Google Professional Cloud Security Engineer Question 305
Select 3Google Cloud PlatformYou are a Professional Cloud Security Engineer tasked with securing an application running in Google Cloud. The application needs access to sensitive API keys to interact with third-party services. You decide to use Secret Manager to store and manage these secrets. Which of the following steps should you take to ensure the secrets remain secure and are accessed only by authorized components?
- A
Grant the application’s service account the 'Secret Manager Admin' role for the secret.
- B
Use Secret Manager to store the API keys and ensure they are encrypted at rest using Google-managed encryption keys.
- C
Grant the application’s service account the 'Secret Manager Secret Accessor' role for the secret.
- D
Enable audit logging for Secret Manager to track access and modifications to the secrets.
- E
Embed the API keys directly into the application’s code to reduce external dependencies.
Show answer and explanation
Correct answers: B, C, D
Explanation
To secure secrets with Secret Manager, you should store the secrets securely in Secret Manager and ensure they are encrypted at rest. The application should be granted only the 'Secret Manager Secret Accessor' role to ensure least privilege access. Enabling audit logging provides visibility into access and modifications for security monitoring. Avoid practices like embedding secrets in code as they expose the application to unnecessary risks.
- A. Incorrect.
Granting the 'Secret Manager Admin' role is overly permissive and violates the principle of least privilege. This role allows not only access but also the ability to modify and delete secrets, which is unnecessary for the application.
- B. Correct.
Using Secret Manager to store the API keys ensures the secrets are stored and encrypted securely at rest. Google-managed encryption keys are automatically used unless you specify a customer-managed encryption key (CMEK).
- C. Correct.
Granting the 'Secret Manager Secret Accessor' role allows the application to read the secrets without providing unnecessary permissions. This adheres to the principle of least privilege.
- D. Correct.
Enabling audit logging for Secret Manager is a best practice for tracking access and modifications to secrets, which helps in identifying and responding to unauthorized access attempts.
- E. Incorrect.
Embedding API keys directly into the application’s code is a security anti-pattern as it increases the risk of accidental exposure and makes it harder to rotate credentials.