Google Professional Cloud Developer Question 80
Select 3Google Cloud PlatformYou are designing a cloud-native web application that requires user authentication and sensitive data storage. Which of the following design choices ensure the application is secure and follows Google Cloud best practices?
- A
Use Identity-Aware Proxy (IAP) to protect access to your application.
- B
Store sensitive data, such as user passwords, in plaintext within a Cloud Storage bucket.
- C
Implement reCAPTCHA Enterprise to prevent automated abuse on user input forms.
- D
Use customer-managed encryption keys (CMEK) to encrypt sensitive data stored in Cloud Storage.
- E
Hardcode application secrets, such as API keys, directly within your application code.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design secure applications on Google Cloud, it is essential to protect access to your application using tools like Identity-Aware Proxy, secure sensitive user interactions with reCAPTCHA Enterprise, and encrypt sensitive data using customer-managed encryption keys. Avoid practices like storing sensitive data in plaintext or hardcoding secrets, which can lead to severe security risks.
- A. Correct.
Using Identity-Aware Proxy (IAP) adds a security layer by enabling context-aware access control, ensuring only authorized users can access the application.
- B. Incorrect.
Storing sensitive data in plaintext is a security risk and violates best practices. Sensitive data should always be encrypted both in transit and at rest.
- C. Correct.
Implementing reCAPTCHA Enterprise helps protect your application from automated abuse, such as bot attacks, ensuring secure user interaction.
- D. Correct.
Using customer-managed encryption keys (CMEK) provides control and auditing over the encryption of sensitive data, aligning with security best practices.
- E. Incorrect.
Hardcoding secrets in application code is a major security vulnerability. Secrets should be stored securely using tools like Secret Manager or environment variables.