ExamFinch.com My Study

Study guide

5.5 Securing the AI Stack: AI Protection, Model Armor, and Zero Trust

Practice this exam

Google Cloud Digital Leader Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 How to Prepare & Use This Guide 1.3 What Changed in the August 12, 2026 Exam Update

2 Digital Transformation with Google Cloud

1.1 Why Cloud Technology Is Transforming Business 1.2 Fundamental Cloud Concepts 1.3 Cloud Computing Models and Shared Responsibility 1.4 Agentic AI, Open Standards, and Google Cloud's Differentiators

3 Exploring Data Transformation with Google Cloud

2.1 The Value of Data 2.2 Google Cloud Data Management Solutions 2.3 Making Data Useful and Accessible 2.4 Data Types, the Data Supply Chain, and Interoperability

4 Innovating with Google Cloud Artificial Intelligence

3.1 AI and ML Fundamentals 3.2 Google Cloud's AI and ML Solutions 3.3 Building and Using Google Cloud AI and ML Solutions 3.4 Gemini, the Agent Platform, and the AI Hypercomputer

5 Modernize Infrastructure and Applications with Google Cloud — Part 1

4.1 Cloud Modernization and Migration 4.2 Computing in the Cloud 4.3 Serverless Computing

6 Modernize Infrastructure and Applications with Google Cloud — Part 2

4.4 Containers in the Cloud 4.5 The Value of APIs 4.6 Hybrid and Multi-Cloud

7 Trust and Security with Google Cloud

5.1 Trust and Security in the Cloud 5.2 Google's Trusted Infrastructure 5.3 Google Cloud's Trust Principles and Compliance 5.4 Google Threat Intelligence, Security Command Center, and Google SecOps 5.5 Securing the AI Stack: AI Protection, Model Armor, and Zero Trust

8 Scaling with Google Cloud Operations

6.1 Financial Governance and Managing Cloud Costs 6.2 Operational Excellence and Reliability at Scale 6.3 Sustainability with Google Cloud 6.4 Cloud Observability, SLIs, SLOs, and the Four Golden Signals

5.5 Securing the AI Stack: AI Protection, Model Armor, and Zero Trust

Key Takeaways Explain This Topic AI

Google secures every layer of the AI stack: infrastructure, data, models, platform, and agents - a compromise at any one layer undermines the others.

Model Armor screens prompts and model responses for prompt injection, jailbreak attempts, malicious URLs, sensitive-data leakage, and unsafe content, and can either inspect only or inspect and block.

AI Protection, delivered through Security Command Center, discovers an organization's AI inventory, assesses its risks, and manages threats against AI workloads.

Zero trust assumes no implicit trust from network location: every request is authenticated, authorized, and encrypted, which is what Identity-Aware Proxy implements for application access.

The updated guide names a broad security product list including Cloud VPC, Cloud VPN, Cloud Interconnect, firewalls, Cloud Armor, Cloud Logging, IAM, Sensitive Data Protection, Confidential Computing, Certificate Manager, and Identity-Aware Proxy.

Last updated: August 2026

Version Note

This section covers material added by the exam guide effective August 12, 2026 . It builds on the security fundamentals in Sections 8.1 and 8.2, which remain in scope for both exam versions.

Why AI Needs Its Own Security Story

Every control in Section 8.2 - encryption, IAM, network defence, audit logging - still applies to an AI workload, because an AI workload is still software running on infrastructure. What is new is a set of attack surfaces that did not exist before:

The prompt is an input channel that carries instructions, not just data, so an attacker who controls text the model reads may be able to control what the model does.

The model is an asset with commercial value that can be stolen, and one that can memorise and leak the data it was trained on.

An agent holds credentials and takes actions, so compromising it is closer to compromising a privileged service account than to compromising a chatbot.

The updated guide reflects this by asking you to recognise how Google secures every layer of the AI stack .

Layer What is at risk What securing it looks like

Infrastructure The compute, storage, and network the workload runs on Secure-by-design data centres, custom hardware root of trust, encryption by default

Data Training data and inference inputs Access control, Sensitive Data Protection, encryption, residency controls

Models Model theft, tampering, memorisation of training data Access control on model artifacts, provenance, evaluation for leakage

Platform The AI platform's own configuration and permissions IAM, posture management, AI Protection inventory and risk assessment

Agents Credentials, tool access, and actions taken autonomously Bounded permissions, least privilege on tools, logging of every action

The exam's point is the chain : a perfectly secured model served from a misconfigured platform, or an agent with excessive permissions, is not secure. Layers are only as strong as the weakest one.

Model Armor

Model Armor is Google Cloud's service for screening what goes into and comes out of an AI application. It inspects both user prompts and model responses before they reach their destination, across several risk categories:

Category What it catches

Prompt injection and jailbreak Input crafted to override the application's instructions or bypass its safety constraints

Malicious URLs Links in prompts or responses that lead to phishing or malware

Sensitive data leakage Personally identifiable information, financial data, credentials, or intellectual property flowing in or out

Responsible AI safety Hate speech and harassment, sexually explicit content, dangerous or violent content, and child sexual abuse material

Two operational details worth knowing because they show up as answer options:

It works in inspect-only mode, which logs findings without interfering, or inspect-and-block mode, which stops the request or response.

It screens content inside documents and images too - text within PDFs, Word, Excel, and PowerPoint files, and text in images via optical character recognition - not just plain prompt text.

Prompt injection is the concept to be able to explain in one sentence, because it is the distinctively AI-shaped threat: an attacker places instructions in content the model will read - a web page, an uploaded document, an email - so that when the model processes it, it follows the attacker's instructions instead of the application's. Model Armor is the control that inspects for it; bounded permissions on what the model may then do are the control that limits the damage.

AI Protection

AI Protection , delivered through Security Command Center, applies the discover-prioritise-remediate motion from Section 9.1 specifically to AI workloads:

Discover the AI inventory. Most enterprises cannot answer "which AI models and applications are running in our environment, using which data?" AI Protection builds that inventory, including the shadow AI nobody registered.

Assess the risks. It evaluates the inventory against AI-specific weaknesses - exposed model endpoints, over-permissive access to training data, unsafe configurations.

Manage threats. It surfaces and helps respond to detected threats against AI workloads, feeding into the same Security Command Center workflow the rest of the estate uses.

The distinction from Model Armor is clean and testable: Model Armor operates at run time on individual prompts and responses; AI Protection operates at the posture level across the whole AI estate. One is a filter, the other is an inventory and risk-management capability.

Gemini in Google Security Operations

Google also applies AI to security work itself. Gemini in Google Security Operations assists analysts by summarising complex investigations in natural language, translating a plain-English question into a search across security telemetry, and recommending response actions. The business value is capacity: the shortage of experienced security analysts is structural, so a tool that lets a tier-one analyst work a case that would previously have needed escalation raises the throughput of the whole team.

Zero Trust and Security by Default

Two foundational terms the updated guide names explicitly.

Zero-trust architecture discards the assumption that being inside the corporate network confers trust. Instead, every request is authenticated, authorized, and encrypted based on the identity of the user and the device, regardless of where it originates. The practical implications:

There is no privileged "inside." A request from the office network is evaluated exactly like a request from a coffee shop.

Access decisions consider context - who the user is, what device they are on, its security state - not just a valid credential.

Identity-Aware Proxy (IAP) is Google Cloud's implementation for application access: it gates applications on identity and context rather than on network location or a VPN.

Security by default means the secure configuration is the one you get without asking. Encryption at rest on all Google Cloud data is the clearest example: it is not a feature to enable, it is simply how storage works. The business value is that the most common cause of breaches - a control that existed but was never turned on - is designed out.

The Wider Security Product List

The updated guide asks you to recognise the functionality, use cases, and business value of Google's other security offerings. Learn them by the job each does:

  • Product The job it does
  • Cloud VPC Private, isolated network space for your resources, with subnets and routing you control
  • Firewall rules Allow or deny traffic to and from resources based on protocol, port, and source
  • Cloud VPN Encrypted tunnel connecting your on-premises network to your VPC over the internet

Cloud Interconnect Dedicated private physical connection between your network and Google Cloud, bypassing the public internet

  • Cloud Armor Edge defence against DDoS and Layer 7 web attacks in front of your load balancer
  • Cloud Logging Centralised log capture, including audit logs recording who did what and when
  • IAM Who may do what to which resource - the enforcement point for least privilege

Sensitive Data Protection Discovers, classifies, and de-identifies sensitive data such as PII across your estate

  • Confidential Computing Keeps data encrypted while it is being processed in memory, protecting data in use
  • Certificate Manager Provisions and manages TLS certificates for your services at scale

Identity-Aware Proxy Zero-trust access to applications based on identity and context rather than network position

The pairing most often confused is Cloud VPN versus Cloud Interconnect : both connect on-premises to Google Cloud, but VPN runs an encrypted tunnel over the public internet, while Interconnect is a dedicated physical link. Choose VPN for speed of setup and lower cost, Interconnect when bandwidth, consistent latency, or avoiding the public internet is the requirement.