PCSE Practice Question: Managing Operations in a Cloud Solution Environment
An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the private key in Cloud Key Management Service (Cloud KMS).
Binary Authorization integrates with Cloud Key Management Service (KMS) to store attestor keys. Cloud KMS provides centralized key management, access control via IAM, and audit logging. Using a key stored in Cloud KMS is the recommended approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the private key in a GCS bucket with uniform bucket-level access.
Why it's wrong here
GCS is not designed for key storage; it lacks key rotation and audit features.
- ✗
Store the private key in Secret Manager.
Why it's wrong here
Secret Manager is for secrets, but for signing keys, Cloud KMS is the appropriate service.
- ✓
Store the private key in Cloud Key Management Service (Cloud KMS).
Why this is correct
Cloud KMS is the secure and managed way to store keys for Binary Authorization.
- ✗
Store the private key on the developer's workstation.
Why it's wrong here
This is not secure and does not meet enterprise security requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.