Examkin

Question

Difficulty: MediumVulnerability Scanning, Container Security, and Threat Detection

An energy utility enterprise is modernizing its smart grid analytics platform hosted on Google Kubernetes Engine (GKE). The security team requires a software supply chain security model that guarantees only verified, signed container images from approved build pipelines can be deployed. Additionally, they require automated detection of newly published vulnerabilities for images already stored in Artifact Registry. Which TWO security configurations should the cloud architect implement to meet these requirements? (Select TWO.)

  1. Configure Binary Authorization on the GKE cluster with an attestation policy requiring cryptographic signatures generated during the CI/CD build process.Answer
  2. Enable continuous vulnerability scanning in Artifact Registry to automatically scan container images upon ingestion and monitor for newly disclosed vulnerabilities.Answer
  3. C
    Grant the primitive Owner IAM role to the GKE deployment service account so that Container Analysis can automatically modify running pods.
  4. D
    Disable control plane authorized networks on the private GKE cluster to allow Security Command Center agentless vulnerability scanning across public endpoints.

Answer

The cloud architect should implement Binary Authorization on GKE with attestation policies to ensure container image supply chain integrity, and enable continuous vulnerability scanning in Artifact Registry to monitor stored images for newly published CVEs.
Binary Authorization enforces supply chain security by blocking un-attested container images at deployment time, while Artifact Registry continuous vulnerability scanning provides ongoing automated detection of newly discovered CVEs in stored container images.

Step-by-Step Solution

1
Evaluate deploy-time image validation requirements
Identify Binary Authorization as the Google Cloud service designed to enforce attestation policies and block unverified container images from deploying onto GKE clusters.
Binary Authorization verifies cryptographic signatures created during CI/CD before deployment.
2
Evaluate image repository threat scanning requirements
Identify Artifact Registry continuous vulnerability scanning as the mechanism to scan images on push and continuously re-evaluate stored images as new CVE disclosures occur.
Continuous scanning provides automated, proactive discovery of vulnerabilities without requiring manual image rebuilds or re-scans.
3
Reject excessive privilege and perimeter exposure proposals
Discard options advocating primitive IAM role assignments or removing control plane authorized network restrictions on private GKE clusters.
Primitive IAM roles break principle of least privilege governance, and exposing GKE control plane endpoints introduces severe perimeter vulnerabilities.

Key Concept

Multi-layered container security using Binary Authorization for deployment attestation and Artifact Registry for continuous vulnerability scanning
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic