Google Professional Cloud Developer Question 107
Select 3Google Cloud PlatformYou are developing a cloud-native application that needs to securely store API keys and database credentials. The application also requires periodic rotation of these secrets to comply with security policies. Which Google Cloud services and best practices should you use to meet these requirements?
- A
Use Secret Manager to securely store and manage secrets, and set up automatic secret rotation.
- B
Store the secrets in a Cloud Storage bucket and use IAM permissions to restrict access.
- C
Use Cloud Key Management Service (KMS) to encrypt the secrets and store the ciphertext in Secret Manager.
- D
Embed the secrets directly in the application code to simplify access.
- E
Enable audit logging for Secret Manager to track access to secrets.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely store, manage, and rotate application secrets, Secret Manager is the recommended service in Google Cloud. It provides features like automatic rotation and fine-grained access control. Cloud KMS can be used to encrypt secrets before storage, adding another layer of security. Enabling audit logging ensures that access to secrets is tracked for compliance purposes. Other methods, such as using Cloud Storage or embedding secrets in code, do not provide the same level of security or functionality for managing secrets.
- A. Correct.
Correct: Secret Manager is designed for securely storing and managing application secrets, including automatic rotation capabilities.
- B. Incorrect.
Incorrect: While Cloud Storage offers encryption and IAM-based access control, it is not specifically designed for managing application secrets, and lacks features like automatic rotation.
- C. Correct.
Correct: Cloud KMS can be used to encrypt secrets, ensuring that they are stored securely. The ciphertext can then be stored in Secret Manager for secure access.
- D. Incorrect.
Incorrect: Embedding secrets in application code is a poor security practice since it increases the risk of exposure, especially in version control systems.
- E. Correct.
Correct: Enabling audit logging for Secret Manager provides a detailed record of who accessed or modified secrets, enhancing security compliance.