GCP Security Engineer study plan

Map every IAM resource hierarchy level (organization, folder, project, resource) and write down which policy inheritance behavior applies at each level

Build a working mental model of allow policies versus deny policies and identify three scenarios where a deny policy overrides an inherited allow

Practice writing IAM Conditions expressions for time-bound and resource-tag-based access, then predict the evaluation outcome for five edge cases

Diagram how service accounts, impersonation, and short-lived credentials differ from long-lived keys in a request path

Compare predefined roles against custom roles and list the exact permissions you would remove to enforce least privilege for a CI/CD pipeline identity

Trace how Workload Identity Federation issues tokens to an external provider and identify each trust check performed

Enumerate the ways to grant temporary elevated access and rank them by auditability

Write a short incident narrative explaining what an auditor would see in Cloud Audit Logs when a role binding is added and later removed

Sketch a VPC topology that isolates a public front end from a private data tier using subnets, firewall rules, and Private Google Access

Distinguish VPC Service Controls perimeters from network firewalls and state which class of exfiltration each one stops

Configure the logic of a perimeter bridge and dry-run mode, and predict which API calls get blocked in each state

List the DNS and routing decisions needed to keep traffic to Google APIs private

Select the right encryption option (Google-managed, CMEK, CSEK) for three data classes and justify each choice

Explain how Cloud KMS key rings, rotation schedules, and key versions interact, and what happens to old ciphertext after rotation

Identify where envelope encryption appears in the request path for Cloud Storage and BigQuery

Describe how Confidential VMs and Confidential GKE nodes change the threat model for in-use data

Classify data using Sensitive Data Protection (DLP) infoTypes and design a de-identification transform for a sample dataset

Compare tokenization, format-preserving encryption, and pseudonymization for re-identification risk

Design a key access boundary so that a workload can use a CMEK key without being able to export or destroy it

Plan a secret lifecycle in Secret Manager including rotation, versioning, and access auditing

Assemble the log sources needed for detection (Cloud Audit Logs, VPC Flow Logs, DNS logs, Security Command Center findings) and state the retention decision for each

Route logs to a central project and design exclusion filters that cut noise without losing security-relevant events

Write three detection rules in Cloud Logging or Security Command Center that would catch privilege escalation, key deletion, and perimeter violations

Draft a response procedure for a compromised service account key from detection through revocation and rotation

Map each GCP security control you have studied to a common compliance framework requirement (for example access review, encryption, logging)

Describe how Assured Workloads and organization policies enforce residency and personnel controls

Explain the shared responsibility model for a specific service and identify which controls the customer must evidence

Prepare the artifacts an auditor would request for access reviews, key rotation, and log retention

Re-derive the IAM decision tree and boundary diagram from memory, then correct gaps against your earlier deliverables

Work through timed scenario questions across all five domains and log every wrong answer with its root cause

Revisit the three weakest subdomains and write a corrected explanation for each missed concept

Run a final review of the milestones from weeks 4 and 7 to confirm retention