Google Professional Cloud Developer Question 106
Select 3Google Cloud PlatformYou are developing a cloud-based application that needs to securely store API keys, database credentials, and other sensitive information. The application also requires access to encryption keys for encrypting sensitive data. Which of the following practices would you implement to securely store, access, and manage these secrets and encryption keys in Google Cloud?
- A
Use Secret Manager to store API keys and database credentials, and configure IAM roles to control access.
- B
Embed API keys and database credentials directly in the application's source code for fast access.
- C
Use Cloud Key Management Service (KMS) to manage encryption keys and ensure they are rotated regularly.
- D
Store sensitive information in a publicly accessible Cloud Storage bucket for scalability.
- E
Implement automatic secret versioning in Secret Manager to manage updates to secrets.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best practices for securely managing secrets and encryption keys in Google Cloud involve using services like Secret Manager for secrets and Cloud KMS for encryption keys. Secret Manager provides secure storage with fine-grained access control via IAM, and versioning ensures safe updates. Cloud KMS offers robust encryption key management with features like rotation. Avoid insecure practices such as embedding secrets in source code or storing them in publicly accessible storage.
- A. Correct.
Correct. Secret Manager is designed for secure storage of secrets like API keys and credentials, and IAM roles ensure only authorized access.
- B. Incorrect.
Incorrect. Embedding secrets in source code is insecure and makes them vulnerable to accidental exposure or leaks.
- C. Correct.
Correct. Cloud KMS is the recommended service for managing encryption keys securely, and regular key rotation enhances security.
- D. Incorrect.
Incorrect. Storing sensitive information in a publicly accessible Cloud Storage bucket is a major security risk and not a best practice.
- E. Correct.
Correct. Automatic secret versioning in Secret Manager allows you to manage updates to secrets securely and roll back if needed.