This domain addresses the critical requirement of ensuring that your Google Cloud environment operates in accordance with internal governance policies and external regulatory standards. It involves understanding the shared responsibility model and knowing how to leverage Google's compliance certifications and reports. You will learn to use cloud-native tools to enforce organizational policies, audit configurations, and prevent actions that could lead to non-compliance. Key topics include managing organizational policies, controlling network perimeters to prevent data exfiltration, and maintaining a clear audit trail. Mastery of this domain enables you to build and operate cloud solutions that meet the stringent compliance requirements of industries like finance, healthcare, and government.
This domain covers the core operational activities of a security engineer responsible for the real-time defense of a cloud environment. It focuses on the continuous process of monitoring, logging, threat detection, and incident response. You will delve into Google Cloud's native security tools, particularly Security Command Center (SCC) for posture management and threat detection, and Google Security Operations for deep analysis and response orchestration. This area is highly practical, emphasizing the skills needed to sift through telemetry, identify anomalies, investigate potential threats, and manage security incidents from detection to resolution. A strong grasp of this domain is crucial for maintaining situational awareness and ensuring a swift and effective response to security events.
This domain centers on the critical task of protecting data stored and processed within the Google Cloud ecosystem. It covers the various layers of encryption that Google Cloud applies by default, as well as the options available for customer-controlled encryption. A key focus is on managing cryptographic keys using Cloud Key Management Service (KMS) to meet specific security or compliance requirements. The domain also explores services and techniques for discovering, classifying, and redacting sensitive data to prevent unauthorized exposure and ensure data privacy. Mastering this area is essential for building trust and ensuring the confidentiality and integrity of customer and organizational data.
This domain focuses on the foundational principles of securing a Google Cloud environment by controlling who can do what, on which resources. It revolves around Google Cloud's Identity and Access Management (IAM) service, which is critical for defining fine-grained access policies. You will learn to apply the principle of least privilege, ensuring that users, applications, and services are only granted the permissions essential to perform their tasks. The domain also covers the secure management of service accounts, which are special identities used by applications and virtual machines to authenticate to Google Cloud APIs. Properly configuring access is the first line of defense in preventing unauthorized actions and data breaches within the cloud.
Event Threat Detection (ETD) is the Security Command Center (SCC) service designed to detect threats by analyzing platform and project logs. ETD custom modules provide the capability to create user-defined detection rules that augment the built-in detectors. The "Configurable Bad IP" template is a predefined module specifically for ingesting a list of known Indicators of Compromise (IoCs)—in this case, malicious IP addresses—as an external signal. When logs, such as VPC Flow Logs, show traffic to or from an IP on this list, the custom module generates a finding in SCC, fulfilling the exact requirements of the scenario.
A. Custom postures are used to define and monitor compliance against a desired security state by grouping existing detectors; they do not create new detectors based on external IoCs.
B. Security Health Analytics (SHA) custom modules are for detecting misconfigurations in Google Cloud resource properties (posture management), not for detecting threats from activity logs using external IoCs.
D. Creating a custom log sink and using the SCC API is a complex, manual approach. ETD custom modules offer a native, fully integrated, and more efficient solution for this specific use case.
1. Google Cloud Documentation
Security Command Center
"Overview of Event Threat Detection custom modules": This document explicitly states
"Event Threat Detection custom modules let you create your own detection rules to complement Google Cloud's built-in Event Threat Detection detectors... To create a custom module
you can use a module template that Google Cloud provides." It lists CONFIGURABLEBADIP as a supported template.
2. Google Cloud Documentation
Security Command Center
"Create and manage Event Threat Detection custom modules": Under the section "Module templates
" the CONFIGURABLEBADIP template is described. It specifies that this template detects connections from a list of IP addresses that you provide
using sources like VPC Flow Logs. This directly supports using external IoC lists for detection.
3. Google Cloud Documentation
Security Command Center
"Create and manage custom modules for Security Health Analytics": This page clarifies the purpose of SHA custom modules: "With custom modules for Security Health Analytics
you can define your own detection policies for your Google Cloud resources... A custom module checks the properties of the resources that you specify in the module." This confirms its role in configuration checking
not threat detection from logs.
