Google Professional Cloud Developer Question 104
Select 3Google Cloud PlatformYou are developing a cloud-native application running on Google Kubernetes Engine (GKE). The application needs to access a database, and the database credentials must be securely stored, accessed, and rotated without manual intervention. Which combination of services should you use to securely manage the database credentials?
- A
Use Secret Manager to store and manage the database credentials, and configure the application to access the secrets programmatically.
- B
Store the database credentials in a Kubernetes ConfigMap and mount it as an environment variable in your application.
- C
Use Cloud Key Management Service (KMS) to encrypt the database credentials before storing them in a secure storage solution.
- D
Manually rotate the database credentials every 90 days and redeploy the application with the updated credentials.
- E
Use Secret Manager with automatic rotation policies to update the database credentials and notify the application.
Show answer and explanation
Correct answers: A, C, E
Explanation
The combination of Secret Manager and Cloud KMS provides a secure and automated approach to managing application secrets. Secret Manager is designed to store sensitive data securely, while Cloud KMS ensures that the data is encrypted. Additionally, Secret Manager's automatic rotation feature ensures that credentials are updated without manual intervention, aligning with security best practices.
- A. Correct.
Using Secret Manager is a secure and recommended approach for storing and managing sensitive data like database credentials. The application can programmatically retrieve these secrets at runtime, ensuring a secure and scalable solution.
- B. Incorrect.
Kubernetes ConfigMaps are not designed for storing sensitive data because they are not encrypted and provide limited access control. This approach is insecure for database credentials.
- C. Correct.
Cloud Key Management Service (KMS) is ideal for encrypting sensitive data before storing it in a secure location. This ensures that the credentials remain secure even if the storage is compromised.
- D. Incorrect.
Manually rotating credentials introduces human error and operational overhead, making it a less secure and less scalable solution.
- E. Correct.
Secret Manager supports automatic rotation policies, which can securely update the database credentials. This minimizes manual effort and ensures that the application always uses updated, secure credentials.