Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions
A developer needs to store application secrets (database passwords, API keys, OAuth tokens) securely so that they are not hardcoded in source code or environment variables. The secrets should be automatically versioned and rotatable. Which Google Cloud product is designed for this secure secrets management requirement?
⚠ Common exam trap
Many candidates confuse Cloud KMS (key management) with Secret Manager (secret storage), or assume that any encrypted storage service (like Cloud Storage or Cloud SQL) can substitute for a purpose-built secrets manager, ignoring the need for automatic versioning, rotation, and fine-grained per-secret access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret Manager, which stores secrets encrypted at rest with automatic versioning, rotation support, and fine-grained IAM access control
Secret Manager is Google Cloud's dedicated service for storing application secrets such as database passwords, API keys, and OAuth tokens. It provides encryption at rest using AES-256, automatic versioning (each new secret version is immutable and timestamped), and built-in rotation support via scheduled rotation policies. Fine-grained IAM roles (e.g., roles/secretmanager.secretAccessor) ensure least-privilege access without exposing secrets in source code or environment variables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Storage, by storing secrets in an encrypted bucket with restricted IAM access
Why it's wrong here
While Cloud Storage can store encrypted files with IAM restrictions, it lacks the purpose-built secret management features: versioning, audit logging for each secret access, rotation triggers, and secret-specific IAM bindings at the individual secret level.
- ✓
Secret Manager, which stores secrets encrypted at rest with automatic versioning, rotation support, and fine-grained IAM access control
Why this is correct
Secret Manager is the correct answer. It provides: encrypted storage for secret values, automatic versioning (each update creates a new numbered version), rotation support via Cloud Functions, per-secret IAM bindings, and audit logs for every secret access. It directly solves the hardcoded secrets problem.
- ✗
Cloud KMS, which generates encryption keys for encrypting application data
Why it's wrong here
Cloud KMS manages cryptographic keys for encrypting data. It is not designed for storing application secrets like passwords and API keys. Secret Manager uses Cloud KMS as its encryption backend but provides the secret storage abstraction on top.
- ✗
Cloud SQL, by storing secrets in an encrypted database table with restricted access
Why it's wrong here
Storing secrets in a Cloud SQL table—even with encryption and IAM restrictions—creates a circular dependency: you must securely store the database credentials used to access the table, reintroducing the exact hardcoded-secret problem. Unlike Secret Manager, Cloud SQL lacks automatic secret versioning, rotation triggers, per-secret audit logging, and fine-grained IAM bindings at the individual secret level. It also adds operational overhead for backups, instance patching, and connection pooling, making it a poor fit for application secrets such as API keys.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.