As part of your company's initiative to shift left on security, the InfoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the…

Question

Options

• AEnable Container Analysis in Artifact Registry, and check for common vulnerabilities and
• BUse Binary Authorization to attest images during your CI/CD pipeline
• CConfigure Identity and Access Management (IAM) policies to create a least privilege model on
• DDeploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods

• A
  5% (2)
• B
  76% (32)
• C
  14% (6)
• D
  5% (2)

Explanation

Binary Authorization enforces a deploy-time security policy that requires container images to have cryptographic attestations (approvals) from trusted authorities before they can run on GKE. This integrates directly into the CI/CD pipeline (shifting left) so only verified, attested images are ever deployed. Container Analysis (A) scans for vulnerabilities but does not block untrusted images. IAM policies (C) control who can deploy, not what images are allowed. Falco/Twistlock (D) monitor running workloads at runtime - they detect threats after deployment, which is not shifting left.

No community discussion yet for this question.