Examkin

Soru

Zorluk: KolayVulnerability Scanning, Container Security, and Threat Detection

An organization is deploying application container images to Google Kubernetes Engine (GKE). To prevent unauthorized or untested code from running in production, the cloud security team requires that only container images digitally signed by an approved CI/CD attestation authority can be deployed to the cluster. Which Google Cloud service should the cloud architect configure to enforce this requirement?

  1. Binary AuthorizationCevap
  2. B
    VPC Service Controls
  3. C
    Granting the Owner primitive IAM role to the deployment service account
  4. D
    Control plane authorized networks on GKE private clusters

Cevap

Binary Authorization should be used to enforce deploy-time cryptographic signature validation for container images on GKE clusters.
Binary Authorization is Google Cloud's deploy-time security control that ensures only container images that have been built and signed by trusted attestors can be deployed to GKE clusters.

Adım Adım Çözüm

1
Identify the security goal in the scenario
The requirement is to prevent untrusted or unsigned container images from being deployed to GKE.
Container supply chain security requires validating software signatures before execution.
2
Evaluate GCP native container security controls
Binary Authorization provides deployment-time policy enforcement based on cryptographic signatures (attestations).
It integrates directly with GKE deployment APIs to block non-compliant image deployments.

Anahtar Kavram

Deploy-time image verification using Binary Authorization
Bu soruyu puanla

Konular

Vulnerability Scanning, Container Security, and Threat Detection

Bu konudan daha fazla soru