Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A company wants to store application secrets such as API keys and database passwords securely and audit access. They also need to automatically rotate secrets periodically. Which TWO Google Cloud services should they use? (Choose 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Scheduler
Secret Manager stores secrets with versioning and IAM control, and Cloud Scheduler can trigger rotations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Deployment Manager
Why it's wrong here
IaC tool, not for secret rotation.
- ✓
Cloud Scheduler
Why this is correct
Cloud Scheduler can be used to trigger periodic rotation of secrets (e.g., via Cloud Functions).
- ✗
Cloud Storage
Why it's wrong here
Cloud Storage is not designed for secret management.
- ✗
Cloud Key Management Service
Why it's wrong here
Cloud Key Management Service is incorrect as it manages cryptographic keys for encryption, decryption, and digital signatures, not application secrets like API keys or database passwords. It lacks native capabilities for storing arbitrary secret values, versioning them, or automatically rotating them periodically, which are crucial requirements here. This option is tempting because it deals with "keys" and security, and would be the correct choice if the scenario involved managing encryption keys for data at rest or performing cryptographic operations.
- ✓
Secret Manager
Why this is correct
Secret Manager is designed for storing secrets.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.