Taken from google "You can use an environment variable pointing to credentials outside of the application's source code, such as Cloud Key Management Service." so the environment variable is just POINTING the secret to the KMS service, where it is stored. So in my mind it is stored in KMS, the environment variable is just telling it to locate it at KMS.

The Q is, how to store them and not how to pass or handle them. And this https://cloud.google.com/kms/docs/store-secrets is even called "Storing Secrets".

Even if any sort of secrets involved. You still need a way to distinguish between environments. Environment varialbes would do the trick. C

https://cloud.google.com/kubernetes-engine/docs/concepts/secret
Using a Secret
To use a Secret with your workloads, you can specify environment variables that reference the Secret's values, or mount a volume containing the Secret.

@Gary if you want to be that specific, you should also consider this note from https://cloud.google.com/kms/docs/secret-management: “Note: Cloud KMS does not directly store secrets. It can encrypt secrets that you store elsewhere.“

environment variable store a point, not credentials
First, ADC checks to see if the environment variable GOOGLE_APPLICATION_CREDENTIALS is set. If the variable is set, ADC uses the service account file that the variable points to.

I would go with A, but here I'm confused because of this: https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application

So "C" could be the other right answer.

I think answer should be A.
https://cloud.google.com/kms/docs/secret-management