Google Professional Cloud DevOps Engineer Question 81
Single answerGoogle Cloud PlatformYour organization is deploying a new application on Google Cloud that requires secure access to a database. The database credentials need to be stored securely and accessed by the application at runtime. Additionally, the credentials must be rotated regularly without requiring application downtime. Which solution should you implement to meet these requirements?
- A
Store the database credentials in Secret Manager and configure the application to retrieve them using the Secret Manager API.
- B
Embed the database credentials directly into the application code and redeploy the application whenever the credentials are updated.
- C
Store the database credentials in a Cloud Storage bucket with fine-grained IAM permissions and access them from the application.
- D
Use Certificate Manager to store and manage the database credentials, allowing for automated credential rotation.
Show answer and explanation
Correct answer: A
Explanation
Secret Manager is the best solution for securely storing and managing database credentials in Google Cloud. It allows for easy integration with applications through APIs, supports secret versioning, and enables credential rotation without requiring downtime. Other options either lack the necessary features or are not designed for secret management.
- A. Correct.
This is the correct option. Secret Manager is designed for storing sensitive information like database credentials securely and provides APIs that allow applications to access secrets at runtime. It also supports secret versioning and rotation without requiring application downtime.
- B. Incorrect.
This is incorrect because embedding credentials in application code is a bad security practice. It increases the risk of credential exposure and requires application redeployment for updates, which can lead to downtime.
- C. Incorrect.
This is incorrect because Cloud Storage is not intended for storing sensitive secrets like credentials. While fine-grained IAM permissions can restrict access, it lacks features like secret versioning and rotation.
- D. Incorrect.
This is incorrect because Certificate Manager is designed for managing SSL/TLS certificates, not for storing and rotating database credentials.