New exam outline
Google Security Operations Engineer: what changes in the new exam outline
A new Security Operations Engineer exam outline takes effect on November 24, 2026. Here’s how the domain weights change, and which outline your exam will use.
- Current outline applies
- until November 23, 2026
- New outline applies
- from November 24, 2026
Last updated
Domain weights
What changed
Each domain’s share of the exam under the current outline and the new outline, as Google Cloud publishes them.
| Domain | Current outline | New outline | Change |
|---|---|---|---|
| Platform operations | Current outline14% | New outline13% | Change−1 point |
| Data management | Current outline14% | New outline20% | Change+6 points |
| Threat hunting | Current outline19% | New outline18% | Change−1 point |
| Detection engineering | Current outline22% | New outline20% | Change−2 points |
| Incident response | Current outline21% | New outline18% | Change−3 points |
| Observability | Current outline10% | New outline11% | Change+1 point |
In short
- Data management grows the most, from 14% to 20% of the exam.
- Incident response shrinks the most, from 21% to 18%.
Weights come from Google Cloud’s exam guides. How we check our facts
Your exam
Which outline will your exam use?
Exams taken until November 23, 2026 use the current outline, and exams taken from November 24, 2026 use the new one. Study for the outline in force on the day you sit the exam.
FAQs
Got Questions? We’ve Got Answers.
Find quick answers or contact our support team.
Which outline will my Google Security Operations Engineer exam use?
Exams taken until November 23, 2026 use the current outline, and exams taken from November 24, 2026 use the new one. Study for the outline in force on the day you sit the exam.
What changes in the new Google Security Operations Engineer exam outline?
Data management grows the most, from 14% to 20% of the exam. Incident response shrinks the most, from 21% to 18%.
