Google Cloud Professional Cloud DevOps Engineer — Question 201

You use Cloud Build to build and deploy your application. You want to securely incorporate database credentials and other application secrets into the build pipeline. You also want to minimize the development effort. What should you do?

Answer options

• A. Create a Cloud Storage bucket and use the built-in encryption at rest. Store the secrets in the bucket and grant Cloud Build access to the bucket.
• B. Encrypt the secrets and store them in the application repository. Store a decryption key in a separate repository and grant Cloud Build access to the repository.
• C. Use client-side encryption to encrypt the secrets and store them in a Cloud Storage bucket. Store a decryption key in the bucket and grant Cloud Build access to the bucket.
• D. Use Cloud Key Management Service (Cloud KMS) to encrypt the secrets and include them in your Cloud Build deployment configuration. Grant Cloud Build access to the KeyRing.

Correct answer: D

Explanation

The correct answer is D because using Cloud Key Management Service (Cloud KMS) allows for secure management and encryption of secrets, which aligns with security best practices. Options A, B, and C do not provide the same level of security or ease of integration with Cloud Build as they involve either less secure storage or more complex management of decryption keys.