GCP Associate Cloud Engineer Practice Question 37: Secret Manager DB Password
Google Cloud Associate Cloud Engineer · Test 4 · question 7 of 10
An application on Cloud Run connects to a database. The password is currently stored in plain text in the source repository. The security team wants the password removed from the code, versioned, and readable only by the application's service account.
What should you do?
Show answer and explanation
Answer:
Secret Manager stores secrets as versioned, encrypted objects with IAM access control and audit logging. Granting only roles/secretmanager.secretAccessor to the application's service account lets that identity read the value (Cloud Run can also expose it as an environment variable or mounted file), and nobody else can.
Option A still writes the password into the image and repository, so it remains exposed to anyone who can read either. Option B keeps the secret in the repository and the key has to be stored somewhere, which shifts the problem. Option D makes the secret available to any authenticated Google user, which is the opposite of restricting access.
Reference: Secret Manager overview