Google Cloud Professional Cloud Security Engineer (PCSE) tests whether you can secure workloads on Google Cloud: identity and access, network boundaries, data protection and encryption, security operations, and compliance. The current exam guide also covers securing AI workloads, including controls for the Gemini Enterprise Agent Platform, plus Privileged Access Manager, Cloud NGFW layer-7 inspection and Secure Web Proxy.
This guide follows Google's official exam guide: all five sections with weights, the controls you must know, a 7-week plan and 15 original scenario questions.
Quick facts (Google Cloud, November 2026)
| Item | Detail |
|---|---|
| Length | 2 hours |
| Questions | 50–60, multiple choice and multiple select |
| Fee | USD 200 (plus tax where applicable) |
| Languages | English, Japanese |
| Delivery | Online-proctored or at a test centre |
| Prerequisites | None; 3+ years of industry experience including 1+ year designing and managing Google Cloud solutions recommended |
| Renewal | Within Google's renewal eligibility period; see Google's renewal FAQs for validity and timing |
Read the official Professional Cloud Security Engineer page and exam guide before booking.
Who should take PCSE?
- Cloud and security engineers protecting Google Cloud environments.
- AWS or Azure security engineers adding Google Cloud (compare AWS SCS-C03 and Microsoft SC-500).
- People who passed the Associate Cloud Engineer and work with IAM, networking and logging.
Sections and weights
| Section | Weight |
|---|---|
| 1. Configuring access | ~25% |
| 2. Securing communications and establishing boundary protection | ~22% |
| 3. Ensuring data protection | ~23% |
| 4. Managing operations | ~19% |
| 5. Supporting compliance requirements | ~11% |
Section 1: Configuring access (~25%)
- Cloud Identity: Google Cloud Directory Sync; SSO with a third-party identity provider; protecting super administrator accounts; automated user lifecycle; Workforce Identity Federation.
- Service accounts: securing default service accounts; avoiding, auditing and limiting service account keys; short-lived credentials; Workload Identity Federation; impersonation.
- Authentication: password and session policies, SAML and OAuth, enforcing 2-step verification.
- Authorisation: privileged roles and separation of duties; IAM conditions and IAM deny policies; least privilege across organisation, folders and projects; Access Context Manager; Policy Intelligence; groups; Privileged Access Manager for just-in-time elevation.
- Resource hierarchy: folders and projects at scale; pre-built and custom organisation policies; inheritance.
# Let a CI job act as a deploy service account for one hour instead of using a key file
gcloud auth print-access-token \
--impersonate-service-account=deployer@prod-app.iam.gserviceaccount.comSection 2: Communications and boundary protection (~22%)
- Perimeter: Cloud NGFW rules and policies including layer-7 inspection; Identity-Aware Proxy; load balancers; Certificate Authority Service; Cloud Armor; Secure Web Proxy; Cloud DNS security; restricting enabled APIs.
- Segmentation: VPC, peering and Shared VPC security; N-tier isolation; VPC Service Controls.
- Private connectivity: HA VPN and Cloud Interconnect; Private Google Access (including for on-premises hosts); restricted Google APIs; Private Service Connect; Cloud NAT.
| Need | Control |
|---|---|
| Stop data being copied out of BigQuery to outside projects | VPC Service Controls perimeter |
| Block SQL injection and limit request rates on a public site | Cloud Armor |
| Employee access to internal apps without a VPN | Identity-Aware Proxy |
| VMs without external IPs need outbound internet | Cloud NAT |
| Private VMs need Google APIs without the internet | Private Google Access or Private Service Connect |
| Inspect and filter outbound web traffic by URL | Secure Web Proxy |
Section 3: Data protection (~23%)
- Sensitive data: Sensitive Data Protection for discovering and redacting PII, pseudonymisation and format-preserving encryption; restricting access to BigQuery, Cloud Storage and Cloud SQL; Secret Manager; protecting instance metadata.
- Encryption: Google default encryption vs CMEK vs Cloud External Key Manager; software vs hardware keys; rotation, revocation and import; Cloud Storage lifecycle; Confidential Computing.
- AI workloads: privacy and security controls so data and models can't be misused; requirements for IaaS- and PaaS-hosted training; controls for the Gemini Enterprise Agent Platform.
Section 4: Managing operations (~19%)
- Automation: CVE scanning in CI/CD; Binary Authorization for GKE and Cloud Run; hardened, patched VM and container images; posture management and drift detection with custom organisation policies and Security Health Analytics modules.
- Logging and detection: Cloud NGFW logs, VPC Flow Logs, Packet Mirroring, Cloud IDS and Log Analytics; logging strategy; incident response; secure access to logs; exports to external SIEMs; Cloud Audit Logs and data access logs; log sinks and aggregated sinks; Security Command Center.
Section 5: Compliance (~11%)
- Technical requirements for compute, data, network and storage; the shared responsibility model.
- Controls for compliance: Assured Workloads, organisation policies, Access Transparency, Access Approval and regional data and services.
- Scoping environments for regulation and mapping requirements to controls such as segmentation and audit-log coverage.
Indian projects often need data to stay in asia-south1 (Mumbai) or asia-south2 (Delhi): use the resource-locations organisation policy. See the DPDP Act for AI applications.
7-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | Resource hierarchy, IAM roles, conditions, deny policies, groups | Folder-level roles with an IAM condition limited to working hours |
| 2 | Service accounts, keys, impersonation, Workload Identity Federation, PAM | Deploy from GitHub Actions with no service account key |
| 3 | VPC firewalls and Cloud NGFW, Shared VPC, IAP, Cloud Armor | IAP-protected internal app; Cloud Armor rate limit |
| 4 | VPC Service Controls, Private Google Access, PSC, Cloud NAT, HA VPN | Perimeter around a BigQuery project; test a blocked copy |
| 5 | Sensitive Data Protection, Secret Manager, CMEK, EKM, Confidential Computing | De-identify a CSV of customer records |
| 6 | Binary Authorization, Security Command Center, audit logs, aggregated sinks, Cloud IDS | Organisation-level sink to a central logging project |
| 7 | AI workload security, Assured Workloads, sample questions | Review weak areas; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. A GitHub Actions pipeline deploys to Google Cloud using a downloaded JSON key. How do you remove the key?
Workload Identity Federation with a GitHub OIDC provider and service account impersonation.
2. Admins need Owner rights only for emergencies, with approval and a time limit. What do you use?
Privileged Access Manager for just-in-time, approved, time-bound grants.
3. No one should ever be able to delete projects in a folder, even if a role allows it. What do you use?
An IAM deny policy on that folder.
4. New projects must never create service account keys. How?
The organisation policy that disables service account key creation.
5. Employees sign in with the company's Microsoft Entra ID. How do you give them Google Cloud access?
SSO with Entra ID as the identity provider, with Directory Sync or Workforce Identity Federation.
6. Sensitive BigQuery data must not be exported even by authorised users to personal projects. What prevents it?
VPC Service Controls.
7. A public website is hit by application-layer DDoS and bot traffic. What protects it?
Cloud Armor (WAF rules, rate limiting and adaptive protection) behind an external load balancer.
8. The bank's policy says encryption keys must live outside Google. Which option?
Cloud External Key Manager (EKM).
9. Customer data needs to be searchable but phone numbers must keep their format while being encrypted. What technique?
Format-preserving encryption with Sensitive Data Protection.
10. Only container images signed by your CI pipeline may run on GKE. What do you enable?
Binary Authorization with attestations.
11. Audit logs from all projects must flow to one SIEM. How?
An aggregated log sink at the organisation or folder level, exporting to Pub/Sub or a central logging bucket.
12. You must know who read objects in a sensitive Cloud Storage bucket. What do you enable?
Data Access audit logs for Cloud Storage.
13. Private VMs on-premises must call Google APIs over Interconnect, not the internet. What do you configure?
Private Google Access for on-premises hosts (via restricted or private Google API endpoints).
14. You need a single view of misconfigurations, vulnerabilities and threats across the organisation. What service?
Security Command Center.
15. A regulated workload must use only approved regions and personnel controls. What helps enforce this?
Assured Workloads together with organisation policies.
After PCSE
- Read GCP for AI engineers and AI for cloud security engineers.
- Combine it with the Professional Cloud Architect for design depth.
- See live security and cloud jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches cloud security on Google Cloud, AWS and Azure. See the APEX AI, ML, Cloud and Cyber Security program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
How long is the Professional Cloud Security Engineer exam?
2 hours, with 50 to 60 multiple-choice and multiple-select questions.
How much does the Google Cloud Security Engineer exam cost?
USD 200, plus tax where applicable.
Which section has the most weight?
Configuring access, at about 25%.
Is there a prerequisite?
No. Google recommends 3+ years of industry experience, including 1+ year designing and managing Google Cloud solutions.
Does the exam cover AI security?
Yes. Section 3 includes securing AI workloads, including controls for the Gemini Enterprise Agent Platform.
Which languages is the exam offered in?
English and Japanese.
