How to Timely Identify Secrets in Cloud Functions Environment Variables?

Secret Management & Discovery

Answer Correct answer: C — Use Sensitive Data Protection to periodically scan environment variables and generate Security Command Center findings for timely secret identification.

You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?

Implement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
Implement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered. Correct Answer
Integrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.

sensitive data protection secrets discovery cloud functions environment variable scanning pcse security command center findings google cloud secret management

Community Votes

70%

30%

70% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests knowledge of native GCP secret discovery workflows versus manual or pipeline-only approaches, with the trap being CI/CD static or dynamic testing which misses runtime exposure.

This PCSE question addresses ongoing secret detection in Google Cloud Functions. The page establishes that Sensitive Data Protection is the native service for periodic environment variable scanning and Security Command Center integration.

Option D is frequently chosen due to overemphasis on CI/CD prevention, but it fails to address ongoing runtime identification and incorrectly suggests Dynamic Application Security Testing for this use case.

Community Discussion (6 comments)

nah99 👍 2 Selected: C

https://cloud.google.com/sensitive-data-protection/docs/secrets-discovery#why

KLei 👍 1 Selected: C

(Dynamic application security testing): While this can help identify secrets in the code, it does not specifically address the secrets that may be present in environment variables

dv1 👍 2 Selected: C

Question asks for secret identification, not blocking the cloud runs if exposed secrets are detected (what D says).

dat987 👍 2 Selected: C

I think C: To perform secrets discovery, you create a discovery scan configuration at the organization or project level. Within your selected scope, Sensitive Data Protection periodically scans Cloud Run functions for secrets in build and runtime environment variables. If a secret is present in an environment variable, Sensitive Data Protection sends a Secrets in environment variables vulnerability finding to Security Command Center. No data profiles are generated. Any findings are only available through Security Command Center. Sensitive Data Protection generates a maximum of one finding per function. For example, if secrets are found in two environment variables in the same function, only one finding is generated in Security Command Center.

brpjp 👍 3

Correct answer - D. For answer C, you need to integrate Sensitive Data Protection with CI/CD pipelines, which is missing here.

yokoyan 👍 3 Selected: D

I think it's D.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Sensitive Data Protection provides a native, scalable solution for continuous secret discovery across Google Cloud resources. By configuring a discovery scan, administrators can schedule periodic checks against Cloud Functions environment variables, ensuring timely detection of newly injected credentials. When a match occurs, the service automatically generates a finding in Security Command Center, fulfilling the requirement for ongoing visibility without manual intervention.

Why the Other Options Are Wrong

Option A relies on manual peer reviews, which are inherently slow and cannot satisfy a "timely manner" requirement. Option B suggests building a custom Cloud Function to perform scanning, which unnecessarily duplicates existing managed capabilities and increases operational overhead. Option D focuses exclusively on the CI/CD pipeline, meaning it only catches secrets before deployment while ignoring runtime exposures, and incorrectly recommends Dynamic Application Security Testing for credential detection.

Community Comment Notes

Several learners initially favored the CI/CD approach, arguing that preventing secrets from entering production is ideal. However, the group consensus shifted once participants recognized that the prompt specifically demands ongoing identification rather than build-time blocking. As dv1 noted, "Question asks for secret identification, not blocking," which directly aligns with scheduled scanning. Verified documentation also confirms that Sensitive Data Protection natively supports this exact workflow for environment variables.

Official Reference

Exam Strategy

Focus on native GCP services for continuous compliance and monitoring rather than custom scripts or build-time checks. Always match the question's timeframe to automated, scheduled cloud-native solutions.

Frequently Asked Questions

Why isn't CI/CD secret scanning sufficient for this scenario?

CI/CD only validates code before deployment, missing runtime injections or post-deployment changes. Scheduled scanning covers the entire lifecycle.

Can Sensitive Data Protection replace manual peer reviews?

Yes, it automates continuous discovery across organizations and projects, eliminating human error and ensuring consistent, timely reporting.

Related Analysis

← Back to PCSE Study Guide