Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A security engineer is designing a secrets management strategy in Google Cloud Secret Manager to support a compliance mandate. The requirements include:
us-east4 and us-central1.Which configuration meets these requirements?
Secret Manager supports two replication models: automatic replication (where Google determines data placement globally) and user-managed replication (where administrators explicitly designate replica locations). When customer-managed encryption keys (CMEK) are configured on user-managed replicas, each replica location must be mapped to a regional Cloud Key Management Service (Cloud KMS) symmetric key hosted within that exact geographic region.
us-east4 and us-central1), secret payloads are confined strictly to those designated regions rather than replicated dynamically across unapproved global data centers.roles/cloudkms.cryptoKeyEncrypterDecrypter) role specifically to the Secret Manager Service Agent (service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com) grants the exact cryptographic operations required to encrypt and decrypt secret payloads without administrative or overprivileged permissions.This architecture guarantees strict adherence to geographic data placement constraints while maintaining end-to-end customer cryptographic control. Binding the minimal required IAM role directly to the service agent preserves the principle of least privilege.
Global Cloud KMS keys reside in the global logical location and can be invoked from any region. The Secret Manager Secret Accessor (roles/secretmanager.secretAccessor) IAM role allows identities to read secret payloads from Secret Manager.
roles/cloudkms.cryptoKeyEncrypterDecrypter), not permissions on the secret itself. Granting roles/secretmanager.secretAccessor does not provide cryptographic decrypt/encrypt rights to Cloud KMS.The goal was to permit an application identity or compute resource to fetch and read secret payloads from Secret Manager, rather than authorizing Secret Manager to perform envelope encryption with Cloud KMS.
Attempting to pair automatic replication with a single regional key attaches a single region's cryptographic key to a globally distributed resource, while authorizing the Compute Engine default service account (PROJECT_NUMBER-compute@developer.gserviceaccount.com).
us-east4 and us-central1.us-east4 for a globally replicated secret creates a cross-region dependency where an outage in us-east4 prevents secret payload decryption across all other regions.service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com).A Compute Engine instance hosted in us-east4 needed direct access to perform manual cryptographic operations using Cloud KMS client libraries.
Automatic replication in Secret Manager distributes secret payload replicas across Google-managed locations globally. Configuring a multi-region key allows services operating in multiple data centers across a continent to utilize keys hosted within that multi-region boundary.
us-east4 and us-central1. Secret payloads could be replicated to any Google Cloud location worldwide, violating strict data residency mandates.roles/cloudkms.admin) role grants administrative permissions to create, alter, disable, and destroy cryptographic keys and IAM bindings, but does not provide least-privilege cryptographic data access (encrypt and decrypt).The organization required global secret redundancy without data residency restrictions and intended to assign key administration rather than cryptographic encryption/decryption privileges.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated