mediumMultiple ChoiceObjective-mapped
Secret Manager for GKE Secrets — Secure Storage and Mounting
A company is deploying a microservices architecture on Google Kubernetes Engine (GKE). They need to securely store and access database credentials, API keys, and other secrets. They want to avoid storing secrets in plaintext in the container image or Kubernetes manifests. Which solution should they use?
Quick Answer
The answer is to use Secret Manager and mount secrets as volumes via the Secret Manager CSI driver. This is correct because Secret Manager offers a centralized, encrypted, and auditable vault for sensitive data like database credentials and API keys, while the CSI driver enables pods to consume those secrets directly as mounted volumes without ever storing them in plaintext within container images, Kubernetes manifests, or etcd. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding of how to enforce a zero-trust secret lifecycle in GKE, often contrasting with less secure options like Kubernetes Secrets or environment variables. A common trap is assuming Kubernetes Secrets alone are sufficient—they are only base64-encoded, not encrypted by default. Remember the mnemonic “CSI for CSI” (Cloud Secret Integration) to recall that the CSI driver is the bridge that keeps secrets off the node’s disk and out of your YAML.
⚠ Common exam trap
Many candidates confuse Kubernetes native Secrets (which are only base64-encoded, not encrypted) with a secure solution, or they assume ConfigMaps can be used for secrets if encrypted, missing the fact that ConfigMaps are not designed for sensitive data and are stored in plaintext in etcd.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Secret Manager and mount secrets as volumes using the Secret Manager CSI driver.
Secret Manager provides a centralized, secure, and auditable way to store secrets, and the Secret Manager CSI driver allows pods to mount these secrets as volumes without exposing them in the container image or Kubernetes manifests. This approach ensures secrets are never stored in plaintext on disk or in etcd, and it integrates with GKE's workload identity for fine-grained access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt secrets with Cloud KMS and store them in a ConfigMap.
Why it's wrong here
The encrypted blob is still in a ConfigMap, and decryption key management adds complexity.
- ✗
Store secrets in a ConfigMap and mount as environment variables.
Why it's wrong here
ConfigMaps are not designed for secrets and are plaintext.
- ✓
Use Secret Manager and mount secrets as volumes using the Secret Manager CSI driver.
Why this is correct
This provides secure, audited access without storing secrets in the cluster.
- ✗
Use Kubernetes native Secrets, committing them to a private repository.
Why it's wrong here
Kubernetes Secrets are only base64 encoded, not encrypted by default.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which two best practices for managing secrets in Secret Manager? (Choose two.)
medium- ✓ A.Enable automatic replication to multiple regions for high availability.
- B.Use the Secret Manager API to list all secrets for any user.
- C.Set a short TTL for secret versions and delete them immediately.
- D.Store secrets in multiple ConfigMaps for redundancy.
- ✓ E.Use IAM conditions to restrict access based on resource tags.
Why A: Secret Manager supports automatic replication across regions, ensuring that secret data remains available even during a regional outage. This is a key best practice for high availability and disaster recovery, as it allows applications to read secrets from the nearest or alternate region without manual intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.