For data residency requirements, you want your secrets in Google Clouds Secret Manager to only have payloads in europe-west1 and europe-west4. Your secrets must be highly available in both regions…

Question

Options

• ACreate your secret with a user managed replication policy, and choose only compliant locations.
• BCreate your secret with an automatic replication policy, and choose only compliant locations.
• CCreate two secrets by using Terraform, one in europe-west1 and the other in europe-west4.
• DCreate your secret with an automatic replication policy, and create an organizational policy to

• A
  72% (28)
• B
  13% (5)
• C
  10% (4)
• D
  5% (2)

Explanation

Secret Manager supports two replication policies: automatic and user-managed. With a user-managed replication policy, you explicitly specify the list of regions where the secret payload will be stored, allowing you to restrict storage to europe-west1 and europe-west4 for data residency compliance. Selecting both regions also provides high availability. Option B is incorrect because automatic replication does not allow you to choose specific regions - Google manages placement globally. Option C (two separate secrets via Terraform) would create two distinct secrets, not one highly available secret replicated across two regions. Option D is incorrect because automatic replication cannot be scoped to specific regions even with an org policy; user-managed replication is the correct mechanism.

No community discussion yet for this question.