What's changed: Created Cloud Digital Leader Chapter 5 (Domain 5 "Trust and security": cloud trust and Google’s secure infrastructure = CIA/defense in depth/encryption (at rest, in transit)/zero trust (BeyondCorp)/Cloud IAM (least privilege); trust principles, compliance, and security operations = data residency/sovereignty/compliance certifications/Security Command Center/Sensitive Data Protection (DLP)).
5.1Cloud trust and Google’s secure infrastructure
Understand the security basics of confidentiality, integrity, and availability (CIA), common threats, defense in depth, encryption at rest and in transit, zero trust (BeyondCorp), and Cloud IAM for least-privilege access control—from the perspective of Google’s secure infrastructure.
Cloud adoption rests on the trust of "can it be used safely." Security basics are the CIA triad: confidentiality (only authorized people can see it), integrity (it is not tampered with), and availability (usable when needed). To protect these, Google layers multiple defenses from data centers through hardware, network, and operations.
5.1.1Defense in depth and encryption
Defense in depth layers multiple defenses rather than relying on one control; even if a layer is breached, another contains the damage. The core of data protection is encryption: Google Cloud encrypts both at rest and in transit by default. Google manages keys by default, and customers can manage their own keys (CMEK) when required. The Google Cloud premise is that data is encrypted without any special configuration.
At the perimeter of defense in depth, you need to stop attacks from the internet. Cloud Armor provides distributed-denial-of-service (DDoS) mitigation and a web application firewall (WAF), blocking malicious traffic in front of the global load balancer. Remember: "defense against DDoS that floods a service to take it down = Cloud Armor."
5.1.2Zero trust and Cloud IAM
Instead of the traditional perimeter idea that "trust anyone on the corporate network," Google champions zero trust (implemented internally as BeyondCorp). It grants access based on verifying user and device, not network location, with the principle "never trust, always verify." The core of access control is Cloud IAM (Identity and Access Management), defining "who (member) gets which role (permissions) on which resource." The principle is least privilege—grant only the minimum permissions needed.
| Term | Meaning | Example |
|---|---|---|
| Member (principal) | Who is acting | User, group, service account |
| Role | A set of permissions | Viewer, Editor, Admin |
| Least privilege | Grant only what is needed | Admin only to those who need it |
Common: concept → term. E.g., "only authorized can view" = confidentiality; "not tampered" = integrity; "usable when needed" = availability; "multiple defensive layers" = defense in depth; "encrypted at rest and in transit" = default encryption; "verify user/device not location" = zero trust/BeyondCorp; "who gets which permissions" = Cloud IAM; "only the minimum" = least privilege.
Watch the mix-ups: (1) do not confuse CIA’s confidentiality/integrity/availability. (2) Google Cloud encrypts at rest and in transit by default (even without customer configuration). (3) Zero trust = do not trust by location (not just extending VPN perimeter defense). (4) IAM follows least privilege—do not hand out Editor/Admin casually.
5.1.3Section summary
- Security basics = CIA (confidentiality, integrity, availability); protect with defense in depth
- Google Cloud encrypts at rest and in transit by default; keys can be customer-managed via CMEK
- Zero trust (BeyondCorp) = verify user/device not location; Cloud IAM uses least privilege
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which set correctly lists the three elements of the CIA security triad?
Q2. Which approach layers multiple defenses rather than relying on a single control?
Q3. Which correctly describes data encryption in Google Cloud?
Q4. Which grants access based on verifying user and device rather than network location?
Q5. Which Google Cloud access management defines "who gets which role on which resource"?
Q6. What is the basic principle when granting access in Cloud IAM?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.