Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cloud Secret Manager

  Why this is correct

  Cloud Secret Manager is the native Google Cloud service designed specifically to store and manage API keys, passwords, and other sensitive strings. It provides centralized IAM-based access control, automatic secret versioning, configurable rotation policies, and full audit logging via Cloud Audit Logs. Secrets can be encrypted with customer-managed keys (CMEK) using Cloud KMS, and the service integrates with Compute Engine and GKE for runtime secret injection. This combination of fine-grained access, lifecycle management, and integration makes it the correct and secure choice.

• ✗

  Cloud KMS

  Why it's wrong here

  Cloud KMS is a key management service that creates, manages, and uses cryptographic keys for encrypting data; it is not a secret store. While you might use a Cloud KMS key to encrypt a password, the ciphertext would still need to live elsewhere, and Cloud KMS neither stores the secret nor provides secret-specific features like rotation of the password value, versioning of the password itself, or IAM policies scoped to a single secret. Misusing Cloud KMS as a secret store also bypasses audit trails for secret access and risks exposing the underlying key material through overly broad key access. Therefore, Cloud KMS is the wrong tool for this requirement.

• ✗

  Datastore

  Why it's wrong here

  Datastore is a highly scalable NoSQL document database intended for application data, not for managing sensitive credentials. It lacks inherent features such as per-secret IAM binding, versioned rotation, and audit logging of secret access; any principal with read access to the database can retrieve the stored passwords. Although Datastore encrypts data at rest, that does not address access control, lifecycle management, or the risk of accidental exposure through exported dumps or compromised services. Thus, it is not a suitable repository for database passwords or API keys.

• ✗

  Cloud Storage with encryption

  Why it's wrong here

  Cloud Storage with encryption at rest is an object storage service, not a secret management solution. You could store a secret as an object, but Cloud Storage lacks native lifecycle operations such as version-based rotation, per-secret IAM binding (you would have to manage bucket-level or object-level ACLs), and granular audit logs that distinguish secret reads from ordinary file access. Additionally, using Cloud Storage for secrets often leads to security anti-patterns like hard-coded URIs, unnecessary replicas, or misconfigured public buckets, while still not providing an automated expiration or rotation mechanism. These limitations make it unacceptable for storing database passwords and API keys.

Go deeper

Related to this question