mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Store application configuration data that changes…
You need to store application configuration data that changes infrequently (e.g., feature flags, database connection strings). Multiple services need to read this configuration at startup, and values must never appear in application code or container images. Updates to configuration should not require redeploying services. Which GCP service is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud Secret Manager to store and retrieve configuration at runtime.
Secret Manager is designed exactly for storing sensitive configuration (connection strings, API keys, feature flags with sensitive values). Secrets can be accessed via API or SDK at runtime without being embedded in code or images. Secret Manager supports versioning, automatic rotation triggers, and IAM-controlled access. When a secret value changes, services can be configured to reload it without redeployment using Secret Manager's notification integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store configuration in environment variables set at deployment time.
Why it's wrong here
Environment variables set at deployment time bake configuration into the container or job template, so any change requires a new deployment or rebuild. They are often visible in CI/CD logs, deployment manifests, and container runtime metadata, making them unsuitable for sensitive data. Environment variables also lack built-in versioning, expiration, rotation, and audit logging, which are essential for managing secrets and configuration at scale.
- ✓
Use Cloud Secret Manager to store and retrieve configuration at runtime.
Why this is correct
Secret Manager is a purpose-built service for storing sensitive configuration, such as API keys, database credentials, and feature flags, with automatic encryption, IAM policies per secret, and versioning. Applications retrieve the latest secret version at runtime through a gRPC/REST API call or client library, which means updates are applied without rebuilding or redeploying the workload. Secret Manager also provides audit logging of secret access and supports key rotation by creating new versions and disabling old ones, making it the safest and most operationally flexible choice.
- ✗
Store configuration in a Cloud Storage bucket readable by all services.
Why it's wrong here
A Cloud Storage bucket treats configuration as plain objects, and granting read access to 'all services' effectively means any workload with bucket read permission can see every secret. Cloud Storage has object versioning, but that is not secret-specific and doesn't provide fine-grained IAM per secret, rotation workflows, or audit logs that record which principal accessed which secret. Additionally, secrets stored as objects may be synced into BigQuery or Dataflow jobs accidentally, and bucket-level or object-level ACLs are coarser than the per-secret access control offered by Secret Manager.
- ✗
Use Cloud Firestore to store configuration documents that services read on startup.
Why it's wrong here
Firestore is a serverless NoSQL document database intended for application data, not a secret or configuration store. Storing secrets in Firestore adds unnecessary query overhead and requires hand-rolled security rules, while also exposing secrets to any service account granted database read access. Firestore collections do not offer out-of-the-box secret rotation, access auditing specific to secret reads, or versioned secret releases, so it would introduce far more risk and operational complexity than a dedicated secrets service.
Go deeper
Related to this question
Learn chapter
GCP Database Services
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.