nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #315

Your organization heavily utilizes serverless applications while prioritizing security best practices. You are responsible for enforcing image provenance and compliance with security standards…

The correct answer is C. Create a Binary Authorization attestor that retrieves the Cloud Build build ID of the container. To enforce that only images built by your Cloud Build pipeline are deployed and that they pass security checks using Binary Authorization, create an attestor that verifies the Cloud Build ID and also integrates with security scan attestations.

Submitted by anna_se· Apr 18, 2026Ensuring compliance

Question

Your organization heavily utilizes serverless applications while prioritizing security best practices. You are responsible for enforcing image provenance and compliance with security standards before deployment. You leverage Cloud Build as your continuous integration and continuous deployment (CI/CD) tool for building container images. You must configure Binary Authorization to ensure that only images built by your Cloud Build pipeline are deployed and that the images pass security standard compliance checks. What should you do?

Options

  • ACreate a Binary Authorization attestor that uses a scanner to assess source code management
  • BCreate a Binary Authorization attestor that utilizes a scanner to evaluate container image build
  • CCreate a Binary Authorization attestor that retrieves the Cloud Build build ID of the container
  • DUtilize a custom Security Health Analytics module to create a policy. Enforce the policy through

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    9% (2)
  • C
    83% (19)
  • D
    4% (1)

Why each option

To enforce that only images built by your Cloud Build pipeline are deployed and that they pass security checks using Binary Authorization, create an attestor that verifies the Cloud Build ID and also integrates with security scan attestations.

ACreate a Binary Authorization attestor that uses a scanner to assess source code management

Scanning source code management occurs before the build process and is not directly handled by Binary Authorization, which primarily verifies post-build artifacts and attestations before deployment.

BCreate a Binary Authorization attestor that utilizes a scanner to evaluate container image build

While attestors can verify scan results, this option misses the specific requirement to verify that images were built by 'your Cloud Build pipeline' using the build ID for provenance.

CCreate a Binary Authorization attestor that retrieves the Cloud Build build ID of the containerCorrect

This approach uses Binary Authorization to verify both provenance (by retrieving and validating the Cloud Build ID from an attestation automatically generated by Cloud Build) and compliance (by requiring and verifying additional attestations from security scan results), directly addressing both requirements for deployment enforcement.

DUtilize a custom Security Health Analytics module to create a policy. Enforce the policy through

Security Health Analytics and Security Command Center identify vulnerabilities and misconfigurations but do not provide the deployment-time enforcement mechanism required by Binary Authorization for image provenance and attestation verification.

Concept tested: Binary Authorization with Cloud Build provenance

Source: https://cloud.google.com/binary-authorization/docs/cloud-build-integration

Topics

#Binary Authorization#Cloud Build#Image Provenance#CI/CD Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice