Examkin

Question

Difficulty: EasyVulnerability Scanning, Container Security, and Threat Detection

An organization is deploying application container images to Google Kubernetes Engine (GKE). To prevent unauthorized or untested code from running in production, the cloud security team requires that only container images digitally signed by an approved CI/CD attestation authority can be deployed to the cluster. Which Google Cloud service should the cloud architect configure to enforce this requirement?

  1. Binary AuthorizationAnswer
  2. B
    VPC Service Controls
  3. C
    Granting the Owner primitive IAM role to the deployment service account
  4. D
    Control plane authorized networks on GKE private clusters

Answer

Binary Authorization should be used to enforce deploy-time cryptographic signature validation for container images on GKE clusters.
Binary Authorization is Google Cloud's deploy-time security control that ensures only container images that have been built and signed by trusted attestors can be deployed to GKE clusters.

Step-by-Step Solution

1
Identify the security goal in the scenario
The requirement is to prevent untrusted or unsigned container images from being deployed to GKE.
Container supply chain security requires validating software signatures before execution.
2
Evaluate GCP native container security controls
Binary Authorization provides deployment-time policy enforcement based on cryptographic signatures (attestations).
It integrates directly with GKE deployment APIs to block non-compliant image deployments.

Key Concept

Deploy-time image verification using Binary Authorization
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic