administration stays with the host, while service project admins deploy resources into shared subnets.

SSL policy minimum TLS

An SSL policy attaches to a target proxy and sets the minimum TLS version and cipher profile, such as modern or restricted, for Google-managed load balancer TLS.

Cloud NAT behavior

Cloud NAT provides outbound-only internet access for instances without external IPs. It does not allow unsolicited inbound connections, and it is regional and tied to a router.

CMEK key hierarchy

Cloud KMS organizes keys as key ring, key, and key version. Rotation creates a new primary version, while older versions remain available for decrypting existing data.

Cloud HSM validation

Cloud HSM provides hardware security modules validated to FIPS 140-2 Level 3. Keys are generated and used inside the HSM, and key material is not exportable.

Cloud EKM

External Key Manager keeps key material in a third-party key manager outside Google. Google stores only a key URI and calls the external manager for cryptographic operations.

Sensitive Data Protection

Inspects data for sensitive infoTypes and de-identifies it using masking, tokenization, or date shifting. It can scan Cloud Storage, BigQuery, Datastore, and streaming content.

Secret Manager rotation

Secret Manager stores versioned secrets with IAM access control and optional CMEK. It does not rotate secrets automatically; rotation must be implemented by the customer.

BigQuery policy tags

Policy tags in Data Catalog enforce column-level access control on BigQuery tables. Users need the fine-grained reader role on the tag to read protected columns.

BigQuery row access policies

Row-level security filters which rows a user can see based on a filter expression. Users with the row-level security admin role can bypass the policy.

Audit log types

Admin Activity logs are always enabled and free. Data Access logs are off by default and billed. System Event and Policy Denied logs cover system changes and deny policy violations.

Aggregated log sinks

A sink created at folder or organization level routes logs from all child projects to a destination such as Cloud Storage, BigQuery, or Pub/Sub for centralized retention.

Log bucket retention lock

Log buckets store logs with a configurable retention period. Locking a bucket prevents reducing retention or deleting it, supporting compliance evidence requirements.

Security Command Center tiers

Standard includes basic findings such as Security Health Analytics. Premium adds Event Threat Detection, Container Threat Detection, and vulnerability scanning, with Pub/Sub export.

VPC Flow Logs

Flow Logs record network flows for subnets, capturing source, destination, and bytes. They are used for forensics and anomaly detection and are configured per subnet.

Access Transparency logs

Records actions taken by Google personnel on customer data, such as support access. Logs are available in Cloud Logging and support audit and compliance requirements.

Access Approval

Requires explicit customer approval before Google support staff can access customer data. It is configured at organization level and complements Access Transparency logging.

Assured Workloads regimes

Creates a folder that enforces compliance controls for regimes such as FedRAMP, IL4, CJIS, ITAR, and HIPAA. It restricts regions and personnel access automatically.

Organization Policy constraints

Guardrails enforced across the hierarchy, such as gcp.resourceLocations or iam.disableServiceAccountKeyCreation. They restrict what configurations child resources can create.

HIPAA BAA requirement

Using Google Cloud for protected health information requires a signed Business Associate Agreement with Google and use of HIPAA-eligible services only.

Compliance reports access

SOC, ISO, and PCI attestation reports are downloadable from the Compliance Reports section of the console. They document Google controls, not the customer's own configuration.