A company must reduce the risk from long-lived credentials used by its build system to deploy to Google Cloud. Which practice is the best choice?
Show answer and explanation
Answer: B
The strongest approach is to avoid long-lived keys altogether. Workload identity federation lets external pipelines exchange their own identity token for short-lived Google credentials, and attached service accounts serve workloads running on Google Cloud. Any keys that must remain should be rotated on a schedule, stored in a secret manager, and monitored through audit logs.
Why the other options are wrong
- A. A shared key multiplies the blast radius of a single leak and makes it impossible to tell which workload used it, so it is an anti-pattern.
- C. Committing a key to a repository, even a private one, exposes it to everyone with read access and to every clone and history snapshot, so it is unsafe.
- D. Copies of an owner's key spread a sensitive credential to more places and do not give emergency access in any controlled way.