PCSE Ensuring Data Protection Practice Question
A company wants to automatically rotate secrets stored in Secret Manager every 30 days. They have set up a Pub/Sub topic and a Cloud Function to perform the rotation. Which TWO actions are required to complete the configuration? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the rotation period on the secret to 30 days.
To enable automatic rotation, you need to configure a rotation period and a Pub/Sub topic. The rotation period defines how often the secret is rotated, and the Pub/Sub topic is used to notify the Cloud Function when rotation is due.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the Cloud Functions service account the secretmanager.secretVersionManager role on the secret.
Why it's wrong here
The Cloud Function needs permissions to create new versions; this role may be needed, but it is not one of the two required steps for automatic rotation configuration.
- ✓
Set the rotation period on the secret to 30 days.
Why this is correct
The rotation period tells Secret Manager how often to trigger rotation.
- ✗
Create a Cloud Scheduler job to call the Secret Manager API every 30 days.
Why it's wrong here
Cloud Scheduler is not needed; Secret Manager handles the scheduling internally.
- ✗
Enable automatic rotation in the Cloud Console by toggling the 'Enable rotation' switch.
Why it's wrong here
There is no such switch; rotation is configured via the rotation period and topic.
- ✓
Configure a Pub/Sub topic on the secret to receive notifications when rotation is triggered.
Why this is correct
The Pub/Sub topic receives notifications that trigger the Cloud Function to rotate the secret.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.