ExpertMedium1 markMultiple Choice
GCP PCA · Question 33 · Domain 3: Designing for Security and Compliance
Your application needs to authenticate with a third-party payment gateway using an API key. The security team requires that the API key is encrypted at rest, versioned, and access to it is strictly audited. Where should you store this API key?
Your application needs to authenticate with a third-party payment gateway using an API key. The security team requires that the API key is encrypted at rest, versioned, and access to it is strictly audited. Where should you store this API key?
Answer options:
A.
Cloud Storage with CMEK enabled.
B.
Secret Manager.
C.
Cloud KMS.
D.
Hardcoded in the application source code, but stored in a private Cloud Source Repository.
How to approach this question
Identify the data type: 'API key' (a secret). Match it to the GCP service designed for secrets.
Full Answer
B.Secret Manager.✓ Correct
Secret Manager.
Secret Manager is the GCP service purpose-built for storing sensitive data like API keys, database passwords, and TLS certificates. It handles versioning automatically, integrates tightly with IAM for access control, and logs all access attempts to Cloud Audit Logs.
Common mistakes
Confusing Secret Manager with Cloud KMS (C). KMS manages cryptographic keys. Secret Manager stores the actual secret payloads.
Practice the full GCP Professional Cloud Architect Practice Exam 3
50 questions · hints · full answers · grading
More questions from this exam
Q01**CASE STUDY: TechStream Gaming**
**Company Overview:**
TechStream Gaming is a global gaming com...MediumQ02**CASE STUDY: TechStream Gaming**
**Company Overview:**
TechStream Gaming is a global gaming com...HardQ03**CASE STUDY: TechStream Gaming**
**Company Overview:**
TechStream Gaming is a global gaming com...MediumQ04**CASE STUDY: TechStream Gaming**
**Company Overview:**
TechStream Gaming is a global gaming com...EasyQ05**CASE STUDY: TechStream Gaming**
**Company Overview:**
TechStream Gaming is a global gaming com...Medium