In the August 2026 revision of the Cloud Digital Leader exam guide, Domain 5 (about 18%) expanded significantly toward security operations and AI security. Security operations (SecOps) terms, protecting every layer of the AI stack, Google Threat Intelligence, Security Command Center, Google Security Operations, Gemini in Security Operations, AI Protection, and Model Armor are all new names on the list. Where the previous guide centered on fundamentals such as IAM and encryption, the exam now also asks "how do you learn about attacks in advance, find them, and respond?" and "how do you protect AI?"
This post starts with the basic terms of security operations, then covers what it means to make Google part of your security team, threat intelligence, Security Command Center, Google Security Operations, and protecting the AI stack with Model Armor. Fundamentals such as the CIA triad, IAM, and the shared responsibility model are in Security and Trust Fundamentals, and security products such as zero trust and Cloud Armor are in Security Concepts and Product Map.
---
The Basic Terms of Security Operations (SecOps)
Picture the security of a large building. Someone checks that the doors and windows are locked, keeps up with the latest crime methods the police share, and watches the CCTV in the control room, sending a guard when something suspicious shows up. Security operations in the cloud does the same work in a digital environment.
| Term | Meaning | In building-security terms | |------|------|------| | Security posture | The overall state of how securely your systems are configured right now | Whether the doors, windows, and alarms are locked and switched on | | Threat intelligence | Information about who is targeting what, and how | The latest crime methods the police tell you about | | Threat detection | Finding signs of attack in logs and signals | The control room spotting suspicious movement on CCTV | | Threat response | Stopping the attack, limiting the damage, and recovering | Sending guards and locking down access | | Security operations center (SOC) | The team that runs detection and response around the clock | The control room | | SIEM | A system that gathers security logs from many places, correlates them, and finds threats | One control screen that brings every CCTV feed together | | SOAR | A system that automatically runs predefined response procedures (playbooks) | A device that locks the doors automatically when the alarm goes off | | Cyber resilience | The ability to keep core operations running and recover quickly even under attack | Staying up on a backup generator during a blackout |
Exam tip: "How securely things are configured right now" is security posture, "information about attackers and their methods" is threat intelligence, and "stopping the attack and recovering" is threat response. Answer choices that swap these three terms show up often.
---
Making Google Part of Your Security Team: Defense in Depth
The exam guide opens this area with "the business value of making Google part of an organization's security team." Moving to the cloud does not mean handing security off to Google; it means one of the largest security organizations in the world joins your team. Underneath that is defense in depth, which stops attacks with several layers.
| What Google takes on | What it includes | What the organization gets | |------|------|------| | Secure-by-design infrastructure | Its own data centers, purpose-built servers and networking equipment, and custom security chips such as Titan | Less risk at the hardware and supply-chain level | | Security by default | Data at rest and in transit is encrypted with no extra setup | You start from a protected state | | Threat visibility | Attack data gathered by protecting billions of users, plus Mandiant's incident response experience | Use the latest attack information right away | | AI-powered security tools | Security Command Center, Google Security Operations, Gemini assistance | Defend a large environment with a small team |
Secure by design means security is built in as the default from the design stage, not bolted on later. If the exam asks why Google Cloud's infrastructure is secure, the candidates are its own data centers, purpose-built servers and networking, and custom security hardware and software.
---
Google Threat Intelligence: Know the Attacker First
Threat intelligence works like a weather forecast. If you know it will rain, you bring an umbrella; if you know which attackers are targeting your industry and how, you can decide in advance where to defend. Google Threat Intelligence combines three unique sources to give a single unified verdict on whether an indicator is a threat to your organization.
| Source | What it sees | Strength | |------|------|------| | Google's vast global visibility | The phishing, malware, and attack attempts seen while protecting billions of users | The latest attack trends at worldwide scale | | Mandiant's frontline experience | Attacker information gathered by investigating and responding to real breaches | Depth on how attackers actually operate | | VirusTotal's crowdsourced detection | A huge database of analyses of files and URLs submitted by users around the world | Quickly judging suspicious files and links |
On top of that, Gemini analyzes and summarizes the vast threat data to surface the threats most relevant to your organization's risk profile first. The business value is the shift from reacting after the fact to preparing in advance, plus the ability to decide which of the flood of alerts to handle first.
Exam tip: If the answer choices mention Mandiant or VirusTotal and the question asks about "proactive insight into attackers and threats," the answer is Google Threat Intelligence.
---
Security Command Center: Your Cloud's Security Checklist
Security Command Center (SCC) is a risk management solution for Google Cloud environments. Like a building safety checklist combined with an alarm system, it finds what is misconfigured, alerts you to active threats, and tells you what to fix first.
| Area | What it does | Example | |------|------|------| | Vulnerability detection | Finds misconfigurations, publicly exposed resources, leaked credentials, and known vulnerabilities | A Cloud Storage bucket left open for anyone to read | | Threat detection and mitigation | Detects attacks in progress | Malware, cryptocurrency mining, container runtime attacks, DDoS | | Postures and policies | Defines the security state you want and alerts you when things drift from it | Finding over-permissioned accounts | | Compliance | Checks compliance against standards such as NIST, HIPAA, PCI-DSS, and CIS | PCI-DSS checks for a payment system | | Data export | Sends findings to BigQuery or Pub/Sub for further analysis | Feeding a security dashboard |
SCC is offered in Standard and Premium tiers. The official documentation notes that the former Enterprise tier shuts down on May 21, 2027, after which organizations move automatically to Premium. For the CDL exam, "what the product does" matters more than the differences between tiers.
Exam tip: "Proactively find misconfigurations and vulnerabilities across the Google Cloud environment, prioritize them, and fix them" is Security Command Center. "Public bucket," "over-permissioned," and "cryptomining detection" are the clues.
---
Google Security Operations: Collect Logs, Find Threats, Respond
Google Security Operations (Google SecOps, formerly Chronicle) is a unified security operations platform that brings an organization's security telemetry into one place to detect, investigate, and respond to threats. If SCC checks "is our cloud configured securely?", Google SecOps is the 24/7 control room that handles "is an attack happening somewhere right now, and how do we respond?"
!The collect, detect, investigate, and respond flow of Google Security Operations, supported by threat intelligence and Gemini
| Stage | What happens | |------|------| | Collect | Ingest large volumes of logs from on-premises, multiple clouds, SaaS, and endpoints, and keep them for a long time | | Detect | Normalize the data into the Unified Data Model (UDM) and link it to detection rules and threat intelligence | | Investigate | Group related alerts into cases and search by asset, IP, user, or domain | | Respond | Run actions such as isolating, blocking, and notifying quickly through automated playbooks |
Gemini in Security Operations
Gemini takes load off security analysts. The features listed in the official documentation are:
Turn a natural-language question into a search query and run it Generate a detection rule (YARA-L) from a natural-language description Answer and summarize questions about threat actors and indicators of compromise Summarize a case and suggest how to resolve it Create and edit playbooks A triage and investigation agent that analyzes alerts and decides whether they are real attacks or false positives
SCC vs. Google SecOps
| Aspect | Security Command Center | Google Security Operations | |------|------|------| | Scope | The Google Cloud environment (organization and projects) | The whole organization, including on-premises, other clouds, and SaaS | | Main question | Is our cloud configured securely? Where are the risks? | Is an attack happening now? How do we respond? | | Core capabilities | Vulnerabilities, misconfigurations, threat detection, security posture, compliance | SIEM (collection, detection, search) and SOAR (case management, automated response) | | Analogy | A building safety checklist | A 24/7 control room |
Exam tip: "Bring security logs from many sources into one place to detect and respond to threats quickly" and "unified security operations platform" both point to Google Security Operations.
---
Protecting Every Layer of the AI Stack
Adopting AI creates new targets for attackers. The exam guid