In the August 2026 revision of the Cloud Digital Leader exam guide, the first item in Domain 5 (about 18%) is the fundamental concepts of cloud security. It asks about the kinds of threats, from ransomware and phishing to LLM attacks, and their business impact; how cloud security differs from on-premises security; key terms such as zero trust and least privilege; encryption of data in use, in transit, and at rest; and the difference between authentication, authorization, and auditing. It then moves on to security products such as Cloud Armor, IAP, Sensitive Data Protection, Confidential Computing, and Certificate Manager, and to how Google Cloud earns trust through transparency reports, digital sovereignty, and data residency.
This post starts with the kinds of threats, then covers how cloud and on-premises security differ, the key security terms, zero trust, the three states of encryption, authentication, authorization, and auditing, a map of the security products, and the mechanisms that earn customer trust. Fundamentals such as the CIA triad, how IAM is structured, and CMEK are covered in Security and Trust Fundamentals, and security operations products such as Security Command Center and Model Armor in Security Operations and AI Security.
---
Threats Aimed at the Cloud and Their Business Impact
The exam guide asks not just for the names of threats but for the impact each one has on the business.
| Threat | What it is | Business impact | |------|------|------| | DDoS | Floods a service with traffic to knock it offline | Service outages, lost revenue | | Ransomware | Encrypts and locks your data, then demands payment | Operations halt, ransom and recovery costs | | Cryptomining | Secretly uses someone else's computing resources to mine cryptocurrency | Unexpected spikes in cloud bills | | Malware and viruses | Malicious programs installed covertly to steal information or damage systems | Data leaks, damaged systems | | Phishing | Steals passwords through fake emails or websites | Breaches that start with account takeover | | Misconfiguration | Setting mistakes such as public storage or excessive permissions | The most common cause of data leaks | | Unsecured third-party systems | Attacks that come in through partners or outside software | Breaches through the supply chain | | Physical damage | Disasters such as fire, flood, or power outages | Data center outages and data loss | | LLM attacks | Attacks that trick AI models, such as prompt injection and jailbreaks | The AI exposes secrets or takes the wrong action |
Exam tip: "The cloud bill suddenly jumped and unknown VMs are running" is cryptomining. "The data is locked and someone is demanding money" is ransomware. Misconfiguration is often the right answer for the most common cause of data leaks.
---
How Cloud Security Differs from On-Premises Security
On-premises is like guarding your own building yourself; the cloud is like moving into a building run by a professional security company. The security company guards the entrances and the structure, but you still decide who gets the keys to your office.
| Aspect | On-premises | Cloud | |------|------|------| | Physical security | The organization guards its own data center | Google guards the data centers and hardware | | Patches and updates | The organization manages every layer itself | Google handles the infrastructure, and more besides on managed services | | Security boundary | Centered on the corporate network perimeter | Centered on the identity of users and services (who they are) | | Scale and expertise | Limited to the organization's security staff and budget | Draws on one of the world's largest security organizations and automated tools | | Customer responsibility | Almost everything | Data, access permissions, configuration (the shared responsibility model) |
Exam tip: Even after moving to the cloud, data and access settings remain the customer's responsibility. An answer choice saying "once we move to the cloud, Google is responsible for all security" is wrong.
---
Security Terms You Must Know
The exam guide names five things that matter in a security model: control, compliance, confidentiality, integrity, and availability. On top of those, you need to be able to define the following terms precisely.
| Term | Meaning | |------|------| | Least privilege | Grant only the minimum permissions needed for the job | | Privileged access | Powerful administrator rights that can change system settings or see all data; must be managed most strictly | | Zero-trust architecture | Trust no user or network by default and verify every request | | Security by default | A secure configuration applies from the start with no extra setup (for example, default encryption) | | Security posture | The overall state of how securely the organization's systems are configured right now | | Cyber resilience | The ability to keep core operations running and recover quickly even under attack | | Firewall | Allows or blocks network traffic according to defined rules | | Encryption and decryption | Turning data into something unreadable without a key, and turning it back with the key | | Data loss prevention (DLP) | Finding sensitive data and masking or blocking it so it does not leak |
---
Zero Trust: Never Trust, Always Verify
Security used to work like a castle with walls and a moat. Anyone inside the castle was trusted, so once a single wall was breached, an attacker could move freely inside. Zero trust works like airport security, checking identity and boarding pass at every door, every time.
!The shift from perimeter security, which trusts the inside like a castle and moat, to zero trust, which verifies every request
Google first adopted a zero trust model called BeyondCorp internally so employees could work securely from anywhere without a VPN, and now offers it as products.
| Product | What it does | |------|------| | Identity-Aware Proxy (IAP) | A central authorization layer that controls access to applications and VMs by user identity and context instead of network firewalls | | Chrome Enterprise Premium | Applies BeyondCorp-style access across the organization, checking even browser and device status |
Exam tip: "Let remote workers reach internal applications securely without a VPN" is zero trust, such as IAP or BeyondCorp. "Grant access based on the user and device rather than network location" is the key sentence of zero trust.
---
The Three States of Encryption
Data exists in three states: stored, moving, and being processed, and each state is protected differently. Think of money kept in a vault, money carried in an armored truck, and money being counted at a bank teller's window.
| State | Meaning | Google Cloud's default protection | What you can add | |------|------|------|------| | Data at rest | Data stored on disks and in storage | Encrypted automatically with AES-256, no setup needed | Customer-managed encryption keys (CMEK) in Cloud KMS | | Data in transit | Data moving across a network | Encrypted with methods such as TLS, with the other party authenticated | Manage TLS certificates with Certificate Manager | | Data in use | Data being processed in memory | On ordinary VMs it is processed in memory in plaintext | Confidential Computing (such as Confidential VM) |
Confidential Computing encrypts even data that is being processed, using a hardware-based Trusted Execution Environment (TEE). The official documentation calls it "the last piece of end-to-end encryption." Because data at rest and in transit are protected by default, if the exam asks how to protect all three states, the key is the missing piece: data in use.
Exam tip: "No one, including the cloud provider, may see the data even while it is being processed" is Confidential Computing.
---
Authentication, Authorization, and Auditing
The three words look alike but ask different questions. In building-access terms, they are checking your ID, checking which floors you may enter, and keeping a log of who came and went.
| Concept | Question | Google Cloud examples | |------|------|------| | Authentication | Who are you? | Passwords plus two-step verification (2SV) or multi-factor authentication (MFA) | | Authorization | What are you allowed to do? | IAM roles and permissions | | Auditing | Who did what, when, and where? | Cloud Audit Logs recorded in Cloud Logging |
Two-step verification (2SV) adds a second step, such as a phone prompt, to the password, while multi-factor authentication (MFA) uses two or more different kinds of factors: something you know (a password), something you have (a security key or phone), and something you are (a fingerprint). Cloud Audit Logs record audit logs such as Admin Activity, Data Access, System Event, and Policy Denied.
Exam tip: "One more check besides the password when signing in" is stronger authentication (2SV, MFA). "Find out who deleted this bucket" is auditing (Cloud Audit Logs).
---
A Map of Google Cloud Security Products
Organizing the security products named in the exam guide by what they protect gives the following.
| What it protects | Product | What it does | |------|------|------| | Network | Cloud VPC and firewall rules | An isolated private network and rules that allow or block traffic | | Network connectivity | Cloud VPN, Cloud Interconnect | Connects on-premises through an encrypted tunnel or a dedicated line | | Web applications | Cloud Armor | DDoS protection and a web application firewall (WAF) that blocks web attacks such as the OWASP Top 10 | | Certificates | Certificate Manager | Acquires, deploys, and manages TLS certificates for load balancers and more | | Access | IAM, Identity-Aware Proxy | Who can do what, and zero-trust access per application | | Sensitive data | Sensitive Data Protection (formerly Cloud DLP) | Finds and classifies sensitive data, and masks or de-identifies it | | Data being pro