Google Cloud Security Engineer Exam Guide 2026

The Professional Cloud Security Engineer exam now tests AI workload security, Privileged Access Manager and Workload Identity Federation, so candidates revising from older outlines are preparing for a narrower exam than the one Google delivers. This guide sets out what Google Cloud itself publishes about the certification: format, length, fee, the five exam sections and their weightings, recommended experience, the two-year validity and the renewal and retake rules. It adds a phased preparation plan built around the products the exam guide names, and shows where the credential sits next to vendor-neutral and other provider certifications. It is written for cloud, platform and security engineers deciding whether to sit the exam, and for managers who fund it. Facts are as published by Google Cloud and checked on 24 October 2026; confirm on the linked Google pages before you book.

Key takeaways

It is a hands-on Google Cloud credential. Google describes the role as designing and implementing secure workloads and infrastructure on Google Cloud using Google security technologies, so the exam rewards product knowledge, not general theory.
The format is short and fixed. Two hours, 50 to 60 multiple choice and multiple select questions, a USD 200 fee plus tax, in English or Japanese, online or at a test centre.
Access carries the most weight. Configuring access is about 25% of the exam, and service accounts, Workload Identity Federation and short-lived credentials appear by name, so identity is the best place to start revising.
There are no prerequisites, but experience matters. Google recommends three or more years of industry experience, including more than one year designing and managing solutions on Google Cloud.
Validity is two years, renewal is by exam. The renewal window opens 60 days before the certification becomes inactive; this exam has no continuing education path or shorter renewal exam on the pages checked.

Who the certification is for

Google's exam guide says a Cloud Security Engineer is proficient in Identity and Access Management, defining the resource hierarchy and policies, data protection, network security defences, threat monitoring, security automation, securing AI workloads, securing the software supply chain and enforcing regulatory controls. That is a builder's role: the person who writes the organisation policies and VPC Service Controls perimeters, not only the person who reviews them.

Good fit: security engineers and platform engineers who run production on Google Cloud, landing zone owners, and consultants who build or assess Google Cloud environments. See the Google Cloud Security Guide.
Good fit for multi-cloud teams: engineers who already hold an AWS or Azure security credential and need to show equivalent depth on Google Cloud. See the AWS Certified Security Specialty Guide and the Microsoft Security Certifications Guide.
Consider the other security exam: Google also offers a Professional Security Operations Engineer certification, which assesses platform operations, data management, threat hunting, detection engineering, incident response and observability, with recommended experience of 1+ years using Google Cloud security tooling. SOC and detection staff may find it the closer match.
Weaker fit: people who need a vendor-neutral credential for governance, audit or architecture roles across several providers. See the CCSP Certification Guide and the CCSK Certification Guide.

Exam format and domains

Format

Item	What Google Cloud publishes	Source
Length	2 hours	Certification page
Questions	50 to 60, multiple choice and multiple select	Certification page
Registration fee	USD 200 (plus tax where applicable)	Certification page
Languages	English, Japanese	Certification page
Delivery	Online-proctored from a remote location, or onsite-proctored at a testing centre	Certification page
Prerequisites	None	Certification page
Minimum age	18	Certification FAQ
Practice material	Official sample questions and a Google Cloud Skills Boost learning path linked from the certification page	Certification page

Two hours for up to 60 questions allows about two minutes a question. Many questions are scenario-based and turn on choosing the right product or setting, so time pressure comes from reading, not calculation.

The five sections

Section names and approximate weightings are from the English exam guide PDF linked from the certification page; the PDF carries no version number or date. The HTML exam guide page showed an older outline without the AI subsection when checked, so treat the PDF as the reference and recheck it before you book. The final column is our suggestion of practical reading, not part of the guide.

Section	Name	Weight	Subsections and named products	Where to see it in practice
1	Configuring access	~25%	1.1 Cloud Identity (Google Cloud Directory Sync, super administrator accounts); 1.2 service accounts (keys, short-lived credentials, Workload Identity Federation, impersonation, default service accounts); 1.3 authentication (SAML, OAuth, two-factor, Workforce Identity Federation); 1.4 authorisation (IAM conditions, IAM deny policies, Access Context Manager, Policy Intelligence, Privileged Access Manager); 1.5 resource hierarchy and organisation policies	Google Cloud IAM and Service Accounts Guide, Google Cloud Organization Policy Guide
2	Securing communications and establishing boundary protection	~22%	2.1 perimeter security (Cloud NGFW, Identity-Aware Proxy, load balancers, Certificate Authority Service, Google Cloud Armor, Secure Web Proxy, Cloud DNS); 2.2 boundary segmentation (Shared VPC, VPC peering, VPC Service Controls); 2.3 private connectivity (Private Google Access, Private Service Connect, HA VPN, Cloud Interconnect, Cloud NAT)	Network Segmentation Guide
3	Ensuring data protection	~23%	3.1 sensitive data and data loss (Sensitive Data Protection, Secret Manager, access to BigQuery, Cloud Storage and Cloud SQL); 3.2 encryption at rest, in transit and in use (CMEK, Cloud External Key Manager, Confidential Computing); 3.3 securing AI workloads (controls for IaaS- and PaaS-hosted training, and for Gemini Enterprise Agent Platform)	Secrets Management Guide, Google Vertex AI Security Guide
4	Managing operations	~19%	4.1 automating infrastructure and application security (CVE scanning in CI/CD, Binary Authorization for GKE or Cloud Run, image hardening, posture and drift detection with custom organisation policies and Security Health Analytics custom modules); 4.2 logging, monitoring and detection (VPC flow logs, Packet Mirroring, Cloud IDS, Log Analytics, Cloud Audit Logs, Security Command Center)	Cloud Incident Response Guide
5	Supporting compliance requirements	~11%	5.1 shared responsibility, Assured Workloads, organisation policies, Access Transparency, Access Approval, regionalisation of data and services, mapping requirements to controls and audit log coverage	Cloud Security Guide

Where identity fits: Section 1.2 is the clearest non-human identity content in any cloud provider exam. It names securing default service accounts, mitigating the use of service account keys, short-lived credentials, Workload Identity Federation and impersonation. These are the controls that stop a leaked key from becoming a breach, and they also appear indirectly in data protection and operations scenarios. See the Workload Identity Federation Guide.

How the sections map to NIST CSF 2.0

This mapping is ours, not Google's, and is useful when you need to explain to a manager which capabilities the certification evidences.

Exam section	NIST CSF 2.0 outcomes
1 Configuring access	PR.AA-01 identities and credentials managed; PR.AA-05 access permissions with least privilege and separation of duties
2 Boundary protection	PR.IR-01 networks and environments protected from unauthorised logical access; PR.DS-02 data in transit
3 Data protection	PR.DS-01 data at rest; PR.DS-02 data in transit
4 Managing operations	PR.PS-01 configuration management; ID.RA-01 vulnerabilities identified; DE.CM-01 and DE.CM-09 monitoring; DE.AE-02 analysis of adverse events
5 Compliance	GV.OC-03 legal, regulatory and contractual requirements understood and managed

Prerequisites and experience

Formal prerequisites: none. Anyone aged 18 or over can register.
Recommended experience: three or more years of industry experience, including more than one year designing and managing solutions using Google Cloud. This is guidance, not a gate, and nothing is verified at registration.
What the recommendation means in practice: you should have created organisation policies, scoped IAM at folder and project level, configured a VPC Service Controls perimeter, routed audit logs through an aggregated sink, and worked with Security Command Center findings, not only read about them.
If you lack production exposure: build a personal organisation or sandbox with at least two folders and several projects, so you can practise inheritance, organisation policy constraints and Shared VPC, which a single project cannot show.

Preparation plan

The plan below assumes about eight to ten weeks of part-time study for someone who meets the recommended experience. Compress it if you already run Google Cloud security day to day.

Baseline (week 1): download the exam guide PDF, try the official sample questions, and score yourself against each subsection in the table above. Note any product you have never configured.
Identity first (weeks 2 to 3): section 1 is the heaviest. Practise disabling service account key creation with organisation policy, replacing keys with Workload Identity Federation, granting impersonation instead of keys, writing IAM conditions and deny policies, and configuring Privileged Access Manager for just-in-time grants.
Network and perimeter (weeks 4 to 5): build a Shared VPC with hierarchical firewall policies, put a VPC Service Controls perimeter around a project with BigQuery and Cloud Storage, test a dry-run perimeter before enforcing it, and set up Private Google Access and Private Service Connect.
Data and AI (week 6): compare default encryption, CMEK and Cloud External Key Manager and know when each is required; run Sensitive Data Protection inspection and de-identification; store and rotate secrets in Secret Manager; read Google's documentation for the AI platform the exam guide names and note which IAM, network and data controls apply.
Operations (week 7): enable Data Access audit logs selectively, create an aggregated sink at organisation level, query logs in Log Analytics, triage Security Command Center findings, and enforce Binary Authorization on a test GKE cluster or Cloud Run service.
Compliance (week 8): learn what Assured Workloads, Access Transparency and Access Approval each provide, and how resource location constraints support data residency.
Exam rehearsal (weeks 9 to 10): take timed practice at 60 questions in two hours, review every wrong answer back to the product documentation, and book only when your weakest section is consistently at your target.

Measuring readiness

Section spread: no section more than about 15 points below your average in practice tests.
Lab coverage: you have configured, not only read about, every product named in sections 1 and 2.
Timing: full practice runs finished inside two hours with time to review flagged questions.
Explain-back: you can explain, without notes, when to use a VPC Service Controls perimeter versus IAM alone, and CMEK versus Cloud External Key Manager.

Small vs large organisations: in a small organisation the candidate often owns everything from Cloud Identity to logging and sees the whole exam in daily work, but may never have used Assured Workloads or Interconnect; lab those. In a large organisation, candidates usually work inside a landing zone someone else built, so they should study the organisation-level settings (hierarchy, organisation policies, aggregated sinks) they rarely touch.

Cost, renewal and continuing education

Item	Rule (Google Cloud, checked October 2026)
Exam fee	USD 200 plus tax where applicable
Validity	All Professional certifications are valid for two years from the date you certify
Renewal window	Opens 60 days before the inactive date; a successful renewal adds two years
Renewal method	Pass the exam again; Google lists continuing education and a shorter renewal exam only for other certifications, not this one
Renewal discount	A 50% renewal discount code is issued on initial certification and held in the CM Connect profile
Late renewal	Possible up to 30 days after the inactive date; after that you sit the standard exam at full price
Early attempts	Taking the same exam while certified and outside the renewal window can lead to rejected results or revocation
Retakes	Up to four attempts in 24 months; wait 14 days after the first failure, 60 days after the second and 365 days after the third; each attempt is paid

Because renewal means passing the current exam, holders re-sit whatever outline is live two years later. Keep a light watch on the exam guide during your validity period rather than starting from scratch 60 days before expiry.

Common failure patterns

Revising an old outline: material that predates the AI subsection, Privileged Access Manager, IAM deny policies or Secure Web Proxy will leave gaps. Check every course against the current PDF.
Treating keys as a footnote: the exam expects you to prefer federation and impersonation over exported keys. The Google API keys exposure shows how a credential assumed to be harmless became sensitive when new services were enabled, the same reasoning the exam applies to credential scope.
Knowing products but not the hierarchy: many questions turn on where a policy is set (organisation, folder, project or resource) and how it inherits. Single-project lab work misses this.
Enforcing perimeters blind: candidates forget dry-run mode for VPC Service Controls and which logs show what a perimeter would block, which matters in both the exam and production.
Underestimating compliance: at about 11% it is small, but Assured Workloads, Access Transparency and Access Approval are easy to confuse without hands-on time.
Missing the renewal window: the window is only 60 days and there is no short renewal exam, so late renewers pay full price after the 30-day grace.

Where it fits on the career path

Before it: an associate-level Google Cloud credential or solid Google Cloud administration experience, plus general security grounding. See the Cybersecurity Certifications Guide.
Alongside it: a vendor-neutral cloud credential such as the CCSP adds governance and legal breadth; the Certified Kubernetes Security Specialist (CKS) Guide adds depth for GKE-heavy teams.
Roles: cloud security engineer, platform security engineer and cloud security architect. See the Cloud Security Engineer Career Guide.
Choosing between Google's two security exams: pick Cloud Security Engineer if you build and harden environments, and Security Operations Engineer if you detect, hunt and respond.

Google does not publish pass rates or salary figures on the pages checked for this guide, and we do not quote third-party estimates.

Practitioner checklist

Download the current exam guide PDF and confirm the section weightings and the AI subsection before buying any course.
Check your experience against the three-year, one-year-on-Google-Cloud recommendation and plan lab time to close gaps.
Build a multi-folder, multi-project sandbox so you can practise inheritance, organisation policies and Shared VPC.
Start with section 1: service accounts, Workload Identity Federation, IAM conditions and deny policies, Privileged Access Manager.
Configure a VPC Service Controls perimeter in dry-run, review the logs, then enforce it.
Know the differences between default encryption, CMEK and Cloud External Key Manager, and when Confidential Computing applies.
Take the official sample questions early and late, and timed practice at 60 questions in two hours.
Record your certification date, note the 60-day renewal window and keep the 50% renewal code safe.

Google Professional Cloud Security Engineer Guide: Exam, Requirements and Preparation