Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
An engineer wants to store a database password securely and allow a Cloud Run service to access it. Which GCP service should they use?
⚠ Common exam trap
PCA often tests the difference between Secret Manager and KMS: candidates may choose KMS for storing secrets, but KMS is for key management, not secret storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret Manager
Secret Manager is designed to securely store and manage sensitive data like database passwords, API keys, and certificates. It provides versioning, access control, and audit logging, and integrates with Cloud Run to inject secrets as environment variables or mounted volumes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Secret Manager
Why this is correct
Secret Manager stores credentials encrypted at rest and exposes them through IAM-controlled API calls, so the Cloud Run service account retrieves the database password at runtime rather than embedding it in code or environment variables. This directly satisfies the requirement for secure storage with service-level access control.
- ✗
Cloud Storage
Why it's wrong here
Cloud Storage holds objects in buckets and offers no secret-versioning, rotation, or IAM-scoped secret access; a Cloud Run service would need broad bucket permissions to read the password. It is tempting for cheap storage, but Secret Manager is the service designed for storing and serving credentials to Cloud Run.
- ✗
Cloud Key Management Service (KMS)
Why it's wrong here
Cloud KMS manages encryption keys and performs cryptographic operations; it does not store secret payloads such as a database password, so Cloud Run cannot retrieve one from it. It is tempting because it is security-focused, but Secret Manager is the service that stores and serves secrets to Cloud Run.
- ✗
Firestore
Why it's wrong here
Firestore is a document database for application data, not a secret store; it lacks secret versioning, rotation, and fine-grained secret-level access controls. It is tempting because it is a managed Google service with IAM, but Secret Manager is purpose-built for storing and serving credentials to Cloud Run.
Go deeper
Related to this question
Learn chapter
IAM Policies, Service Accounts, and Auditing
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.