The InfoSec team has mandated that all new Cloud Run jobs and services in production must have Binary Authorization enabled. You need to enforce this requirement. What should you do?

Question

Options

• AConfigure an organization policy to require Binary Authorization enforcement on images deployed
• BConfigure a Security Health Analytics (SHA) custom rule that prevents the execution of Cloud
• CEnsure the Cloud Run admin role is not assigned to developers.
• DConfigure a Binary Authorization custom policy that is not editable by developers and auto-

• A
  91% (29)
• B
  6% (2)
• D
  3% (1)

Explanation

Google Cloud's Organization Policy Service includes the constraint run.allowedBinaryAuthorizationPolicies, which can be applied at the organization, folder, or project level to mandate that all Cloud Run services and jobs must have Binary Authorization enabled with an approved policy. This is a preventative control enforced by the platform itself - it blocks deployment of any Cloud Run workload that does not comply, regardless of who initiates the deployment. Option B (SHA custom rule) is a detective control that identifies violations after the fact but does not prevent non-compliant deployments. Option C (restricting the Cloud Run admin role) is an access control measure that does not enforce Binary Authorization specifically. Option D describes configuring the Binary Authorization policy itself, but without an organization policy to mandate its use, developers or admins could bypass it by deploying without Binary Authorization enabled.

No community discussion yet for this question.