Your company uses a custom application to service thousands of users. The application is running on a Compute Engine and a Cloud SQL for PostgreSQL database. The company requires database passwords…

Question

Options

• A
  1. Store the credentials in an encrypted text file in the application.
• B
  1. Store the credentials to the database in Secret Manager.
• C
  1. Store the credentials in a text file in a Cloud Storage bucket.
• D
  1. Configure IAM database authentication for the application to connect to the database.

• A
  13% (7)
• B
  77% (41)
• C
  2% (1)
• D
  8% (4)

Explanation

Storing credentials in Secret Manager is the correct solution. Secret Manager provides encrypted, centralized secret storage with fine-grained IAM access control, audit logging, and version management. The application retrieves credentials at runtime via API, and when passwords are rotated every 60 days, only the secret version in Secret Manager needs to be updated - the application code does not change. Storing credentials in an encrypted text file bundled with the application (A) makes rotation difficult, risks credentials being embedded in source control or container images, and is not considered a secure practice. Storing in a plain text file in Cloud Storage (C) is insecure even with bucket-level permissions and violates the principle of least privilege and secret management best practices. IAM database authentication (D) would eliminate password rotation needs entirely by using short-lived IAM tokens, which is actually the most secure option, but the company's policy specifically mandates password rotation every 60 days, implying they require traditional username/password authentication - making Secret Manager the correct answer within that constraint.

No community discussion yet for this question.