Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Storage

  Why it's wrong here

  Cloud Storage is a scalable object storage service for unstructured data, not a secret management system. While you could technically write an API key or certificate to a bucket, you would have to manually manage encryption, access controls, and lifecycle policies, and the payload would remain visible to anyone with object-level read access. Cloud Storage lacks purpose-built secret capabilities such as versioned secret values, IAM-specific secret roles, and native rotation scheduling, making it a risky and operationally heavy place to store credentials.

• ✗

  Cloud KMS

  Why it's wrong here

  Cloud KMS is a cryptographic key management service that creates and controls keys used for encryption, decryption, signing, and verification. It is designed to store key objects themselves, not the sensitive application data like API keys or certificates; you would use KMS to encrypt a secret, but the encrypted secret still needs a separate storage location. KMS also does not provide secret versioning, payload retrieval APIs, or secret-specific access auditing, so it cannot serve as the direct secret store this developer needs.

• ✓

  Secret Manager

  Why this is correct

  Secret Manager is the correct choice because it is a dedicated, purpose-built service for storing and managing sensitive data such as API keys, passwords, and certificates as immutable secret versions. It provides fine-grained IAM roles, automatic log-based auditing, built-in rotation with etag validation, and integration with App Engine, Cloud Functions, and Kubernetes workloads. You can upload certificate data directly as a secret payload and access it securely via the Secret Manager API or client libraries, giving the developer exactly the managed workflow they need.

• ✗

  Cloud Asset Inventory

  Why it's wrong here

  Cloud Asset Inventory is a metadata service that records the configuration, history, and IAM policy state of Google Cloud resources, not the content or payload of those resources. It can tell you that a Secret Manager secret resource exists and who has access to it, but it cannot return the actual secret value or certificate data. Because it lacks any API to store or retrieve secret payloads, it is completely unsuitable as a secret management solution.

Go deeper

Related to this question