Your company wants to collect and analyze CVE information for packages in container images, and wants to prevent images with known security issues from running in your Google Kubernetes Engine…

The correct answer is A. Deployment policies. Google recommends two complementary features in a container build pipeline: (1) Vulnerability scanning (e.g., Artifact Analysis / Container Analysis) to detect CVEs in packages, and (2) Deployment policies via Binary Authorization to enforce that only scanned and approved…

Submitted by devops_kid· Apr 18, 2026Ensuring compliance

Question

Your company wants to collect and analyze CVE information for packages in container images, and wants to prevent images with known security issues from running in your Google Kubernetes Engine environment. Which two security features does Google recommend including in a container build pipeline?

Options

ADeployment policies
BPassword policies
CVulnerability scanning
DNetwork isolation

How the community answered

(62 responses)

A
77% (48)
B
13% (8)
C
3% (2)
D
6% (4)

Explanation

Google recommends two complementary features in a container build pipeline: (1) Vulnerability scanning (e.g., Artifact Analysis / Container Analysis) to detect CVEs in packages, and (2) Deployment policies via Binary Authorization to enforce that only scanned and approved images are allowed to run in GKE. Binary Authorization acts as a policy gate - if an image has known vulnerabilities or has not been attested as clean, the deployment is blocked. While the listed correct answer shows only 'A' (Deployment policies), the full Google-recommended approach pairs deployment policies with vulnerability scanning (C). Password policies (B) and network isolation (D) are not specific to container image security pipelines.

Topics

#Container Security#Kubernetes Engine (GKE)#Deployment Policies#Software Supply Chain Security

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice