Cloud Digital Leader Google Cloud Security Practice Question
A developer needs to store a database password securely and access it from a Compute Engine VM. The password should be automatically rotated every 90 days. Which Google Cloud service should they use?
⚠ Common exam trap
GCDL often tests the confusion between Cloud KMS (encryption keys) and Secret Manager (application secrets) — candidates pick KMS because it sounds like the secure storage service, but KMS does not store or rotate passwords.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret Manager
Secret Manager is purpose-built for storing, versioning, and accessing sensitive values like database passwords, API keys, and certificates, with native support for automatic rotation via rotation schedules and Pub/Sub notifications. It integrates directly with Compute Engine service accounts through IAM, so a VM can retrieve the secret at runtime without embedding credentials. This matches every requirement in the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM
Why it's wrong here
IAM is Google Cloud's identity and access management service, used to define who can perform actions on which resources, but it does not store secret values. A database password cannot be placed inside IAM; it only grants permissions, such as the ability to access a secret stored elsewhere. Thus, while IAM can control access to a secret, it cannot be the system that actually holds and protects the password.
- ✗
Cloud Storage with server-side encryption
Why it's wrong here
Cloud Storage is an object storage service; even with server-side encryption at rest, it is not designed to be a secret store. Objects in a bucket lack secret-specific features such as version locking, IAM per-secret conditions, and lifecycle management tailored to credentials, and they are easy to misconfigure as public. Storing a database password there would also require custom access control and leave it vulnerable to broad bucket-level permissions, making Secret Manager a safer and more purpose-built choice.
- ✗
Cloud KMS
Why it's wrong here
Cloud KMS is a key management service that creates, rotates, and destroys cryptographic keys, but it does not store secrets such as passwords. You could use KMS to encrypt a database password, but you would still need to store the resulting ciphertext elsewhere, and rotating a KMS key does not change the secret value itself. KMS does not provide the API for storing secret versions or auditing individual secret access, so it is not the correct service for this requirement.
- ✓
Secret Manager
Why this is correct
Secret Manager is Google Cloud's dedicated service for storing secrets like database passwords, API keys, and certificates. It provides versioned secret values, fine-grained IAM roles, and Cloud Audit Logging to track access, and it supports rotation policies by using Cloud Scheduler to create new versions. Unlike the other options, Secret Manager handles the password directly and offers the necessary controls for secure retrieval by applications.
Go deeper
Related to this question
Learn chapter
Private Service Connect and Private Access
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
One of 848 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.