You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of…

Question

Options

• AImplement regular peer reviews to assess the environment variables and identify secrets in your
• BImplement a Cloud Function that scans the environment variables multiple times a day, and
• CUse Sensitive Data Protection to scan the environment variables multiple times per day, and
• DIntegrate dynamic application security testing into the CI/CD pipeline that scans the application

• A
  14% (5)
• B
  3% (1)
• C
  74% (26)
• D
  9% (3)

Explanation

Sensitive Data Protection (formerly Cloud DLP) is Google Cloud's purpose-built service for detecting sensitive data - including secrets, credentials, and PII - making it the right tool for automated, recurring scans of Cloud Functions environment variables; it requires no custom detection logic and scales reliably across your entire environment.

Why the distractors fall short:

• A (peer reviews) relies on manual, infrequent human effort, which is slow and error-prone - the exact problem the annual review revealed.
• B (custom Cloud Function scanner) reinvents the wheel by building detection logic from scratch when a managed service already exists; it also introduces maintenance burden and risk of incomplete detection.
• D (DAST in CI/CD) catches issues at deployment time but won't detect secrets that already exist in live function configurations, nor does it address environment variables as a data-at-rest concern.

Memory tip: Think "Sensitive Data Protection = Secrets Detected Proactively" - whenever an exam question involves finding sensitive data (secrets, PII, credentials) across GCP resources automatically and repeatedly, Sensitive Data Protection is the answer over manual reviews or custom scripts.

No community discussion yet for this question.