Google Professional Cloud Security Engineer

Get started today

Ultimate access to all questions.

Quick Answer

Answer-first summary for fast verification

Answer: 1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.

The question requires a solution that provides granular access to secrets, control over encryption key rotation schedules, environment separation, and ease of management. Option A is optimal because: (1) Using separate projects for Production and Non-Production secrets maintains environment separation, (2) Project-level IAM bindings, while less granular than secret-level, can still provide adequate access control when combined with proper project organization and are easier to manage at scale, (3) Customer-managed encryption keys (CMEK) give full control over key rotation schedules, which is explicitly required. Option C uses Google-managed keys, which do not provide control over rotation schedules, violating a key requirement. Option B and D use a single project, failing environment separation. The community discussion shows 76% support for A, with the top-voted comment (13 upvotes) explaining that A meets all requirements, while comments favoring C (24%) overlook that Google-managed keys do not allow control over rotation.

Author: LeetQuiz Editorial Team

Quick Answer

Answer-first summary for fast verification

Author: LeetQuiz Editorial Team

Comments (0)

No comments yet.

You are designing a new governance model for secrets stored in Secret Manager. Currently, secrets for Production and Non-Production applications are stored and accessed using service accounts. Your proposed solution must:

Provide granular access to secrets

Give you control over the rotation schedules for the encryption keys that wrap your secrets

Maintain environment separation

Provide ease of management Which approach should you take?

Exam-Like

Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.

33.3%

Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.

33.3%

Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.

33.3%

Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.