Google PCA Designing for Security and Compliance Practice Question
A developer needs to securely store a database password that will be used by a Compute Engine instance. The password must be rotated automatically every 30 days. Which service should they use?
⚠ Common exam trap
PCA often tests the confusion between Cloud KMS (encryption key management) and Secret Manager (application secret storage and rotation), trapping candidates who pick KMS for password storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret Manager
Google Cloud Secret Manager is designed to store, manage, and rotate secrets such as database passwords, API keys, and certificates. It supports automatic rotation schedules via Pub/Sub notifications and Cloud Functions or Cloud Run, making it the correct choice for a password that must rotate every 30 days. Cloud KMS manages encryption keys, not application secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud KMS
Why it's wrong here
Cloud KMS manages encryption keys and performs cryptographic operations; it does not store application credentials or rotate database passwords on a schedule. It is tempting because KMS underpins secret encryption, and would be correct for managing customer-managed encryption keys, but the requirement is secret storage with automatic rotation.
- ✗
Cloud Storage with encryption
Why it's wrong here
Cloud Storage holds objects with encryption at rest but provides no secret lifecycle management or scheduled rotation, and retrieving a password from a bucket exposes it broadly. It is tempting because encryption is present, and it would suit storing arbitrary encrypted files, but rotation and least-privilege secret access are absent.
- ✗
Environment variables
Why it's wrong here
Environment variables store secrets in plaintext within the instance configuration and offer no rotation mechanism, so the 30-day requirement fails. They are tempting for convenience in passing configuration to applications, and would suit non-sensitive settings, but they provide neither encryption at rest nor automated credential rotation.
- ✓
Secret Manager
Why this is correct
Secret Manager stores the database password as a versioned secret and supports rotation schedules, satisfying the 30-day automatic rotation constraint. A Compute Engine instance retrieves it at runtime via its service account, so the credential never sits in code or instance metadata.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
IAM Policies, Service Accounts, and Auditing
Key term
Cloud Functions
Cloud Functions are serverless compute services that let you run single-purpose code in response to events without managing servers.
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
About these practice questions
One of 807 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.