PCSE Ensuring Data Protection Practice Question
A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.
Secret Manager can set a rotation period and publish a Pub/Sub message upon rotation. A Cloud Function can subscribe to that topic and execute updates. Directly triggering from Secret Manager is not possible. Cloud Scheduler is not needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually rotate the secret and set a Cloud Scheduler job to invoke the Cloud Function.
Why it's wrong here
Manual rotation is not automatic.
- ✗
Use Cloud Scheduler to call the Secret Manager API to add a new version every 60 days, then trigger a Cloud Function via HTTP.
Why it's wrong here
Secret Manager supports automatic rotation natively; no need for Cloud Scheduler.
- ✗
Set a rotation period on the secret and directly specify a Cloud Function as a webhook in Secret Manager.
Why it's wrong here
Secret Manager does not support direct webhook triggers; it uses Pub/Sub.
- ✓
Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.
Why this is correct
This is the correct method: rotation triggers Pub/Sub, Cloud Function acts on it.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.