Your container runs in GKE and needs a secret. Which secure approach should you use?
Choose an answer
Tap an option to check your answer.
Correct answer: Store the credential in Secret Manager. Create a Google service account (GSA) to read the credential from Secret Manager. Create a Kubernetes service account (KSA) to run the container. Use Workload Identity to configure your KSA to act as a GSA..
Why this is the answer
The most secure and recommended approach is to use Secret Manager with Workload Identity. Secret Manager is a dedicated service for storing sensitive data, offering versioning, access control, and auditing. Workload Identity allows your Kubernetes Service Account (KSA) to impersonate a Google Service Account (GSA), granting fine-grained access to Google Cloud resources like Secret Manager without embedding credentials directly into your container or Pod. Passing a Kubernetes Secret as an environment variable is less secure as environment variables can be easily inspected. Application-layer Secret Encryption protects secrets at rest but doesn't manage access for applications. Exporting a GSA as a .json file and mounting it as a volume is insecure because the key file could be compromised if the container is breached.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed