Skip to main content

Professional Cloud Security Engineer (PSE) Certification Lab Map

The PSE certification validates your ability to design and implement secure workloads and infrastructure on Google Cloud — identity and access management, perimeter and boundary protection, data protection, security operations, and regulatory compliance. The RAD platform's four foundation modules (Services_GCP, App_CloudRun, App_GKE, App_Common) form a live security lab: they implement least-privilege service accounts, Workload Identity, IAP, Secret Manager with automated zero-downtime rotation, CMEK with plan-time key recovery, Binary Authorization with a KMS signer and attestor, VPC Service Controls with access levels and dry-run mode, Cloud Armor WAF, Kubernetes NetworkPolicy micro-segmentation, audit log configuration, and Security Command Center enrollment — all driven by portal variables you can toggle and observe.

How to use this guide

  • Deploy one of the profiles below from your deployment portal.
  • Work through the matching section guide (PSE_Section_<N>_Exploration_Guide.md) topic by topic.
  • Use the coverage legend to know which exam topics you must study outside the platform — the section guides give concrete study pointers for every 🟡 and 📘 topic.

Coverage legend

SymbolMeaning
Fully demonstrated — deploy it, see it, modify it in the RAD platform
🟡Partially demonstrated — the modules touch the concept; supplement with docs
📘Concept-only — not implemented by the modules; study pointers provided

Deployment profiles

Profile: secure-platform

Purpose: a hardened shared platform exercising CMEK, audit logging, SCC, vulnerability scanning, and Binary Authorization. Modules: Services_GCP.

VariableValue
create_postgrestrue (default)
enable_cmektrue
cmek_key_rotation_period7776000s (default, 90 days)
enable_audit_loggingtrue
enable_security_command_centertrue
enable_scc_notificationstrue
enable_vulnerability_scanningtrue
enable_binary_authorizationtrue
binauthz_evaluation_modeREQUIRE_ATTESTATION
Estimated incremental cost: low–moderate — KMS keys cost cents per month; the dominant drivers are the Cloud SQL instance baseline and increased Cloud Logging volume from DATA_READ/DATA_WRITE audit logs.

Profile: guarded-edge

Purpose: a Cloud Run service protected by IAP, a Cloud Armor WAF behind a global HTTPS load balancer, and automated secret rotation. Modules: App_CloudRun (optionally on top of secure-platform).

VariableValue
enable_iaptrue
iap_authorized_users["user:you@example.com"]
enable_cloud_armortrue
application_domains["app.example.com"] (required when Cloud Armor is on)
enable_auto_password_rotationtrue
secret_rotation_period2592000s (default, 30 days)
enable_audit_loggingtrue
Estimated incremental cost: moderate — the global external Application Load Balancer forwarding rules and the Cloud Armor policy are the dominant drivers; IAP and Secret Manager rotation are negligible.

Profile: zero-trust-gke

Purpose: a GKE Autopilot workload with Workload Identity, NetworkPolicy micro-segmentation, namespace quotas, and IAP at the Gateway. Modules: Services_GCP + App_GKE.

VariableValue
create_google_kubernetes_engine (Services_GCP)true
enable_network_segmentationtrue
enable_resource_quotatrue
enable_custom_domaintrue + application_domains
enable_cloud_armortrue
enable_iaptrue + iap_oauth_client_id, iap_oauth_client_secret, iap_support_email
Estimated incremental cost: high — the GKE Autopilot cluster is the dominant cost driver; the Gateway load balancer and Cloud Armor add a moderate increment.

Profile: perimeter-lab

Purpose: a VPC Service Controls perimeter in dry-run mode around the project's APIs. Requires a project in a GCP organization and org-level Access Context Manager permission. Modules: any of Services_GCP, App_CloudRun, App_GKE (each can create its own perimeter).

VariableValue
enable_vpc_sctrue
admin_ip_ranges["<your-public-ip>/32"] (required — perimeter is skipped without it)
vpc_sc_dry_runtrue (default — audit before enforcing)
organization_id (App_CloudRun / App_GKE only)set only if the project is nested under a folder
Estimated incremental cost: none — VPC-SC, access levels, and Access Context Manager are free.

Section 1: Configuring access (~25% of the exam)

Identity and authorization is where the modules are strongest on the "workload identity" side (dedicated service accounts, Workload Identity, per-resource IAM) and weakest on the "human identity" side (Cloud Identity, SSO, org policy), which you must study separately.

Exam topicCoverageWhere in RADGuide
1.1 Managing Cloud Identity📘identities consumed via iap_authorized_users/groups, support_usersSection 1 guide
1.2 Managing service accountspurpose-built service accounts with Workload Identity; WIF via enable_workload_identity_federation + wif_provider_typeSection 1 guide
1.3 Managing authentication🟡enable_iap on Cloud Run and GKESection 1 guide
1.4 Managing and implementing authorization controlsthe platform's resource-level IAM layer, per-secret/per-bucket IAMSection 1 guide
1.5 Defining the resource hierarchy📘org/folder/standalone detection in the VPC Service Controls layer is the nearest adjacencySection 1 guide

Section 2: Securing communications and establishing boundary protection (~22% of the exam)

The modules implement three distinct boundary layers you can deploy and break on purpose: an edge WAF (Cloud Armor + global HTTPS LB), an API-level data-exfiltration perimeter (VPC Service Controls), and pod-level micro-segmentation (Kubernetes NetworkPolicy on Dataplane V2).

Exam topicCoverageWhere in RADGuide
2.1 Designing and configuring perimeter securityenable_cloud_armor on Cloud Run and GKESection 2 guide
2.2 Configuring boundary segmentationenable_vpc_sc, enable_network_segmentation (Kubernetes NetworkPolicy), private-IP Cloud SQLSection 2 guide
2.3 Establishing private connectivity🟡Direct VPC egress, Private Services Access, Cloud NATSection 2 guide

Section 3: Ensuring data protection (~23% of the exam)

Secret Manager with automated dual-version rotation and CMEK with plan-time key recovery are the standout hands-on labs here. Sensitive Data Protection (DLP) and AI workload security are concept-only.

Exam topicCoverageWhere in RADGuide
3.1 Protecting sensitive data and preventing data loss🟡Secret Manager rotation pipeline, enable_auto_password_rotation; DLP is 📘Section 3 guide
3.2 Managing encryption at rest, in transit, and in useenable_cmek, TLS at the LB; EKM/HSM/Confidential Computing are 📘Section 3 guide
3.3 Securing AI workloads📘not implemented by the foundation modulesSection 3 guide

Section 4: Managing operations (~19% of the exam)

The supply-chain story is fully wired: Cloud Build → Artifact Registry scanning → KMS-signed attestation → Binary Authorization admission enforcement. Detection is covered through audit log configuration and SCC findings routed to Pub/Sub.

Exam topicCoverageWhere in RADGuide
4.1 Automating infrastructure and application securityenable_binary_authorization, enable_vulnerability_scanning, CI/CD attestationSection 4 guide
4.2 Configuring logging, monitoring, and detection🟡enable_audit_logging, enable_security_command_center + enable_scc_notifications; flow logs / sinks / IDS are 📘Section 4 guide

Section 5: Supporting compliance requirements (~11% of the exam)

The modules demonstrate the technical controls that compliance frameworks demand (CMEK, audit trails, least privilege, perimeters) and the shared-responsibility narrowing of GKE Autopilot — but framework mapping, Assured Workloads, and Access Transparency are study-only topics.

Exam topicCoverageWhere in RADGuide
5.1 Adhering to regulatory and industry standards requirements for the cloud🟡composed controls across all four modules; Assured Workloads / Access Transparency are 📘Section 5 guide