QuestionQ338
Ensuring data protectionYou are creating a new governance model for your organization's secrets stored in Secret Manager. At present, Production and Non-Production application secrets are stored and accessed by using service accounts. The proposed solution must:
- Provide granular access to secrets
- Give you control over the rotation schedules for the encryption keys that wrap your secrets
- Preserve environment separation
- Provide ease of management
Which approach should you take?
- A
- Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.
- B
- Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
- C
- Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
- D
- Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.
Community Discussion