Google Professional Cloud DevOps Engineer Question 220
Select 2Google Cloud PlatformYour organization is building a CI/CD pipeline on Google Cloud for a web application. The pipeline needs to securely access database credentials and an SSL certificate for HTTPS communication. The team wants to ensure that secrets are stored securely, with access restricted to only the pipeline service account. Which combination of Google Cloud services should you use to manage the secrets and certificates securely?
- A
Use Secret Manager to store the database credentials and Certificate Manager to manage the SSL certificate.
- B
Store the database credentials in Cloud Storage using a publicly accessible bucket and manage the SSL certificate using Certificate Manager.
- C
Use Secret Manager to store both the database credentials and the SSL certificate.
- D
Store the database credentials in a plaintext file in the CI/CD pipeline repository and use Certificate Manager to manage the SSL certificate.
- E
Grant appropriate IAM roles to the pipeline service account for Secret Manager and Certificate Manager.
Show answer and explanation
Correct answers: A, E
Explanation
To securely manage secrets like database credentials and SSL certificates, Secret Manager and Certificate Manager are the recommended services on Google Cloud. Secret Manager provides a secure and scalable way to store and access secrets, while Certificate Manager is specifically designed to manage SSL/TLS certificates. Additionally, assigning appropriate IAM roles to the service account ensures that access is restricted to only authorized components of the pipeline. This approach aligns with Google Cloud's best practices for secret management and security.
- A. Correct.
This is correct. Secret Manager is designed to securely store and access secrets like database credentials, and Certificate Manager is the recommended service for managing SSL certificates in Google Cloud.
- B. Incorrect.
This is incorrect. Storing sensitive data like database credentials in a publicly accessible Cloud Storage bucket creates a security risk and does not adhere to best practices.
- C. Incorrect.
This is partially correct but not ideal. While Secret Manager can theoretically store both database credentials and SSL certificates, Certificate Manager is specifically designed to manage SSL certificates and provides better integration for use cases like HTTPS communication.
- D. Incorrect.
This is incorrect. Storing sensitive information in plaintext within a repository is insecure and violates best practices for secret management.
- E. Correct.
This is correct. Granting the necessary IAM roles to the CI/CD pipeline service account ensures that only authorized entities can access the secrets and certificates.