mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team is deploying a Cloud Function that…
A team is deploying a Cloud Function that requires a private environment variable containing an API key. They want the key stored securely and automatically injected at runtime. Which approach follows GCP best practices?
⚠ Common exam trap
Google Cloud often tests the misconception that storing secrets in Cloud Storage with fine-grained ACLs is sufficient, but the trap here is that Secret Manager is the only service that provides automatic encryption, versioning, and audit logging for secrets without requiring custom code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the key in Secret Manager and reference it as a secret environment variable in the function deployment
Secret Manager is the GCP-native service designed to securely store API keys and other sensitive data. By referencing a secret as an environment variable in the Cloud Function deployment configuration, the key is automatically decrypted and injected at runtime without exposing it in source code or configuration files. This follows the principle of least privilege and ensures the secret is encrypted at rest and in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the API key in the function source code
Why it's wrong here
Hardcoding the API key in the function source code is a severe anti-pattern because the source is stored in your version control system, and many people (developers, CI/CD pipelines, code reviewers) typically have access to it. Even if the repo is private, the secret can leak through build logs, cloud source repository mirrors, or source artifacts that Cloud Functions stores in Cloud Storage, and rotating the key then requires changing and redeploying code.
- ✗
Pass the API key as a plain-text environment variable in the function configuration
Why it's wrong here
Passing the API key as a plain-text environment variable in the function configuration exposes it to anyone with roles/cloudfunctions.viewer for the project — that includes viewing via the Google Cloud console, the gcloud CLI, or the Cloud Functions API. The environment variable definition is stored in the function's metadata and is returned in cleartext when you describe or list the function, so the secret is effectively public to anyone who can read the deployment configuration.
- ✓
Store the key in Secret Manager and reference it as a secret environment variable in the function deployment
Why this is correct
Storing the key in Secret Manager and referencing it as a secret environment variable is the correct approach because Cloud Functions integrates natively with Secret Manager through the --set-secrets flag. At runtime, the function's service account fetches the secret value using the IAM role roles/secretmanager.secretAccessor, and the secret is injected into the function environment without ever being stored in the function configuration or visible in the console, gcloud, or Cloud Monitoring metadata.
- ✗
Store the API key in a Cloud Storage bucket and download it at function startup
Why it's wrong here
Fetching the API key from a Cloud Storage bucket at function startup is suboptimal because Cold start latency increases as the function must download the object before executing user code, and you still have to separately manage bucket IAM policies, object ACLs, and encryption settings to keep the secret private. Cloud Storage is not a purpose-built secret management service; it lacks native versioning for secret rotation (bucket object versioning is clunky), no secret-specific audit logging, and no built-in integration with Cloud Functions' environment injection, so it is both less secure and more complex than Secret Manager.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.