CDL
Deep Dive
What Google Cloud secures vs what is the customer's responsibility. How it changes depending on the service model (IaaS, PaaS, SaaS).
In the cloud, security is a shared responsibility between the provider (Google Cloud) and the customer. Google is responsible for the security of the cloud; the customer is responsible for security in the cloud.
| Layer | IaaS (Compute Engine) | PaaS (App Engine / GKE) | SaaS (Google Workspace) |
|---|---|---|---|
| User data | 👤 Customer | 👤 Customer | 👤 Customer |
| Access and identity (IAM) | 👤 Customer | 👤 Customer | 👤 Customer |
| Apps and code | 👤 Customer | 👤 Customer | ☁️ Google |
| OS and runtime | 👤 Customer | ☁️ Google | ☁️ Google |
| Virtual network | 👤 Customer | ☁️ Google | ☁️ Google |
| Hardware / physical | ☁️ Google | ☁️ Google | ☁️ Google |
| Data centers | ☁️ Google | ☁️ Google | ☁️ Google |
Key rule for the exam
The customer is ALWAYS responsible for their data and access control (IAM), regardless of the service model. Google is ALWAYS responsible for the physical security of the hardware and data centers. The difference lies in the intermediate layers.
Custom hardware and Titan
Google designs its own hardware (servers, network chips). Titan is the custom security chip that verifies the integrity of the hardware and bootloader before the OS starts.
Encryption at rest
All data stored in Google Cloud is automatically encrypted at rest with AES-256. No additional configuration needed. Google manages the keys by default (GMEK), but the customer can use CMEK or CSEK.
Encryption in transit
All traffic between Google's data centers travels over Google's private network, encrypted with TLS. Traffic between the customer and GCP services is also encrypted in transit.
Global private network
Google's private fiber network connects its datacenters with more than 1 million km of fiber cable and 33 subsea cables. Traffic does not pass over the public internet.
Zero Trust: Chrome Enterprise Premium
Google implemented Zero Trust internally (the BeyondCorp project) more than a decade ago, now available as Chrome Enterprise Premium. There is no "secure perimeter" — every access is continuously verified based on identity, device, and context.
Google-managed (GMEK)
Google automatically manages the encryption keys. No customer configuration required.
When to use
Most cases. No operational overhead.
Customer-managed (CMEK)
The customer creates and manages keys in Cloud KMS. Google uses those keys to encrypt but cannot use them without the customer.
When to use
Compliance requirements that demand control over keys.
Customer-supplied (CSEK)
The customer supplies their own keys with each request. Google never stores the key on disk.
When to use
Maximum control. If you lose the key, you lose the data.
The CDL exam evaluates whether you know current threats and how the cloud helps mitigate them. Companies face these threats regardless of whether they are in the cloud or on-premises.
Phishing and social engineering
Tricking employees into revealing credentials or installing malware. It is the number 1 attack vector worldwide. It does not require sophisticated technical hacking — only human deception.
Business impact
Credential theft → unauthorized access to systems. Loss of confidential data.
Ransomware
Malware that encrypts a company's files and demands a ransom to unlock them. Modern attacks also steal data before encrypting it (double extortion).
Business impact
Total operational shutdown. Multi-million dollar ransom costs. Reputational damage.
Insider threats
Employees or contractors who abuse their legitimate access, either maliciously or by mistake. Hard to detect because they have valid credentials.
Business impact
Exfiltration of sensitive data, system sabotage, financial fraud.
DDoS (Distributed Denial of Service)
Thousands of compromised devices bombard a server with traffic until it collapses. Prevents legitimate customers from accessing the service.
Business impact
Revenue loss from downtime. Reputational damage. Mitigation costs.
Confidentiality
Data is only accessible to those authorized. Implemented with: encryption, IAM, VPC Service Controls, Secret Manager.
Integrity
Data is not modified without authorization. Implemented with: checksums, digital signatures, Cloud Audit Logs, version control.
Availability
Systems are available when needed. Implemented with: Managed Instance Groups, Cloud Load Balancing, Cloud Armor (anti-DDoS), multi-region.
Control
The ability to govern and manage access to resources. IAM, Organization Policies, and VPC Service Controls are control mechanisms.
Compliance
Adhering to industry regulations and standards: GDPR, HIPAA, PCI DSS, SOC 2. Google Cloud has 150+ compliance certifications to help customers.
Did you get this topic?
Test what you just learned
A company migrates its applications to Google Cloud using Compute Engine (IaaS). After the migration, which of the following security layers is the customer responsible for?
Put what you learned to the test with original CDL exam questions.
Start CDL mock examUnlimited mock exams with the Pro plan
Log in to track your progress.