Google Cybersecurity Certificate: A Complete Beginner’s Guide to All 8 Courses

The Google Cybersecurity Certificate is one of the most popular ways to start a security career. This guide gives you one page to keep open while you study. It maps every course to free study notes, practice pages, labs, and videos.

First, you will see a course map. Next, you will find core concepts, cheat sheets, and a study plan. Finally, you can search a glossary and read answers to common questions. Bookmark this page, and return to it after each course.

Independent study aid. This page is not affiliated with or endorsed by Google or Coursera. Always confirm current course content on the official Google Cybersecurity Certificate page on Coursera.

How to use this Google Cybersecurity Certificate guide

The Google Cybersecurity Certificate has eight courses. Each course builds on the one before it. Therefore, you should study them in order.

Use this simple loop for every course:

1. Read the course study notes on this site.
2. Watch the course lessons on Coursera.
3. Practice with the linked helper pages and labs.
4. Finish the graded quizzes and activities.
5. Test yourself with the practice questions.

Tip: You can also go the other way. Start with a helper page, then jump to the matching course on Coursera. Every course block below has links in both directions.

Google Cybersecurity Certificate course map

This table shows how each course connects to the study notes and helper pages on this site. Use it as your quick index.

Course 1: Foundations of Cybersecurity

Course 2: Play It Safe: Manage Security Risks

Course 3: Connect and Protect: Networks and Network Security

Course 4: Tools of the Trade: Linux and SQL

Course 5: Assets, Threats, and Vulnerabilities

Course 6: Sound the Alarm: Detection and Response

Course 7: Automate Cybersecurity Tasks with Python

Course 8: Put It to Work: Prepare for Cybersecurity Jobs

Core cybersecurity concepts: the CIA triad and beyond

The CIA triad is the base of every security decision. It appears in almost every course, so learn it first. For a deeper walkthrough, read core cybersecurity concepts explained.

Related ideas to know

• Non-repudiation: a party cannot deny an action. Digital signatures and logs provide it.
• AAA: authentication (who are you), authorization (what may you do), and accounting (what did you do).
• Security principles: least privilege, separation of duties, defense in depth, and zero trust.
• Control types: preventive, detective, corrective, and deterrent.
• Data types: PII, SPII, and PHI. Data also has three states: at rest, in transit, and in use.

To go deeper, read cybersecurity fundamentals explained. It covers attacks, encryption, zero trust, authentication, and risk.

The 8 CISSP domains in the Google Cybersecurity Certificate

The certificate uses the eight CISSP domains as a map of the security field. Courses 1 and 2 teach them most directly.

The full CISSP covers the same domains in more depth. See ISC2 CISSP for details. Note that it requires professional experience.

Security frameworks, laws, and standards

Frameworks give teams a shared plan. Because of this, employers expect you to know the main ones. Course 2 covers most of them.

Common threats, attacks, and vulnerabilities

Courses 1, 3, and 5 cover threats. As a result, this section helps you across the whole certificate.

Watch: attack types · SQL injection · phishing

Networking quick reference

Networking is the skill that beginners often find hardest. Therefore, review this table often. Then practice with the Wireshark tutorial for beginners, which shows you how to capture and filter real traffic.

Common ports: 20/21 FTP · 22 SSH · 23 Telnet · 25 SMTP · 53 DNS · 80 HTTP · 110 POP3 · 143 IMAP · 443 HTTPS · 445 SMB · 3389 RDP · 3306 MySQL

Remember: TCP is reliable and uses a three-way handshake (SYN, SYN-ACK, ACK). UDP is fast and connectionless.

Linux and SQL cheat sheets

Course 4 teaches both tools. For full lessons, use the Linux for cybersecurity beginners guide and the SQL for cybersecurity analysts guide. More one-page summaries live on the cheat sheets hub.

Linux commands

pwd, ls -la, cd /path       # navigate
cat, less, head, tail -f    # read files / follow logs
grep -i "failed" auth.log   # search text
find / -name "*.conf"       # locate files
chmod 640 file              # permissions (r=4 w=2 x=1)
chown user:group file       # ownership
sudo, su, useradd, passwd   # users
ps aux, top, kill PID       # processes
ip a, ss -tulpn, ping       # networking
man command                 # help

The permission string -rwxr-x--- shows type, owner, group, and others.

SQL queries

SELECT * FROM log_in_attempts WHERE success = 0;
SELECT username, COUNT(*) FROM events GROUP BY username ORDER BY COUNT(*) DESC;
SELECT * FROM employees WHERE department = 'Sales' AND NOT office = 'East';
SELECT a.name, b.device FROM employees a JOIN machines b ON a.id = b.emp_id;
-- operators: AND OR NOT, LIKE '%x%', BETWEEN, IN

Python for security: starter patterns

Course 7 uses Python to automate boring checks. For example, this script flags IP addresses that are not on an allow list. For six hands-on exercises, try Python for cybersecurity beginners.

import re
allow_list = ["10.0.0.5", "10.0.0.9"]
with open("log.txt") as f:
    for line in f:
        ips = re.findall(r"\d{1,3}(?:\.\d{1,3}){3}", line)
        for ip in ips:
            if ip not in allow_list:
                print("Review:", ip)

def is_strong(pw):
    return len(pw) >= 12 and any(c.isdigit() for c in pw)

Practice: official Python tutorial · regex101

Detection and incident response

Course 6 explains how teams respond to attacks. To practice, work through five realistic SIEM and incident response scenarios.

NIST incident response lifecycle:

1. Preparation
2. Detection and analysis
3. Containment, eradication, and recovery
4. Post-incident activity (lessons learned)

• Tools: SIEM (Splunk, Chronicle, Elastic), IDS/IPS (Snort, Suricata), Wireshark, and EDR.
• Indicators: an IoC is evidence of a compromise. An IoA is evidence of an attack in progress.
• Key terms: triage, escalation, playbook, chain of custody, and root cause analysis.
• Good escalation note: what happened, when, which systems, the evidence, actions taken, and next steps.

Free labs, tools, and reading

Hands-on practice makes the theory stick. Start with the cybersecurity home lab setup guide. After that, try the platforms below.

An 8-week study plan for the Google Cybersecurity Certificate

Every learner moves at a different speed. However, this plan gives you a steady rhythm. Adjust it to your schedule.

What to do after the Google Cybersecurity Certificate

• Entry roles: SOC analyst, security analyst, IT support with a security focus, vulnerability analyst, and GRC analyst.
• Next certifications: CompTIA Security+, then CySA+. Pursue CISSP after you gain the required experience.
• Portfolio: publish your capstone, lab write-ups, and a home lab. Also write a short blog post for each concept you learn.
• Study habit: learn one concept a day, and explain it aloud. Repeat quizzes until you score 90% or more.

Google Cybersecurity Certificate FAQ

Cybersecurity glossary: search key terms

Type a term below to filter the list. For a longer list, open the full cybersecurity glossary for beginners.

Access control

Restricting who or what can view or use resources.

APT

Advanced persistent threat: a long-term, stealthy, targeted intrusion.

Asset

Anything of value to an organization: data, devices, people, systems.

Attack surface

All the points where an attacker could try to get in.

Authentication

Verifying identity (password, token, biometric).

Authorization

Granting permissions to an authenticated identity.

Backdoor

Hidden way to bypass normal authentication.

Baiting

Social engineering that lures victims with something tempting.

Botnet

Network of infected devices controlled remotely.

Brute force

Trying many credentials or keys until one works.

Business continuity

Keeping critical operations running during a disruption.

CIA triad

Confidentiality, Integrity, Availability.

Cipher

Algorithm for encrypting and decrypting.

Cloud security

Protecting data and services hosted in cloud environments.

Compliance

Meeting legal, regulatory, or standards requirements.

Cryptography

Science of securing information with math-based techniques.

CSRF

Cross-site request forgery: tricking a user’s browser into unwanted actions.

CVE

Common Vulnerabilities and Exposures: public ID list of known flaws.

CVSS

Scoring system (0 to 10) for vulnerability severity.

Defense in depth

Multiple layers of security controls.

DDoS

Distributed denial of service: a flood from many sources that knocks a service offline.

DLP

Data loss prevention: tools that stop sensitive data from leaving.

DNS

Domain Name System: translates names to IP addresses.

EDR

Endpoint detection and response: monitors and responds on devices.

Encryption

Converting data into an unreadable form without a key.

Exploit

Code or technique that takes advantage of a vulnerability.

Firewall

Filters network traffic by rules.

Forensics

Collecting and analyzing evidence after an incident.

GRC

Governance, risk, and compliance.

Hash

One-way fixed-length digest of data (SHA-256, MD5). Used for integrity checks.

Hardening

Reducing vulnerabilities by tightening configurations.

IAM

Identity and access management.

IDS / IPS

Intrusion detection (alerts) or prevention (blocks) systems.

Incident

An event that threatens the security of information or systems.

IoC

Indicator of compromise: evidence a breach occurred.

Insider threat

Risk from employees, contractors, or partners with access.

Least privilege

Give only the minimum access needed.

Log

Record of events on a system.

Malware

Malicious software.

MFA

Multi-factor authentication: two or more factor types.

MITRE ATT&CK

Catalog of real-world adversary tactics and techniques.

NIST

US National Institute of Standards and Technology.

On-path attack

Attacker intercepts communication between two parties (formerly MITM).

OSINT

Open-source intelligence from public information.

OWASP

Open Worldwide Application Security Project.

Packet

Unit of data sent over a network.

Patch

Software update that fixes vulnerabilities.

Penetration test

Authorized simulated attack to find weaknesses.

PHI

Protected health information.

Phishing

Deceptive messages that trick users into revealing data or clicking links.

PII / SPII

Personally identifiable information, and its sensitive form (such as a bank number).

Playbook

Documented steps for handling a specific scenario.

PKI

Public key infrastructure: certificates and keys for trust.

Ransomware

Malware that encrypts data and demands payment.

RBAC

Role-based access control.

Risk

Potential for loss when a threat exploits a vulnerability.

Rootkit

Malware that hides deep in a system with elevated privileges.

Salting

Adding random data to a password before hashing.

SIEM

Security information and event management: collects and analyzes logs.

SOAR

Security orchestration, automation, and response.

SOC

Security operations center.

Social engineering

Manipulating people into giving access or information.

SQL injection

Inserting malicious SQL through input to manipulate a database.

SSO

Single sign-on: one login for many apps.

STRIDE

Threat model: Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of privilege.

Threat

Anything that can harm an asset.

Threat actor

Person or group behind an attack.

TLS

Transport Layer Security: encrypts web traffic (HTTPS).

Trojan

Malware disguised as legitimate software.

VPN

Encrypted tunnel across an untrusted network.

Vulnerability

Weakness that can be exploited.

Worm

Self-replicating malware that spreads without user action.

XSS

Cross-site scripting: injecting scripts into pages viewed by others.

Zero-day

Vulnerability unknown to the vendor, with no patch yet.

Zero trust

Model that verifies every request and never assumes trust by location.

Keep learning

You now have a full roadmap for the Google Cybersecurity Certificate. Next, pick your current course in the course map, open its study notes, and start. When you finish, test yourself with the practice questions. Then return to the Google Cybersecurity Certificate on Coursera for the next course.

↑ Back to top

Educational summary for learners. Verify details against official course materials. Last reviewed: October 2026.