Secret Manager for credentials in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Secret Manager handle secret versioning?

When you add a new version to a secret in Google Cloud Secret Manager, what happens to the previous versions?

A Only the latest version is stored; older versions are overwritten.

B Previous versions are automatically deleted when a new version is added.

C All versions are merged into a single secret value.

D Previous versions remain accessible and can be enabled or disabled independently.

💡 Hint

Think about how you might want to roll back to an older password if needed.

Secret Manager keeps all versions of a secret. Each version can be enabled or disabled independently, allowing safe rollbacks or staged updates.

❓ security

intermediate

Which IAM role is needed to access secret values?

To allow a service account to read secret values from Secret Manager, which IAM role should you assign?

A roles/secretmanager.secretAccessor

B roles/viewer

C roles/secretmanager.admin

D roles/secretmanager.secretVersionAdder

💡 Hint

Look for the role that specifically allows reading secret data.

The role roles/secretmanager.secretAccessor grants permission to access secret versions' data without full admin rights.

❓ Architecture

advanced

Best architecture to securely provide database credentials to a Cloud Function

You want a Cloud Function to connect to a database using credentials stored in Secret Manager. Which architecture ensures the credentials are securely accessed and rotated?

A Embed credentials directly in Cloud Function code for faster access.

B Store credentials in Secret Manager, grant Cloud Function secretAccessor role, and fetch secrets at runtime.

C Store credentials in Cloud Storage and have Cloud Function read them from there.

D Use environment variables in Cloud Function with static credentials.

💡 Hint

Think about security best practices for secret storage and access.

Fetching secrets at runtime from Secret Manager with proper IAM roles ensures credentials are not hardcoded and can be rotated without redeploying code.

❓ Configuration

advanced

What is the correct gcloud command to add a new secret version?

You have a secret named db-password. Which command correctly adds a new version with the value from a file password.txt?

A gcloud secrets create db-password --data-file=password.txt

B gcloud secrets add-version db-password --data=password.txt

C gcloud secrets versions add db-password --data-file=password.txt

D gcloud secrets versions update db-password --data-file=password.txt

💡 Hint

Remember the command to add a new version to an existing secret.

The command gcloud secrets versions add adds a new version to an existing secret using the data from the specified file.

✅ Best Practice

expert

How to automate secret rotation with minimal downtime?

You want to rotate database credentials stored in Secret Manager automatically every 30 days without downtime. Which approach is best?

A Use a Cloud Scheduler job to trigger a Cloud Function that creates a new secret version and updates the database, then update clients to use the new version.

B Manually update the secret in Secret Manager and restart all clients immediately.

C Delete the old secret and create a new one with updated credentials every 30 days.

D Store credentials in environment variables and update them manually.

💡 Hint

Think about automation and smooth transition without service interruption.

Automating rotation with Cloud Scheduler and Cloud Functions allows seamless creation of new secret versions and updating the database, while clients can fetch the latest secret version without downtime.