Google ACE Configuring Access and Security Practice Question
Which Google Cloud service provides a managed, scalable, and secure way to store API keys, passwords, and certificates?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret Manager
Secret Manager is the correct service for storing secrets such as API keys, passwords, and certificates. It provides encryption, access control, and versioning. Cloud KMS is for managing encryption keys, Cloud IAM is for access management, and Cloud Storage is for object storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Key Management Service (Cloud KMS)
Why it's wrong here
Cloud KMS is a key management service for creating, rotating, and using cryptographic encryption keys, not for storing arbitrary secret material such as passwords or API keys. While Secret Manager can be configured with customer-managed encryption keys (CMEK) managed by Cloud KMS, KMS itself never stores the secrets; it only provides the envelope encryption keys that encrypt secret payloads. Therefore, using Cloud KMS alone cannot fulfill the need for a managed, scalable secret store.
- ✗
Cloud IAM
Why it's wrong here
Cloud IAM is an access-control system that defines who (identities) can perform which actions (roles) on Google Cloud resources; it does not have a data plane for storing secret values. IAM policies can be attached to Secret Manager resources to manage access to individual secret versions, but the secrets themselves are not persisted in IAM. Since the question asks for a service that stores secrets, IAM is not the right choice.
- ✓
Secret Manager
Why this is correct
Secret Manager is the dedicated Google Cloud service for storing, managing, and accessing secrets such as API keys, passwords, and certificates. It provides built-in secret versioning with immutable payloads, IAM-based access control at the secret-version level, automatic replication for high availability, and full audit logging via Cloud Audit Logs. This makes it the managed and scalable solution that directly matches the requirement.
- ✗
Cloud Storage
Why it's wrong here
Cloud Storage is an object storage solution for unstructured data such as files, images, and backups, and it has object versioning and encryption capabilities. However, it is not designed for secrets: it lacks secret-aware lifecycle features such as disabling/enabling a specific secret version, per-secret version access policies with built-in state transitions, and automated secret rotation helpers. Storing secrets in buckets can also increase the risk of accidental public exposure because buckets are shared objects with broad access modeling.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.