Cloud Digital Leader Google Cloud Security Practice Question
A developer needs to store a database password securely and access it from a Compute Engine VM. The password should be automatically rotated every 90 days. Which Google Cloud service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret Manager
Secret Manager is designed to store secrets like passwords, API keys, and certificates. It supports automatic rotation of secrets. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not secure for secrets. IAM does not store secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM
Why it's wrong here
IAM is Google Cloud's identity and access management service, used to define who can perform actions on which resources, but it does not store secret values. A database password cannot be placed inside IAM; it only grants permissions, such as the ability to access a secret stored elsewhere. Thus, while IAM can control access to a secret, it cannot be the system that actually holds and protects the password.
- ✗
Cloud Storage with server-side encryption
Why it's wrong here
Cloud Storage is an object storage service; even with server-side encryption at rest, it is not designed to be a secret store. Objects in a bucket lack secret-specific features such as version locking, IAM per-secret conditions, and lifecycle management tailored to credentials, and they are easy to misconfigure as public. Storing a database password there would also require custom access control and leave it vulnerable to broad bucket-level permissions, making Secret Manager a safer and more purpose-built choice.
- ✗
Cloud KMS
Why it's wrong here
Cloud KMS is a key management service that creates, rotates, and destroys cryptographic keys, but it does not store secrets such as passwords. You could use KMS to encrypt a database password, but you would still need to store the resulting ciphertext elsewhere, and rotating a KMS key does not change the secret value itself. KMS does not provide the API for storing secret versions or auditing individual secret access, so it is not the correct service for this requirement.
- ✓
Secret Manager
Why this is correct
Secret Manager is Google Cloud's dedicated service for storing secrets like database passwords, API keys, and certificates. It provides versioned secret values, fine-grained IAM roles, and Cloud Audit Logging to track access, and it supports rotation policies by using Cloud Scheduler to create new versions. Unlike the other options, Secret Manager handles the password directly and offers the necessary controls for secure retrieval by applications.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.