How to Timely Identify Secrets in Cloud Functions Environment Variables?

PCSE By islever Editorial Last updated

Short answer

C Use Sensitive Data Protection to periodically scan environment variables and generate Security Command Center findings for timely secret identification.

Question

You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?
  1. Implement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
  2. Implement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
  3. Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered. Correct Answer
  4. Integrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.

Key Takeaways

Tests knowledge of native GCP secret discovery workflows versus manual or pipeline-only approaches, with the trap being CI/CD static or dynamic testing which misses runtime exposure.

This PCSE question addresses ongoing secret detection in Google Cloud Functions. The page establishes that Sensitive Data Protection is the native service for periodic environment variable scanning and Security Command Center integration.

Common mistake: Option D is frequently chosen due to overemphasis on CI/CD prevention, but it fails to address ongoing runtime identification and incorrectly suggests Dynamic Application Security Testing for this use case.

Expert Analysis

Why the Answer Is Correct

Sensitive Data Protection provides a native, scalable solution for continuous secret discovery across Google Cloud resources. By configuring a discovery scan, administrators can schedule periodic checks against Cloud Functions environment variables, ensuring timely detection of newly injected credentials. When a match occurs, the service automatically generates a finding in Security Command Center, fulfilling the requirement for ongoing visibility without manual intervention.

Why the Other Options Are Wrong

Option A relies on manual peer reviews, which are inherently slow and cannot satisfy a "timely manner" requirement. Option B suggests building a custom Cloud Function to perform scanning, which unnecessarily duplicates existing managed capabilities and increases operational overhead. Option D focuses exclusively on the CI/CD pipeline, meaning it only catches secrets before deployment while ignoring runtime exposures, and incorrectly recommends Dynamic Application Security Testing for credential detection.

Community Comment Notes

Several learners initially favored the CI/CD approach, arguing that preventing secrets from entering production is ideal. However, the group consensus shifted once participants recognized that the prompt specifically demands ongoing identification rather than build-time blocking. As dv1 noted, "Question asks for secret identification, not blocking," which directly aligns with scheduled scanning. Verified documentation also confirms that Sensitive Data Protection natively supports this exact workflow for environment variables.

Official Reference

https://cloud.google.com/sensitive-data-protection/docs/secrets-discovery#why

This link opens the official vendor documentation in a new tab.

Exam Strategy

Focus on native GCP services for continuous compliance and monitoring rather than custom scripts or build-time checks. Always match the question's timeframe to automated, scheduled cloud-native solutions.

Frequently Asked Questions

Why isn't CI/CD secret scanning sufficient for this scenario?

CI/CD only validates code before deployment, missing runtime injections or post-deployment changes. Scheduled scanning covers the entire lifecycle.

Can Sensitive Data Protection replace manual peer reviews?

Yes, it automates continuous discovery across organizations and projects, eliminating human error and ensuring consistent, timely reporting.

More PCSE FAQ →

Community Votes

C
70%
D
30%

70% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. brpjp 👍 3
    Correct answer - D. For answer C, you need to integrate Sensitive Data Protection with CI/CD pipelines, which is missing here.
  2. dat987 👍 2 Answered C
    I think C: To perform secrets discovery, you create a discovery scan configuration at the organization or project level. Within your selected scope, Sensitive Data Protection periodically scans Cloud Run functions for secrets in build and runtime environment variables. If a secret is present in an environment variable, Sensitive Data Protection sends a Secrets in environment variables vulnerability finding to Security Command Center. No data profiles are generated. Any findings are only available through Security Command Center. Sensitive Data Protection generates a maximum of one finding per function. For example, if secrets are found in two environment variables in the same function, only one finding is generated in Security Command Center.
  3. dv1 👍 2 Answered C
    Question asks for secret identification, not blocking the cloud runs if exposed secrets are detected (what D says).
  4. nah99 👍 2 Answered C
    https://cloud.google.com/sensitive-data-protection/docs/secrets-discovery#why
  5. KLei 👍 1 Answered C
    (Dynamic application security testing): While this can help identify secrets in the code, it does not specifically address the secrets that may be present in environment variables
Show 1 more comment
  1. yokoyan 👍 3 Answered D
    I think it's D.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide