Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

A legacy automation job runs inside Google Cloud Build and still relies on reading a JSON key file for a user-managed service account. Your security team forbids checking the key into source control or writing it unencrypted to any persistent disk, but agrees that the key may continue to exist if it is protected by Google-managed encryption and tightly scoped IAM. You must update the build so the script can still read the key with almost no code changes and without violating policy. Which solution best meets these requirements?

  • Mount the key into the build step from a Kubernetes ConfigMap that is base64-encoded and protected by GKE-specific IAM permissions.

  • Delete the key entirely and configure the build to impersonate the service account using the iam.serviceAccountTokenCreator role.

  • Encrypt the key with Cloud KMS, upload the ciphertext to a dedicated Cloud Storage bucket, and have the build step download and decrypt the file before execution.

  • Store the JSON key as a Secret Manager secret, grant the Cloud Build service account "secretmanager.versions.access", and reference the secret with the secrets/secretEnv block so the script reads it from an injected environment variable.

GCP Professional Cloud Security Engineer
Configuring Access
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot