CDL
Deep Dive
Cloud Armor, Security Command Center, Cloud KMS, Secret Manager, Google Security Operations, Chrome Enterprise Premium, and VPC Service Controls.
Cloud Armor
WAF (Web Application Firewall) and DDoS protection for applications behind Cloud Load Balancing. Blocks layer 3/4 attacks (volumetric DDoS) and layer 7 attacks (SQLi, XSS, OWASP Top 10).
Security Command Center (SCC)
Central security and risk management platform for the entire GCP organization. Detects misconfigurations, vulnerabilities, and active threats.
Cloud KMS (Key Management Service)
Manages cryptographic keys in an HSM (Hardware Security Module) administered by Google. Creates, rotates, and destroys keys to encrypt data in GCP and in your applications.
Secret Manager
Securely stores secrets (API keys, passwords, certificates). Eliminates hardcoding credentials in code or environment variables.
Google's cloud-native SIEM (Security Information and Event Management), formerly called Chronicle. Ingests and analyzes petabytes of security logs at scale. Detects threats using Google Threat Intelligence.
Main use case
Enterprises that need to correlate logs from multiple sources to detect sophisticated threats.
Google's Zero Trust implementation (formerly BeyondCorp Enterprise). Access to apps is based on identity + device state + context, not on whether you are inside the corporate VPN. It originated from how Google works internally.
Main use case
Remote or hybrid workforce that needs secure access to corporate apps without a VPN.
Creates a security perimeter around GCP services to prevent data exfiltration. Restricts which projects or identities can access GCP APIs (BigQuery, Cloud Storage) from outside the perimeter.
Main use case
Sensitive data in BigQuery or Cloud Storage where you need to guarantee it is not copied outside the corporate environment.
Identity and device management (IDaaS). Users and groups to access GCP and Google Workspace without requiring Gmail accounts. Integrates with LDAP/Active Directory directories.
Main use case
Enterprises that want to manage corporate identities in GCP without full Google Workspace.
| Need | Service |
|---|---|
| Protect a web app from DDoS and SQLi attacks | Cloud Armor |
| See all vulnerabilities and misconfigurations in my org | Security Command Center |
| Manage encryption keys (CMEK) | Cloud KMS |
| Securely store API keys and passwords | Secret Manager |
| Analyze security logs to detect intrusions | Google Security Operations |
| VPN-free access based on identity and device state | Chrome Enterprise Premium |
| Prevent BigQuery data from being copied to external projects | VPC Service Controls |
| Manage corporate users to access GCP | Cloud Identity |
Compliance and certifications
Google Cloud has more than 150 regulatory compliance certifications. This makes it easier for customers to meet their own regulatory obligations.
Data sovereignty and residency
Data sovereignty refers to the right of a country or company to control where its data resides and who can access it, according to local laws.
Google Cloud trust principles
Transparency
Google publishes Transparency Reports on government requests and Cloud Audit Logs so customers can see who accesses their data.
Independent audits
Certified third parties regularly audit Google Cloud's infrastructure and security controls.
Your data is yours
Customer data is not used to train Google's models or for advertising. You can delete it whenever you want.
Google's restricted access
Google employees do not access customer data by default. Access Transparency logs every exceptional access.
Did you get this topic?
Test what you just learned
A financial services company stores sensitive customer data in BigQuery. Their main concern is that an administrator with access could copy that data to a personal GCP project. Which service should they implement to prevent this?
Put what you learned to the test with original CDL exam questions.
Start CDL mock examUnlimited mock exams with the Pro plan
Log in to track your progress.