A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system. How should the customer achieve this using Google Cloud Platform?

Storing secrets in Cloud SQL, even if not plain text, is not the intended purpose of a relational database for general secret management and lacks the dedicated features of a secret management service. Cloud Source Repositories is an SCM, which the problem states to move secrets from.

Using a service like Google Cloud Secret Manager, which encrypts secrets at rest, ideally with Customer-Managed Encryption Keys (CMEK) from Cloud KMS, provides a dedicated, secure, and auditable solution for storing secrets outside of SCM systems.

While Cloud Data Loss Prevention (DLP) API can scan for sensitive data, it's for detection and remediation, not for secure storage. Storing secrets in Cloud SQL is not the recommended primary solution for secret management.

Deploying SCM to a Compute Engine VM with local SSDs and preemptible VMs does not address the core problem of securely managing secrets; it only describes an infrastructure setup for the SCM system itself.