Secret Manager for credentials in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Secret Manager handle secret versioning?

When you add a new version to a secret in Google Cloud Secret Manager, what happens to the previous versions?

A Only the latest version is stored; older versions are overwritten.

B Previous versions are automatically deleted when a new version is added.

C All versions are merged into a single secret value.

D Previous versions remain accessible and can be enabled or disabled independently.

💡 Hint

Think about how you might want to roll back to an older password if needed.

Secret Manager keeps all versions of a secret. Each version can be enabled or disabled independently, allowing safe rollbacks or staged updates.

❓ security

intermediate

Which IAM role is needed to access secret values?

To allow a service account to read secret values from Secret Manager, which IAM role should you assign?

A roles/secretmanager.secretAccessor

B roles/viewer

C roles/secretmanager.admin

D roles/secretmanager.secretVersionAdder

💡 Hint

Look for the role that specifically allows reading secret data.

The role roles/secretmanager.secretAccessor grants permission to access secret versions' data without full admin rights.

❓ Architecture

advanced

Best architecture to securely provide database credentials to a Cloud Function

You want a Cloud Function to connect to a database using credentials stored in Secret Manager. Which architecture ensures the credentials are securely accessed and rotated?

A Embed credentials directly in Cloud Function code for faster access.

B Store credentials in Secret Manager, grant Cloud Function secretAccessor role, and fetch secrets at runtime.

C Store credentials in Cloud Storage and have Cloud Function read them from there.

D Use environment variables in Cloud Function with static credentials.

💡 Hint

Think about security best practices for secret storage and access.

Fetching secrets at runtime from Secret Manager with proper IAM roles ensures credentials are not hardcoded and can be rotated without redeploying code.

❓ Configuration

advanced

What is the correct gcloud command to add a new secret version?

You have a secret named db-password. Which command correctly adds a new version with the value from a file password.txt?

A gcloud secrets create db-password --data-file=password.txt

B gcloud secrets add-version db-password --data=password.txt

C gcloud secrets versions add db-password --data-file=password.txt

D gcloud secrets versions update db-password --data-file=password.txt

💡 Hint

Remember the command to add a new version to an existing secret.

The command gcloud secrets versions add adds a new version to an existing secret using the data from the specified file.

✅ Best Practice

expert

How to automate secret rotation with minimal downtime?

You want to rotate database credentials stored in Secret Manager automatically every 30 days without downtime. Which approach is best?

A Use a Cloud Scheduler job to trigger a Cloud Function that creates a new secret version and updates the database, then update clients to use the new version.

B Manually update the secret in Secret Manager and restart all clients immediately.

C Delete the old secret and create a new one with updated credentials every 30 days.

D Store credentials in environment variables and update them manually.

💡 Hint

Think about automation and smooth transition without service interruption.

Automating rotation with Cloud Scheduler and Cloud Functions allows seamless creation of new secret versions and updating the database, while clients can fetch the latest secret version without downtime.

Practice

1. What is the main purpose of Google Cloud Secret Manager?

easy

A. To host websites and web applications

B. To securely store and manage sensitive information like passwords and API keys

C. To analyze large datasets quickly

D. To create virtual machines for computing tasks

Solution

1. Step 1: Understand Secret Manager's role

   Secret Manager is designed to keep sensitive data safe and accessible only to authorized users.

2. Step 2: Compare options with Secret Manager's function

   Options A, C, and D describe other cloud services, not Secret Manager.

3. Final Answer:

   To securely store and manage sensitive information like passwords and API keys -> Option B

4. Quick Check:

   Secret Manager = Secure storage [OK]

Hint: Secret Manager = safe storage for secrets [OK]

Common Mistakes:

• Confusing Secret Manager with compute or storage services
• Thinking it hosts websites or runs code
• Assuming it analyzes data

2. Which command correctly creates a new secret named db-password in Secret Manager?

easy

A. gcloud secrets create db-password --replication-policy="automatic"

B. gcloud secret create db-password --auto-replication

C. gcloud secrets add db-password --replication=auto

D. gcloud create secret db-password --replication-policy=manual

Solution

1. Step 1: Recall correct gcloud syntax for creating secrets

   The correct command uses gcloud secrets create with the secret name and replication policy.

2. Step 2: Check each option's syntax

   gcloud secrets create db-password --replication-policy="automatic" matches the correct syntax exactly. Options A, B, and C have incorrect command structure or flags.

3. Final Answer:

   gcloud secrets create db-password --replication-policy="automatic" -> Option A

4. Quick Check:

   Correct command syntax = gcloud secrets create db-password --replication-policy="automatic" [OK]

Hint: Use 'gcloud secrets create' with replication policy [OK]

Common Mistakes:

• Using 'secret' instead of 'secrets' in command
• Wrong flag names like --auto-replication
• Incorrect command order or missing quotes

3. Given this Python code snippet accessing a secret version:

from google.cloud import secretmanager
client = secretmanager.SecretManagerServiceClient()
name = "projects/my-project/secrets/api-key/versions/latest"
response = client.access_secret_version(name=name)
payload = response.payload.data.decode("UTF-8")
print(payload)

What will this code print if the secret value is supersecret123?

medium

A. supersecret123

B. b'supersecret123'

C. api-key

D. projects/my-project/secrets/api-key/versions/latest

Solution

1. Step 1: Understand the code flow

   The code accesses the latest version of the secret named 'api-key' and decodes the binary data to a UTF-8 string.

2. Step 2: Determine the printed output

   Since payload.data is decoded, the output is the plain string 'supersecret123', not bytes or other values.

3. Final Answer:

   supersecret123 -> Option A

4. Quick Check:

   Decoded secret value = 'supersecret123' [OK]

Hint: Decoded secret data prints as plain string [OK]

Common Mistakes:

• Printing raw bytes without decoding
• Confusing secret name with secret value
• Expecting metadata instead of secret content

4. You try to access a secret but get a permission denied error. What is the most likely cause?

medium

A. The secret value is empty

B. The secret does not exist in the project

C. The secret version is disabled

D. The service account lacks the Secret Manager Secret Accessor role

Solution

1. Step 1: Analyze permission denied error context

   Permission denied usually means the caller lacks rights to access the secret.

2. Step 2: Identify required role for access

   The Secret Manager Secret Accessor role grants permission to read secret versions. Without it, access is denied.

3. Final Answer:

   The service account lacks the Secret Manager Secret Accessor role -> Option D

4. Quick Check:

   Permission denied = missing access role [OK]

Hint: Check service account roles for Secret Accessor permission [OK]

Common Mistakes:

• Assuming secret absence causes permission error
• Ignoring secret version state
• Thinking empty secret causes permission denied

5. You want to rotate a database password stored in Secret Manager without downtime. Which approach is best?

hard

A. Manually update the password in the database and Secret Manager at the same time

B. Delete the old secret and create a new secret with the new password

C. Create a new secret version with the new password and update your app to use the latest version

D. Store the password in a config file instead of Secret Manager

Solution

1. Step 1: Understand secret rotation best practice

   Adding a new secret version allows smooth transition without deleting old data, avoiding downtime.

2. Step 2: Evaluate options for zero downtime

   Create a new secret version with the new password and update your app to use the latest version uses versioning and app update to switch secrets seamlessly. Delete the old secret and create a new secret with the new password deletes data causing downtime. Manually update the password in the database and Secret Manager at the same time risks inconsistency. Store the password in a config file instead of Secret Manager is insecure.

3. Final Answer:

   Create a new secret version with the new password and update your app to use the latest version -> Option C

4. Quick Check:

   Rotate by adding new version, not deleting [OK]

Hint: Rotate secrets by adding versions, not deleting old ones [OK]

Common Mistakes:

• Deleting secrets causing downtime
• Updating database and secret separately risking mismatch
• Storing passwords insecurely outside Secret Manager