Google Professional Cloud Security Engineer Question 308
Select 3Google Cloud PlatformYour organization uses Google Cloud Secret Manager to manage sensitive credentials such as API keys and database passwords. You have been tasked with ensuring that only specific services and users have access to read secrets, while also maintaining an audit trail of secret usage. What steps should you take to achieve this?
- A
Grant the Secret Manager Admin role to all users who need access to secrets.
- B
Use IAM roles such as Secret Manager Secret Accessor to provide read access to specific users or services.
- C
Enable Secret Manager audit logs in Cloud Audit Logs to track access to secrets.
- D
Store secrets in plaintext files on Compute Engine instances for faster access.
- E
Configure fine-grained IAM policies for individual secrets or secret versions.
Show answer and explanation
Correct answers: B, C, E
Explanation
To securely manage secrets in Google Cloud Secret Manager, you should follow the principle of least privilege by assigning the Secret Accessor role only to authorized users or services. Additionally, enabling Cloud Audit Logs ensures that all secret access is tracked for auditing purposes. Fine-grained IAM policies allow you to further restrict access to specific secrets or versions, ensuring a robust and secure setup.
- A. Incorrect.
Granting the Secret Manager Admin role to all users is not a security best practice as it provides overly broad permissions, including the ability to manage and delete secrets.
- B. Correct.
Using the Secret Manager Secret Accessor role is the recommended way to provide read-only access to specific users or services, ensuring the principle of least privilege.
- C. Correct.
Enabling audit logs in Cloud Audit Logs ensures you have visibility into who accessed secrets and when, which is critical for maintaining an audit trail.
- D. Incorrect.
Storing secrets in plaintext files on Compute Engine instances is insecure and not recommended because it exposes sensitive credentials to unauthorized access.
- E. Correct.
Configuring fine-grained IAM policies for individual secrets or secret versions allows precise control over who can access specific secrets, enhancing security.