Google Professional Cloud Developer exam dumps: questions 101 to 200 of 480

Correct answers: A, B, D

• A. Correct.

  Enabling Container Analysis is a critical step to automatically scan container images for vulnerabilities. This is a primary service provided by Google Cloud to assess potential risks.

• B. Correct.

  Binary Authorization ensures that only trusted container images that meet security policies are deployed. It provides an additional layer of security.

• C. Incorrect.

  Manually inspecting dependencies is not practical or scalable, especially in modern CI/CD workflows. Automated tools like Container Analysis should be used instead.

• D. Correct.

  Integrating Cloud Build with Container Analysis allows for vulnerability scanning at the build stage, ensuring that insecure images do not progress further in the pipeline.

• E. Incorrect.

  Storing container images in a third-party registry does not inherently reduce vulnerability risks and does not utilize Google Cloud's security mechanisms for scanning.

Correct answer: A

• A. Correct.

  Google Cloud Container Analysis is the correct choice as it provides vulnerability scanning for container images stored in Artifact Registry or Container Registry, ensuring that application binaries and dependencies are secure before deployment.

• B. Incorrect.

  IAM Policies are used for access control and permissions management but do not scan or secure application binaries and dependencies.

• C. Incorrect.

  Cloud Armor provides DDoS protection and web application firewall capabilities but does not perform vulnerability scanning for application binaries or dependencies.

• D. Incorrect.

  Cloud Logging is used for storing and analyzing logs but does not provide any functionality to scan or secure application binaries and dependencies.

Correct answer: A

• A. Correct.

  Google Secret Manager is the recommended solution for securely storing and accessing application secrets. It supports automatic rotation and integrates with IAM for granular access control, meeting both security and compliance requirements.

• B. Incorrect.

  Storing secrets in Cloud Storage with Cloud KMS encryption is a possible solution, but it requires manual rotation of secrets, which does not fulfill the automatic rotation requirement.

• C. Incorrect.

  Embedding secrets directly in application code is highly insecure and violates best practices for managing secrets, as it exposes sensitive data and complicates updates.

• D. Incorrect.

  Using Compute Engine instance metadata for storing secrets is not intended for secret management and poses security risks, as it does not provide robust access control or automatic rotation.

Correct answers: A, C, E

• A. Correct.

  Using Secret Manager is a secure and recommended approach for storing and managing sensitive data like database credentials. The application can programmatically retrieve these secrets at runtime, ensuring a secure and scalable solution.

• B. Incorrect.

  Kubernetes ConfigMaps are not designed for storing sensitive data because they are not encrypted and provide limited access control. This approach is insecure for database credentials.

• C. Correct.

  Cloud Key Management Service (KMS) is ideal for encrypting sensitive data before storing it in a secure location. This ensures that the credentials remain secure even if the storage is compromised.

• D. Incorrect.

  Manually rotating credentials introduces human error and operational overhead, making it a less secure and less scalable solution.

• E. Correct.

  Secret Manager supports automatic rotation policies, which can securely update the database credentials. This minimizes manual effort and ensures that the application always uses updated, secure credentials.

Correct answers: A, C, E

• A. Correct.

  Correct: Granting the application service account the 'Secret Manager Secret Accessor' role ensures the application can securely access the secrets stored in Secret Manager without exposing them unnecessarily.

• B. Incorrect.

  Incorrect: Storing sensitive secrets in environment variables is not a secure practice as it increases the risk of unintentional exposure. Manual key rotation is error-prone and lacks automation.

• C. Correct.

  Correct: Configuring automatic secret version rotation in Secret Manager ensures secrets are rotated securely and consistently. Using a Cloud Function for rotation helps automate the process.

• D. Incorrect.

  Incorrect: While encrypting keys with Cloud KMS and storing them in Cloud Storage is secure, this approach is less practical for managing dynamic secrets like API keys compared to using Secret Manager.

• E. Correct.

  Correct: Fetching secrets dynamically at runtime using the Secret Manager API prevents hardcoding and ensures the application always uses the latest version of the secret.