5. Configuring Access and Security (20%)

Access and security is the smallest domain by weight, but it's the one that touches every other domain covered so far — every compute, storage, and networking task in Phases 2 through 4 depended on an IAM policy or a service account permission working correctly behind the scenes. This phase makes that invisible dependency explicit.