nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #145

You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from…

The correct answer is A. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud E. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have. On-demand container analysis can be integrated into a Cloud Build Pipeline: https://cloud.google.com/container-analysis/docs/ods-cloudbuild Also binary attestation is a complementary mechanism "cloud-native".

Submitted by layla.eg· Apr 18, 2026Ensuring compliance

Question

You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution: - Must be cloud-native - Must be cost-efficient - Minimize operational overhead How should you accomplish this? (Choose two.)

Options

  • ACreate a Cloud Build pipeline that will monitor changes to your container templates in a Cloud
  • BUse a Cloud Function triggered by log events in Google Cloud's operations suite to automatically
  • CUse a cron job on a Compute Engine instance to scan your existing repositories for known
  • DDeploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container
  • EIn your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have

How the community answered

(32 responses)
  • A
    63% (20)
  • B
    22% (7)
  • C
    9% (3)
  • D
    6% (2)

Explanation

On-demand container analysis can be integrated into a Cloud Build Pipeline: https://cloud.google.com/container-analysis/docs/ods-cloudbuild Also binary attestation is a complementary mechanism "cloud-native".

Topics

#CI/CD Security#Container Security#Vulnerability Scanning#Binary Authorization

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice