Professional Cloud Security EngineerDemo

Enforce the Organization Policy constraint that disables service account key creation (iam.managed.disableServiceAccountKeyCreation, or the legacy iam.disableServiceAccountKeyCreation). The policy blocks creation of new external, user-managed service account keys in the projects where it applies, reducing the risk from unmanaged long-lived credentials.

Enforcing the Vertex AI Workbench organization policies for automatic scheduled upgrades and disabled root access requires newly created instances to have an automatic upgrade schedule and prevents them from enabling root access. This keeps the environment updated while preventing users from altering operating-system settings with root privileges.

An organization-level aggregated Cloud Logging sink can route relevant logs across the organization to a Pub/Sub topic in near real time. Pub/Sub supports redelivery when a subscriber does not acknowledge a message, while a Dataflow streaming pipeline provides managed, autoscaling processing to deliver the records to the SIEM. A secondary replay mechanism preserves recovery from failed deliveries.

The trusted image organization policy constraint restricts deployments to approved container image registries. A Binary Authorization policy that requires attestations enforces that an image was signed and approved by the configured trusted authority before GKE permits deployment.

Cloud Interconnect supplies private, scalable, high-bandwidth connectivity between a VPC network and an on-premises network. Sending the traffic through an on-premises firewall before it uses the on-premises internet connection applies centralized security controls, while avoiding the substantially lower per-tunnel bandwidth of HA VPN.

For Shared VPC, VPC Service Controls requires the host project to be included in the same service perimeter as the Shared VPC service projects. Requests from Compute Engine instances use the Shared VPC network owned by the host project, so omitting that host project causes access to protected BigQuery datasets to be denied.

VPC Service Controls can protect BigQuery with a service perimeter to mitigate data-exfiltration risk. An Access Context Manager access level can classify requests by source IP address; applying that access level to the perimeter permits access from the authorized IP ranges while blocking other internet-originated requests.

Organization policies, including the Resource Location Restriction constraint, can be set at the organization, folder, or project level and apply to child resources. A folder-level policy allows separate branches of one organization to enforce different permitted locations, supporting multiple data-residency locations while governing the projects and resources within each branch.

Cloud Data Loss Prevention API, now part of Sensitive Data Protection, inspects text for sensitive information using infoType detectors and can de-identify or redact detected content before it is published.

IAM roles granted on a folder are inherited by all projects and resources within that folder. Assigning the department Google Group the Project Viewer role on its department folder therefore gives the group read-only access to resources in all current and future projects placed in that folder. The Project Browser role only permits browsing the resource hierarchy and does not grant access to project resources.

SAML SSO requires a SAML profile containing the identity provider’s sign-in and sign-out URLs and verification certificate. The service provider’s Entity ID and Assertion Consumer Service (ACS) URL must also be configured in the identity provider so it can issue assertions to the correct recipient endpoint. OpenID Connect configuration is a different federation protocol and does not satisfy a SAML requirement.

De-identifying sensitive fields before training prevents personal data from being used by the model while retaining usable data for analysis. Cloud DLP, now part of Sensitive Data Protection, supports discovery and de-identification of sensitive BigQuery data. BigQuery IAM enables granular, least-privilege access so only authorized users can access the dataset.

Sensitive Data Protection can inspect Cloud Storage objects for configured sensitive-data infoTypes. Keeping uploaded logs in the administrator-only bucket, initiating an inspection through Pub/Sub and Cloud Functions, and moving only objects for which no PII is detected ensures that analysts never receive access to logs containing PII. Cloud Storage lifecycle rules and object-event triggers do not themselves evaluate an object's contents for PII.

Cloud DNS with DNSSEC signs DNS zone data and enables validating resolvers to authenticate DNS lookup responses, helping prevent DNS spoofing and cache-poisoning attacks.

Artifact Analysis provides automatic vulnerability scanning for container images in Artifact Registry. After automatic scanning is enabled, new images pushed to Artifact Registry are scanned and their vulnerability results can be viewed within Google Cloud. Container Threat Detection instead monitors runtime activity in containers for attacks; it is not the image-vulnerability scanning service.

The roles/compute.imageUser role in the project hosting the custom image grants principals permission to use that shared image. The constraints/compute.trustedImageProjects organization policy can centrally allow only the security team’s image project, restricting new VM boot disks to trusted image projects throughout the organization.

An organization-level aggregated log sink with includeChildren exports matching logs from all child projects, and a Pub/Sub topic provides a near-real-time integration point for an external SIEM. Google Workspace Login Audit logs record user sign-ins; sharing Google Workspace audit logs with Google Cloud makes those login events available in Cloud Logging. Configuration-changing API calls are recorded as Admin Activity audit logs, which are always written.

restricted.googleapis.com uses the restricted VIP, which is intended for APIs and services supported by VPC Service Controls and denies access to unsupported APIs. Advertising its VIP range to the on-premises network through Cloud Router over Cloud Interconnect lets on-premises requests reach Google APIs privately through the VPC rather than via the public internet.

Compute Engine automatically encrypts Local SSD data, and Local SSDs do not support customer-managed encryption keys. For application traffic, using TCP enables TLS connections implemented with BoringSSL, whose BoringCrypto core is FIPS validated. Replacing UDP instance-to-instance traffic with TCP and using BoringSSL for TLS therefore addresses the required encryption in transit without attempting unsupported Local SSD key configuration.

Container Threat Detection monitors container runtime activity and produces Security Command Center findings for events such as added-library loading and malicious script execution. It is a Security Command Center Premium-tier capability, so enabling it for the projects in the production folder provides the required detection and makes the resulting findings available in Security Command Center.

A VPC private subnet with private IP addresses keeps the database servers on internal, non-internet-routable addressing. Google Cloud documents that internal IP addresses are not publicly routable and cannot be reached from the internet; external IP addresses enable communication with the public internet.

Cloud Storage is designed to hold backup files and supports scheduled transfers from an on-premises environment. Cloud Interconnect provides stable private connectivity to Google Cloud, making scheduled gsutil uploads to Cloud Storage an appropriate backup and disaster-recovery solution before migrating production workloads.

VPC Service Controls service perimeters protect Vertex AI by restricting access across a defined boundary, which mitigates data-exfiltration risks. Sensitive Data Protection’s DLP API can inspect text content and identify sensitive-data findings, enabling detection of information that should not be exposed. VPC Service Controls supported products and Inspecting text for sensitive data describe these capabilities.

A Shared VPC centralizes network administration in a host project while allowing developers to manage workloads in attached service projects. Security administrators can manage firewall rules in the Shared VPC network, preserving separation between network security control and application-resource administration.