Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your…

Question

Options

• AUse Kubernetes role-based access control (RBAC) as the source of truth for cluster access by
• BUse gcloud artifacts docker images describe LOCATION-
• CEnforce the use of Cloud Code for development so users receive real-time security feedback on
• DEnable Binary Authorization and create attestations of scans.

• A
  9% (4)
• B
  2% (1)
• C
  19% (8)
• D
  70% (30)

Explanation

Binary Authorization is a deploy-time security control for GKE and Cloud Run that enforces a policy requiring container images to be attested before they are allowed to run. In a CI/CD pipeline, vulnerability scanning tools (such as Container Analysis in Artifact Registry) scan images and create cryptographic attestations upon passing. Binary Authorization then verifies these attestations at deploy time, blocking any unscanned or non-verified images from running. This is a fully automated, end-to-end solution that covers both requirements: automatic scanning in the pipeline and enforcement of verified-only deployments. Option A (Kubernetes RBAC) controls who can access the cluster, not image verification. Option B is a manual, one-time gcloud command, not an automated pipeline control. Option C (Cloud Code) only provides feedback during development and cannot enforce deployment-time verification.

No community discussion yet for this question.