You work for a financial services company that has a container-first approach. Your team develops microservices applications. You have a Cloud Build pipeline that creates a container image, runs regre

Question

Options

• ADeploy Voucher Server and Voucher Client components. After a container image has passed the
• BCreate an attestor and a policy. Run a vulnerability scan to create an attestation for the container
• CCreate an attestor and a policy. Create an attestation for the container images that have passed
• DSet the Pod Security Standard level to Restricted for the relevant namespaces. Digitally sign the

• A
  6% (1)
• B
  6% (1)
• C
  75% (12)
• D
  13% (2)

Explanation

Binary Authorization enforces deployment policies by requiring cryptographic attestations before allowing a container to run on GKE. The correct workflow is: (1) create an attestor (the trusted authority that signs attestations) and a policy (which requires that attestor's signature), then (2) after a container image passes regression tests in Cloud Build, create an attestation signed by that attestor. Only images with valid attestations matching the policy can be deployed. Option B incorrectly ties attestation to a vulnerability scan rather than regression test passage. Option A (Voucher) is a valid but significantly more complex framework. Option D (Pod Security Standards) controls workload permissions but cannot enforce which images are allowed based on test results.

No community discussion yet for this question.