Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Secret Manager

  Why this is correct

  Secret Manager is the correct choice because it is Google Cloud's purpose-built service for storing sensitive data such as database passwords, API keys, and certificates. It provides fine-grained IAM policies, automatic versioning, audit logging of secret access, and integration with services like Cloud Functions and GKE. Additionally, it supports secret rotation and allows you to enforce retention policies, making it the secure and native solution for managing a database password.

• ✗

  Cloud Storage

  Why it's wrong here

  Cloud Storage is an object storage service designed for unstructured data such as images, backups, or application files. While you could technically store a password in a text file inside a bucket, Cloud Storage lacks the specialized secret management features like versioned secrets, access-specific audit logs, and IAM conditions tailored to individual secrets. Misconfigured bucket permissions are a common source of data breaches, and using it for secrets would bypass Google Cloud's recommended security model for sensitive credentials.

• ✗

  Cloud Filestore

  Why it's wrong here

  Cloud Filestore provides managed network file storage (NFS) for workloads that need shared file systems, such as high-performance computing or legacy applications. It has no concept of secret versioning, secret-level IAM, or audit logging of read access to individual credential values; instead, security relies on POSIX permissions and network access controls. Storing a database password in a Filestore share would expose the plaintext to any process with file read access and would not integrate with Google Cloud's native secret management workflows.

• ✗

  Cloud KMS

  Why it's wrong here

  Cloud KMS is a cryptographic key management service that creates, stores, and manages encryption keys, not the secrets themselves. You could use a KMS key to encrypt the password, but the ciphertext would still need to be stored elsewhere, and KMS does not provide versioning, rotation, or audit logging for a secret value like Secret Manager does. In fact, Secret Manager leverages Cloud KMS to encrypt secrets under the hood, so using KMS directly would require you to build your own secret storage layer and would not give you the native access control or audit trail needed for a database password.

Go deeper

Related to this question