This training course gives you a broad study of security controls and techniques in Google Cloud. Through recorded lectures, demonstrations, and hands-on labs, you’ll explore and deploy the components of a secure Google Cloud solution, including Cloud Identity, Resource Manager, Identity and Access Management (IAM), Virtual Private Cloud firewalls, Cloud Load Balancing, Direct Peering, Carrier Peering, Cloud Interconnect, and VPC Service Controls.

Who this course is for

  • Cloud information security analysts, architects, and engineers
  • Information security/cybersecurity specialists
  • Cloud infrastructure architects


Google: Cloud Identity, Resource Manager, IAM, HSM, Secret Manager, Google Kubernetes Engine, Managed Service for Microsoft Active Directory, Cloud Interconnect, Cloud Storage, Web Security Scanner, Identity-Aware Proxy, VPC Service Controls, Google Cloud’s operations suite (formerly Stackdriver), Google Cloud Armor, Compute Engine, Cloud Data Loss Prevention API

Third party: Forseti Inventory, Forseti Scanner.

Read more


  • Prior completion of Google Cloud Fundamentals: Core Infrastructure or equivalent experience
  • Prior completion of Networking in Google Cloud or equivalent experience
  • Basic understanding of Kubernetes terminology (preferred but not required)
  • Knowledge of foundational concepts in information security, through experience or through online training such as SANS’s SEC301: Introduction
  • to Cyber Security
  • Basic proficiency with command-line tools and Linux operating system environments
  • Systems Operations experience, including deploying and managing applications, either on-premises or in a public cloud environment
  • Reading comprehension of code in Python or Javascript
Read more

Learning Outcomes

  • Understand Google’s approach to security.
  • Manage administration identities using Cloud Identity.
  • Implement least privilege administration using Resource Manager and IAM.
  • Implement Identity-Aware Proxy.
  • Implement IP traffic controls using VPC firewalls and Google Cloud Armor.
  • Remediate security vulnerabilities, especially public access to data and virtual machines.
  • Scan for and redact sensitive data using the Cloud Data Loss Prevention API.
  • Analyze changes to resource metadata configuration using audit logs.
  • Scan a Google Cloud deployment with Forseti, to remediate important types of vulnerabilities, especially in public access to data and VMs
Read more

Course Outline

Module 01: Foundations of Google Cloud Security


  • Google Cloud’s Approach to Security
  • The Shared Security Responsibility Model
  • Threats Mitigated by Google and Google Cloud
  • Access Transparency


  • Learn about Google Cloud’s approach to security.
  • Understand the shared security responsibility model.
  • Understand the kinds of threats mitigated by Google and by Google Cloud.
  • Define and understand access transparency.

Module 02 Cloud Identity


  • Cloud Identity
  • Cloud Identity
  • Google Cloud Directory Sync
  • Google Authentication Versus SAML-based SSO
  • Authentication Best Practices


  • Learn what Cloud Identity is and what it does.
  • Learn how Directory Sync securely syncs users and permissions between your on-prem LDAP or AD server and the cloud.
  • Understand the two ways Google Cloud handles authentication and how to set up SSO.
  • Explore best practices for managing groups, permissions, domains and admins with Cloud Identity.

Module 03 Identity and Access Management (IAM)


  • Resource Manager
  • IAM Roles
  • IAM Policies
  • IAM Recommender
  • IAM Troubleshooter
  • IAM Audit Logs
  • IAM Best Practices


  • Understand Resource Manager: projects, folders, and organizations.
  • Learn how to implement IAM roles, including custom roles.
  • Understand IAM policies, including organization policies.
  • Understand best practices, including separation of duties and least privilege, the use of Google groups in policies, and avoiding the use of basic roles.
  • Learn how to configure IAM, including custom roles and organization policies.


  • Lab: Configuring IAM

Module 04 Configuring Virtual Private Cloud for Isolation and Security


  • VPC Firewalls
  • Load Balancing and SSL Policies
  • Interconnect and Peering Policies
  • Best Practices for VPC Networks
  • VPC Flow Logs


  • Learn best practices for configuring VPC firewalls (both ingress and egress rules).
  • Understand load balancing and SSL policies.
  • Understand how to set up private Google API access.
  • Understand SSL proxy use.
  • Learn best practices for VPC networks, including peering and shared VPC use, and the correct use of subnetworks.
  • Learn best security practices for VPNs.
  • Understand security considerations for interconnect and peering options.
  • Become familiar with available security products from partners.
  • Learn to configure VPC firewalls.
  • Prevent data exfiltration with VPC Service Controls.


  • Lab: Configuring VPC Firewalls
  • Lab: Configuring and Using VPC Flow Logs in Cloud Logging

Module 05 Securing Compute Engine: Techniques and Best Practices


  • Service Accounts, IAM Roles and API Scopes
  • Managing VM Logins
  • Organization Policy Controls
  • Compute Engine Best Practices
  • Encrypting Disks with CSEK


  • Learn about Compute Engine service accounts, default and customer-defined.
  • Understand IAM roles and scopes for VMs.
  • Understand how Shielded VMs help maintain your system and application integrity


  • Lab: Configuring, Using, and Auditing VM Service Accounts and Scopes
  • Lab: Encrypting Disks with Customer-Supplied Encryption Keys

Module 06 Securing Cloud Data: Techniques and Best Practices


  • Cloud Storage IAM permissions and ACLs
  • Auditing Cloud Data
  • Signed URLs and Policy Documents
  • Encrypting with CMEK and CSEK
  • Cloud HSM
  • BigQuery IAM Roles and Authorized Views
  • Storage Best Practices


  • Use cloud permissions and roles to secure cloud resources.
  • Audit cloud data.
  • Use signed URLs to give access to objects in a Cloud Storage bucket.
  • Manage what can be placed in a Cloud Storage bucket using Signed Policy Document.
  • Encrypt cloud data using customer managed encryption keys (CMEK), customer supplied encryption keys (CSEK), and Cloud HSM.
  • Protecting data in BigQuery using IAM roles and authorized views


  • Lab: Using Customer-Supplied Encryption Keys with Cloud Storage
  • Lab: Using Customer-Managed Encryption Keys with Cloud Storage and Cloud KMS
  • Lab: Creating a BigQuery Authorized View

Module 07 Application Security: Techniques and Best Practices


  • Types of Application Security Vulnerabilities
  • Web Security Scanner
  • Threat: Identity and Oauth Phishing
  • Identity-Aware Proxy
  • Secret Manager


  • Recall various types of application security vulnerabilities.
  • Understand DoS protections in App Engine and Cloud Functions.
  • Understand the role of Web Security Scanner in mitigating risks.
  • Define and recall the threats posed by Identity and Oauth phishing.
  • Understand the role of Identity-Aware Proxy in mitigating risks.
  • Store application credentials and metadata securely using Secret Manager.


  • Lab: Using Web Security Scanner to Find Vulnerabilities in an App Engine Application
  • Lab: Configuring Identity-Aware Proxy to Protect a Project
  • Lab: Configuring and Using Credentials with Secret Manager

Module 08 Securing Google Kubernetes Engine: Techniques and Best Practices


  • Introduction to Kubernetes/GKE
  • Authentication and Authorization
  • Hardening Your Clusters
  • Securing Your Workloads
  • Monitoring and Logging


  • Understand the basic components of a Kubernetes environment.
  • Understand how authentication and authorization works in Google Kubernetes Engine.
  • Recall how to harden Kubernetes Clusters against attacks.
  • Recall how to harden Kubernetes workloads against attacks.
  • Understand logging and monitoring options in Google Kubernetes Engine.

Module 09 Protecting against Distributed Denial of Service Attacks (DDoS)


  • How DDoS Attacks Work
  • Google Cloud Mitigations
  • Types of Complementary Partner Products


  • Understand how DDoS attacks work.
  • Recall common mitigations: Cloud Load Balancing, Cloud CDN, autoscaling, VPC ingress and egress firewalls, Google Cloud Armor.
  • Recall the various types of complementary partner products available.
  • Use Google Cloud Armor to blocklist an IP address and restrict access to an HTTP load balancer


  • Lab: Configuring Traffic Blocklisting with Google Cloud Armor

Module 10 Content-Related Vulnerabilities: Techniques and Best Practices


  • Threat Ransomware
  • Ransomware Mitigations
  • Threats: Data Misuse, Privacy Violations, Sensitive Content
  • Content-Related Mitigations


  • Discuss the threat of ransomware.
  • Understand ransomware mitigations: Backups, IAM, Cloud Data Loss Prevention API.
  • Understand threats to content: Data misuse, privacy violations, sensitive/restricted/unacceptable content.
  • Recall mitigations for threats to content: Classifying content using Cloud ML APIs; scanning and redacting data using the DLP API.


  • Lab: Redacting Sensitive Data with the DLP AP

Module 11 Monitoring, Logging, Auditing, and Scanning


  • Cloud Audit Logs
  • Deploying and Using Forseti


  • Understand and use Security Command Center.
  • Understand and use Cloud Monitoring and Cloud Logging.
  • Install the Monitoring and Logging Agents.
  • Understand Cloud Audit Logs.
  • Gain experience configuring and viewing Cloud Audit Logs.
  • Gain experience deploying and using Forseti.
  • Learn how to inventory a deployment with Forseti Inventory.
  • Learn how to scan a deployment with Forseti Scanner


  • Lab: Installing Cloud Logging and Monitoring Agents
  • Lab: Configuring and Using Cloud Logging and Monitoring
  • Lab: Configuring and Viewing Cloud Audit Logs
Read more

Why choose QA

Google Cloud learning paths

Want to boost your career in Google Cloud? Click on the roles below to see QA‘s learning pathways, specially designed to give you the skills to succeed.

Required Star = Required
Certification = Certification
Data Scientist
Data Engineer
Developer Software Development Experience
Architect Enterprise Architecture Experience
Administrator Windows Administrator Experience

Frequently asked questions

See all of our FAQs

How can I create an account on myQA.com?

There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.

If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".

If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.

Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.

How do QA’s virtual classroom courses work?

Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.

We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting (more details in the link below) to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.

Learn more about our Virtual Classrooms.

How do QA’s online courses work?

QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course. When you book a QA online learning course you will receive immediate access to it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.

All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.

Learn more about QA’s online courses.

When will I receive my joining instructions?

Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.

When will I receive my certificate?

Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.

Contact Us

Please contact us for more information