GCP PCA · Domain 3 of 6

GCP PCA Domain 3: Designing for security and compliance

Section 3 tests how you build protection and regulatory fit into a design: identity, resource hierarchy, encryption keys, perimeters, secure access, software supply chain, AI safeguards and evidence for audits.

Exam weight
~17.5%
Official objectives
2
Estimated questions estimate
9–11
Suggested study time estimate
14–18 hrs

About 12 min read Reviewed October 2026

Overview

Section 3 has only two objectives, but each is broad. Objective 3.1, designing for security, lists IAM, the organization-folder-project hierarchy, key and secret management, separation of duties, and controls such as audit logging, VPC Service Controls, context-aware access, organization policies and hierarchical firewall policies. It adds customer-managed encryption keys in Cloud KMS, secure remote access through Identity-Aware Proxy, service account impersonation, Chrome Enterprise Premium and Workload Identity Federation, plus software supply chain security and AI protection with Model Armor and Sensitive Data Protection.

Objective 3.2, designing for compliance, covers legislation such as health record, children's and general data privacy, data ownership and sovereignty, commercial rules for card data and PII, industry certifications such as SOC 2, and audits backed by logs.

How it's tested

Security questions describe a risk or regulation and ask for the control that addresses it with least privilege and minimal friction. Expect choices between preventive and detective controls, between identity-based and network-based protection, and between Google-managed and customer-managed keys. The best answer is usually layered and enforced centrally.

  • Least privilege fit

    Pick the narrowest predefined or custom role at the right level of the hierarchy, often granted to a group instead of individual users.

  • Data exfiltration defense

    Choose VPC Service Controls, organization policies or Sensitive Data Protection to stop sensitive data leaving approved boundaries.

  • Regulation to control

    Map a law or standard such as health privacy, card data rules or data residency to location, encryption, logging and access settings.

Reasoning it through

A hospital network wants analysts to query patient data in BigQuery but fears a stolen credential could copy tables to a personal project. IAM alone cannot stop a valid user exporting data. A VPC Service Controls perimeter around the BigQuery and Cloud Storage projects blocks copies to resources outside it, while Cloud Audit Logs record access for compliance reviews.

Objectives 2

Official objectives from the Google Cloud outline, in outline order.

3.1 Designing for securityIAM, hierarchy, key and secret management, separation of duties, perimeters, remote access, supply chain, AI security.
What it means
This objective covers protecting a solution by design. The guide lists Identity and Access Management, the resource hierarchy of organizations, folders and projects, data security through key management, encryption and secret management, separation of duties, and security controls such as auditing, VPC Service Controls, context-aware access, organization policy and hierarchical firewall policy. It also names customer-managed encryption keys in Cloud KMS, secure remote access options, software supply chain security, and securing AI with Model Armor, Sensitive Data Protection and secure model deployment.
What to understand
IAM policies inherit down the hierarchy, so grant at the highest level that is still narrow enough and prefer groups over users. Organization policy constraints restrict what anyone can do, for example allowed resource locations or blocking service account key creation. CMEK in Cloud KMS gives control over key rotation and revocation, and Cloud HSM or Cloud External Key Manager raise that control further. Secret Manager stores credentials. Identity-Aware Proxy and Chrome Enterprise Premium give zero trust access without a VPN, and Workload Identity Federation lets external workloads use short-lived tokens instead of keys. Binary Authorization and Artifact Analysis protect the supply chain. Model Armor screens prompts and responses for injection and harmful content.
How it shows up
Expect scenarios asking for the control that blocks a specific threat, such as key leakage, data exfiltration, untrusted images or prompt injection.
Common confusion
IAM controls who can act; VPC Service Controls limit where data can go even for authorized identities.
3.2 Designing for compliancePrivacy and sovereignty law, card data and PII, industry certifications such as SOC 2, audits and logs.
What it means
This objective covers meeting external obligations. It includes legislation and regulation such as health record privacy, children's privacy, data privacy, data ownership and data sovereignty, commercial requirements such as handling card data and personally identifiable information, industry certifications such as SOC 2, and audits including logs.
What to understand
Google provides a compliant platform, but the customer configures workloads to stay compliant under the shared responsibility model. Data residency is enforced with organization policy resource location constraints and, where sovereignty is strict, Assured Workloads or sovereign cloud offerings. Card data environments should be isolated in their own projects with tight perimeters. Sensitive Data Protection discovers, classifies and de-identifies PII. Cloud Audit Logs record admin activity by default; data access logs must be enabled for most services, and logs can be routed to locked buckets for retention.
How it shows up
Questions present a regulation or audit finding and ask which configuration demonstrates or enforces compliance.
Common confusion
A Google compliance certification does not make your own application compliant automatically.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Resource hierarchy

    Organization, folders and projects, with policies inherited downward.

    Remember
    A grant at a folder applies to every project under it.
    Tested as
    Structuring teams and environments.
    Trap
    Granting broad roles at the organization for convenience.

  • Organization policy

    Constraints that limit configurations across the hierarchy.

    Remember
    Preventive and applies regardless of IAM permissions.
    Tested as
    Residency and key-creation controls.
    Trap
    Confusing it with IAM allow policies.

  • VPC Service Controls

    Service perimeters around Google APIs to reduce data exfiltration.

    Remember
    Blocks data movement to projects outside the perimeter.
    Tested as
    Sensitive analytics and storage.
    Trap
    Thinking it replaces firewall rules for VM traffic.

  • CMEK

    Customer-managed encryption keys in Cloud KMS used by Google services.

    Remember
    Disabling the key makes the data unreadable.
    Tested as
    Key control requirements.
    Trap
    Assuming data is unencrypted without CMEK; Google encrypts at rest by default.

  • Cloud External Key Manager

    Keys held in a supported external key manager outside Google.

    Remember
    Strongest separation of key custody.
    Tested as
    Sovereignty scenarios.
    Trap
    Choosing it when CMEK alone meets the requirement.

  • Identity-Aware Proxy

    Identity and context-based access to applications and VMs.

    Remember
    Replaces bastion hosts and VPNs for many access needs.
    Tested as
    Secure remote access.
    Trap
    Opening SSH to the internet with firewall rules instead.

  • Workload Identity Federation

    Lets workloads outside Google Cloud use external identities for short-lived access.

    Remember
    Removes long-lived service account keys.
    Tested as
    CI systems and other clouds.
    Trap
    Creating and storing a service account key in the pipeline.

  • Service account impersonation

    Temporarily acting as a service account with a granted role.

    Remember
    Auditable and avoids downloading keys.
    Tested as
    Admin and automation access.
    Trap
    Giving users the service account key file.

  • Binary Authorization

    Admission control that lets only signed or approved images deploy.

    Remember
    Enforces supply chain policy at deploy time.
    Tested as
    Software supply chain questions.
    Trap
    Relying on scanning alone without enforcement.

  • Model Armor

    Screens model prompts and responses for prompt injection, jailbreaks and sensitive data.

    Remember
    Named in the guide for securing AI.
    Tested as
    Generative AI features in case studies.
    Trap
    Relying only on the model's built-in safety settings.

  • Sensitive Data Protection

    Discovery, classification and de-identification of sensitive data.

    Remember
    Masking, tokenization and redaction options.
    Tested as
    PII and AI training data.
    Trap
    Using it as an access control system.

  • Assured Workloads

    Folder-level controls for regulated workloads such as data location and personnel access.

    Remember
    Packages compliance controls for specific regimes.
    Tested as
    Government and sovereignty scenarios.
    Trap
    Assuming it applies to the whole organization automatically.

  • Cloud Audit Logs

    Four log types in Google Cloud: Admin Activity, Data Access, System Event and Policy Denied.

    Remember
    Data Access logs are off by default for most services.
    Tested as
    Audit evidence.
    Trap
    Believing all reads are logged without enabling them.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Encryption key options

ConceptMeaningKey differenceCommon trap
Google default encryption Google manages keys automatically. No customer action or control. Thinking data is unencrypted without CMEK.
CMEK (Cloud KMS) Customer controls keys in Google Cloud. Rotation, disablement and audit by the customer. Forgetting key location must match data location.
Cloud HSM CMEK backed by FIPS 140-2 Level 3 hardware. Hardware protection of key material. Choosing it when software keys meet policy.
Cloud EKM Keys stay in an external manager. Key custody outside Google. Ignoring availability risk if the external manager fails.

Access control layers

ConceptMeaningKey differenceCommon trap
IAM Who can do what on which resource. Identity-based permissions. Assuming it stops authorized data copying.
Organization policy What configurations are allowed. Guardrails independent of identity. Using it to grant access.
VPC Service Controls Where API data may flow. Perimeter around services. Expecting it to filter VM ports.
Hierarchical firewall policy Network rules set at organization or folder. Central network enforcement above VPC rules. Thinking project admins can override deny rules.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Keys for automation

    What candidates pick
    Create a service account key and store it in the CI tool.
    Why it looks right
    It works with any external system.
    Why it's wrong
    Long-lived keys leak easily; Workload Identity Federation gives short-lived tokens without stored keys.

    Clue to watch for An external CI system or another cloud.

  2. IAM for exfiltration

    What candidates pick
    Tighten IAM roles on BigQuery to stop data leaving.
    Why it looks right
    Fewer permissions sound safer.
    Why it's wrong
    Users who legitimately read data can still copy it elsewhere; a VPC Service Controls perimeter blocks that path.

    Clue to watch for Concern about insiders or stolen credentials copying data.

  3. Bastion host for admin access

    What candidates pick
    A public VM with SSH as a jump host.
    Why it looks right
    It is a familiar pattern.
    Why it's wrong
    Identity-Aware Proxy TCP forwarding gives identity-checked access without exposing SSH to the internet.

    Clue to watch for Requirement to avoid public IPs or VPNs.

  4. Compliance by certification

    What candidates pick
    Point to Google's certifications as proof of compliance.
    Why it looks right
    Google holds many certifications.
    Why it's wrong
    Shared responsibility means the customer must configure and evidence controls for its own workloads.

    Clue to watch for An auditor asking about the customer's own controls.

  5. Region choice only

    What candidates pick
    Deploy in an EU region to meet residency rules.
    Why it looks right
    Location seems to settle residency.
    Why it's wrong
    Without a location constraint, someone can create resources elsewhere; organization policy enforces it.

    Clue to watch for A requirement that data must never leave a jurisdiction.

  6. Model safety settings only

    What candidates pick
    Rely on Gemini safety filters to stop prompt injection.
    Why it looks right
    Built-in filters exist.
    Why it's wrong
    Model Armor adds screening for injection, jailbreaks and data leakage across models and applications.

    Clue to watch for A public generative AI feature handling user input.

Answer framework

Use these steps for security and compliance scenarios in Section 3.

  1. Name the asset and the threat or obligation: what data, which regulation, and whether the risk is access, exfiltration, tampering or residency.
  2. Choose identity controls first, granting the narrowest predefined role to a group at the correct level of the resource hierarchy.
  3. Add organization-wide guardrails with organization policies, hierarchical firewall policies and service perimeters where data must not leave.
  4. Decide key custody: default encryption, CMEK, Cloud HSM or external keys, matching the strictest requirement in the stem without exceeding it.
  5. Confirm evidence: enable the right audit logs, route them to retained storage, and classify sensitive data so auditors can verify controls.

Practice question

A retailer's build system runs in another cloud and deploys container images to GKE in Google Cloud. Security requires no long-lived credentials and only images signed by the build system may run in production. What should the architect design?

Want more like this? The GCP PCA practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Organize study around layers. Start with the resource hierarchy and IAM, because inheritance explains many answers: draw an organization with folders for production and development, then mark where each role should be granted. Next study guardrails that work independently of identity: organization policies, hierarchical firewall policies and VPC Service Controls. Write one sentence for each describing the exact threat it blocks.

Then cover keys and access. Compare default encryption, CMEK, Cloud HSM and external keys in a table, and practice replacing service account keys with impersonation and Workload Identity Federation. Add supply chain controls and the AI safeguards the 2026 guide introduces, Model Armor and Sensitive Data Protection. For compliance, reread the EHR Healthcare and KnightMotives case studies and list every regulatory clue, then map each to a control. Finish by enabling Data Access logs in a lab so you remember they are off by default. Allow 14 to 18 hours.

FAQ

What share of the exam does Designing for security and compliance cover?

Google weights this section at about 17.5%, which suggests roughly 9 to 11 questions. Security reasoning also influences answers in design, migration and operations questions elsewhere.

Why does the section have only two objectives?

Google groups all security design under 3.1 and all compliance design under 3.2. Each objective lists many considerations, so the topic count understates how much material there is.

Is Chrome Enterprise Premium the same as BeyondCorp Enterprise?

Chrome Enterprise Premium is the current name for Google's zero trust access offering previously sold as BeyondCorp Enterprise. The exam guide uses the current name.

What is Model Armor?

Model Armor is a Google Cloud service that screens prompts and responses for prompt injection, jailbreak attempts, harmful content and sensitive data, and it works across models.

Do I need to memorize specific laws?

You need to recognize the kind of obligation, such as health privacy, children's privacy, card data or data sovereignty, and pick matching controls. Detailed legal text is not tested.

Which case studies stress this section?

EHR Healthcare has healthcare privacy and availability needs, and KnightMotives Automotive has EU data protection, residency and past security breaches. Cymbal Retail also protects customer data.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

Check whether you can choose the right IAM, perimeter, key and compliance controls for regulated Google Cloud workloads.

Take the GCP PCA practice test Check your GCP PCA readiness

Keep going