The answer is to use Secret Manager and mount secrets as volumes via the Secret Manager CSI driver. This is correct because Secret Manager offers a centralized, encrypted, and auditable vault for sensitive data like database credentials and API keys, while the CSI driver enables pods to consume those secrets directly as mounted volumes without ever storing them in plaintext within container images, Kubernetes manifests, or etcd. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding of how to enforce a zero-trust secret lifecycle in GKE, often contrasting with less secure options like Kubernetes Secrets or environment variables. A common trap is assuming Kubernetes Secrets alone are sufficient—they are only base64-encoded, not encrypted by default. Remember the mnemonic “CSI for CSI” (Cloud Secret Integration) to recall that the CSI driver is the bridge that keeps secrets off the node’s disk and out of your YAML.
PCSE Ensuring data protection Practice Question
This PCSE practice question tests your understanding of ensuring data protection. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is deploying a microservices architecture on Google Kubernetes Engine (GKE). They need to securely store and access database credentials, API keys, and other secrets. They want to avoid storing secrets in plaintext in the container image or Kubernetes manifests. Which solution should they use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Secret Manager and mount secrets as volumes using the Secret Manager CSI driver.
Option C is correct because Secret Manager provides a centralized, secure, and auditable way to store secrets, and the Secret Manager CSI driver allows pods to mount these secrets as volumes without exposing them in the container image or Kubernetes manifests. This approach ensures secrets are never stored in plaintext on disk or in etcd, and it integrates with GKE's workload identity for fine-grained access control.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Encrypt secrets with Cloud KMS and store them in a ConfigMap.
Why it's wrong here
The encrypted blob is still in a ConfigMap, and decryption key management adds complexity.
✗
Store secrets in a ConfigMap and mount as environment variables.
Why it's wrong here
ConfigMaps are not designed for secrets and are plaintext.
✓
Use Secret Manager and mount secrets as volumes using the Secret Manager CSI driver.
Why this is correct
This provides secure, audited access without storing secrets in the cluster.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use Kubernetes native Secrets, committing them to a private repository.
Why it's wrong here
Kubernetes Secrets are only base64 encoded, not encrypted by default.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Kubernetes native Secrets (which are only base64-encoded, not encrypted) with a secure solution, or they assume ConfigMaps can be used for secrets if encrypted, missing the fact that ConfigMaps are not designed for sensitive data and are stored in plaintext in etcd.
Detailed technical explanation
How to think about this question
The Secret Manager CSI driver uses the Container Storage Interface (CSI) to mount secrets as ephemeral volumes, ensuring secrets are never written to the pod's filesystem or logs. Under the hood, the driver calls the Secret Manager API to retrieve the secret value at mount time, and the volume is backed by a tmpfs in memory, which is automatically cleaned up when the pod terminates. This approach also supports automatic rotation of secrets without restarting pods, as the driver can refresh the mount contents when the secret is updated in Secret Manager.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Ensuring data protection — This question tests Ensuring data protection — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use Secret Manager and mount secrets as volumes using the Secret Manager CSI driver. — Option C is correct because Secret Manager provides a centralized, secure, and auditable way to store secrets, and the Secret Manager CSI driver allows pods to mount these secrets as volumes without exposing them in the container image or Kubernetes manifests. This approach ensures secrets are never stored in plaintext on disk or in etcd, and it integrates with GKE's workload identity for fine-grained access control.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which two best practices for managing secrets in Secret Manager? (Choose two.)
medium
✓ A.Enable automatic replication to multiple regions for high availability.
B.Use the Secret Manager API to list all secrets for any user.
C.Set a short TTL for secret versions and delete them immediately.
D.Store secrets in multiple ConfigMaps for redundancy.
✓ E.Use IAM conditions to restrict access based on resource tags.
Why A: Option A is correct because Secret Manager supports automatic replication across regions, ensuring that secret data remains available even during a regional outage. This is a key best practice for high availability and disaster recovery, as it allows applications to read secrets from the nearest or alternate region without manual intervention.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.