Exam Professional Cloud Security Engineer topic 1 question 284 discussion

https://cloud.google.com/sensitive-data-protection/docs/secrets-discovery#why

(Dynamic application security testing): While this can help identify secrets in the code, it does not specifically address the secrets that may be present in environment variables

Question asks for secret identification, not blocking the cloud runs if exposed secrets are detected (what D says).

I think C: To perform secrets discovery, you create a discovery scan configuration at the organization or project level. Within your selected scope, Sensitive Data Protection periodically scans Cloud Run functions for secrets in build and runtime environment variables. If a secret is present in an environment variable, Sensitive Data Protection sends a Secrets in environment variables vulnerability finding to Security Command Center. No data profiles are generated. Any findings are only available through Security Command Center. Sensitive Data Protection generates a maximum of one finding per function. For example, if secrets are found in two environment variables in the same function, only one finding is generated in Security Command Center.

Correct answer - D. For answer C, you need to integrate Sensitive Data Protection with CI/CD pipelines, which is missing here.

I think it's D.