A development team is migrating a monolithic application to Google Cloud. The application reads a database password from a local configuration file at startup. The security team requires that the password be stored securely, rotated regularly, and accessed only by the application's service account. What is the most appropriate solution?

Use Application Default Credentials (ADC) to authenticate the application and store the password in a Cloud Storage bucket with a lifecycle rule.

Encrypt the password with Cloud KMS and store the ciphertext in a configuration file that the application reads at startup.

Set the password as an environment variable in the deployment manifest and reference it in the application code.

Store the password in Secret Manager and grant the service account the Secret Accessor role on the secret.

What is the principle of least privilege?

Granting all permissions to simplify management

Granting permissions based on seniority

Granting permissions only to administrators

Granting only the minimum permissions required to perform a task

What is the purpose of Artifact Analysis in Google Cloud?

To store container images in a private registry

To scan container images for vulnerabilities

To build container images from source code

To deploy container images to Kubernetes

Google CloudProfessional Cloud Developer

Domain 1Objective 2

1.2 Designing Secure Applications PROFESSIONAL-CLOUD-DEVELOPER Practice Questions (Page 9)

Part of the Designing highly scalable, secure, and reliable cloud-native applications domain, which accounts for ~32% of the PROFESSIONAL-CLOUD-DEVELOPER exam.

52questions here

11free pages

19concepts

~32%of the exam

19 Concepts in This Objective

Cloud Storage Object Lifecycle Management
Cloud Storage Retention Policies and Locks
Identity-Aware Proxy (IAP)
Web Security Scanner
Artifact Analysis Vulnerability Scanning
Security Command Center
Secret Manager
Cloud Key Management Service (KMS)
Workload Identity Federation
Application Default Credentials (ADC)
JSON Web Tokens (JWT) and OAuth 2.0
Cloud SQL Auth Proxy and AlloyDB Auth Proxy
Identity Platform
IAM Roles for Service Accounts
Cloud Service Mesh
Kubernetes Network Policies
Direct VPC Egress and Private Service Connectivity
Least Privileged Access
Binary Authorization

Questions 41–45

41application · medium
A development team is migrating a monolithic application to Google Cloud. The application reads a database password from a local configuration file at startup. The security team requires that the password be stored securely, rotated regularly, and accessed only by the application's service account. What is the most appropriate solution?
Select an answer first
42foundation · easy
What is the principle of least privilege?
Select an answer first
43foundation · easy
What is the purpose of Artifact Analysis in Google Cloud?
Select an answer first
44foundation · easy
Which principle should guide the assignment of IAM roles to service accounts?
Select an answer first
45foundation · easy
Which component must be configured to allow users to authenticate through IAP?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-DEVELOPER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-DEVELOPER” is a trademark of its owner, used for identification only.

1.2 Designing Secure Applications PROFESSIONAL-CLOUD-DEVELOPER Practice Questions (Page 9)

Questions 41–45

What is the principle of least privilege?

What is the purpose of Artifact Analysis in Google Cloud?

Which principle should guide the assignment of IAM roles to service accounts?

Which component must be configured to allow users to authenticate through IAP?

Keep studying — Designing highly scalable, secure, and reliable cloud-native applications