Your organization relies heavily on Cloud Run for its containerized applications. You utilize Cloud Build for image creation, Artifact Registry for image storage, and Cloud Run for deployment. You…

Question

Options

• AImplement vulnerability scanning as part of the Cloud Build process. If any medium or higher
• BPerform manual vulnerability checks post-build, but before Cloud Run deployment. Implement a
• CConfigure Binary Authorization on Cloud Run to enforce image signatures. Create policies to
• DUtilize a vulnerability scanner during the Cloud Build stage and set Artifact Registry permissions

• A
  4% (1)
• B
  13% (3)
• C
  74% (17)
• D
  9% (2)

Explanation

Binary Authorization is a deploy-time security control that requires container images to be attested (cryptographically signed by a trusted authority) before they can be deployed to Cloud Run or GKE. By configuring Binary Authorization with a policy that requires a vulnerability-scan attestation, and by setting up an attestor that only signs images with no medium-or-higher CVEs, you create an automated, policy-enforced gate that prevents non-compliant images from ever reaching production - regardless of how deployment is triggered. Option A (breaking the build) can be bypassed by deploying an image directly from Artifact Registry. Option D restricts who can pull images but does not enforce a vulnerability threshold at deployment time.

No community discussion yet for this question.