Google Professional Cloud Security Engineer Question 306
Select 2Google Cloud PlatformYour organization uses Google Cloud Secret Manager to store sensitive credentials such as API keys and database passwords. You have been tasked with ensuring that access to secrets is restricted to only authorized applications and users. Which of the following steps should you take to secure secrets in Secret Manager?
- A
Grant the Secret Manager Admin role at the project level to all developers.
- B
Use IAM roles to grant the least privilege access to secrets.
- C
Enable audit logging for Secret Manager to track access and modification events.
- D
Store secrets in plaintext format within the Secret Manager for easier retrieval.
- E
Use labels to organize secrets and enable better access control.
Show answer and explanation
Correct answers: B, C
Explanation
To secure secrets in Secret Manager, it is essential to follow security best practices such as using IAM roles for least privilege access and enabling audit logging to monitor access and modifications. These steps ensure that secrets are only accessible by authorized entities and help maintain compliance with security standards.
- A. Incorrect.
Granting the Secret Manager Admin role at the project level to all developers violates the principle of least privilege and could lead to unauthorized access. This is not a recommended security practice.
- B. Correct.
Using IAM roles to grant the least privilege access ensures that only authorized applications and users can access specific secrets. This is a key principle of securing secrets in Secret Manager.
- C. Correct.
Enabling audit logging allows you to track who accessed or modified secrets, which is critical for security monitoring and compliance.
- D. Incorrect.
Storing secrets in plaintext format makes them vulnerable to unauthorized access. Secret Manager automatically encrypts secrets, so this step is unnecessary and insecure.
- E. Incorrect.
Labels can be used for organization and management of secrets but do not directly enable better access control. IAM policies should be used for access control instead.