| Topic | Details |
| Topic 1 | - Platform Operations: This section of the exam measures the skills of Cloud Security Engineers and covers the configuration and management of security platforms in enterprise environments. It focuses on integrating and optimizing tools such as Security Command Center (SCC), Google SecOps, GTI, and Cloud IDS to improve detection and response capabilities. Candidates are assessed on their ability to configure authentication, authorization, and API access, manage audit logs, and provision identities using Workforce Identity Federation to enhance access control and visibility across cloud systems.
|
| Topic 2 | - Threat Hunting: This section of the exam measures the skills of Cyber Threat Hunters and emphasizes proactive identification of threats across cloud and hybrid environments. It tests the ability to create and execute advanced queries, analyze user and network behaviors, and develop hypotheses based on incident data and threat intelligence. Candidates are expected to leverage Google Cloud tools like BigQuery, Logs Explorer, and Google SecOps to discover indicators of compromise (IOCs) and collaborate with incident response teams to uncover hidden or ongoing attacks.
|
| Topic 3 | - Data Management: This section of the exam measures the skills of Security Analysts and focuses on effective data ingestion, log management, and context enrichment for threat detection and response. It evaluates candidates on setting up ingestion pipelines, configuring parsers, managing data normalization, and handling costs associated with large-scale logging. Additionally, candidates demonstrate their ability to establish baselines for user, asset, and entity behavior by correlating event data and integrating relevant threat intelligence for more accurate monitoring.
|