A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application. The company wants to scan the images for known security issues and securely share the…

Question

Options

• A
  1. Enable Container Threat Detection in the Security Command Center Premium tier.
• B
  1. Use an open source tool in Cloud Build to scan the images.
• C
  1. Enable vulnerability scanning in the Artifact Registry settings.
• D
  1. Get a GitHub subscription.

• A
  12% (5)
• B
  7% (3)
• C
  76% (32)
• D
  5% (2)

Explanation

Artifact Registry has a built-in vulnerability scanning feature that automatically scans container images for known CVEs upon push and on an ongoing basis. Scan results are accessible via the Google Cloud Console and APIs, and access to those results is controlled by IAM - meaning the security team can be granted read access to view reports entirely within Google Cloud without any data leaving the environment. Container Threat Detection (A) monitors runtime behavior in GKE, not image-level vulnerability scanning. Open-source scanning in Cloud Build (B) introduces tooling that must be maintained and may not natively keep results inside Google Cloud. A GitHub subscription (D) is irrelevant to this requirement.

No community discussion yet for this question.