Google Professional Cloud Developer Question 100
Select 3Google Cloud PlatformYou are developing a containerized application on Google Cloud and need to ensure that the application binaries, dependencies, and manifests are regularly scanned for vulnerabilities before deployment. Which of the following steps should you take to implement this security mechanism effectively?
- A
Enable Container Analysis API to scan container images stored in Container Registry or Artifact Registry.
- B
Integrate Cloud Build with Container Analysis to automatically scan application artifacts during CI/CD pipelines.
- C
Manually download and inspect container images for vulnerabilities using third-party tools.
- D
Set up Binary Authorization to enforce deployment only for trusted, verified container images.
- E
Configure IAM roles to grant 'Viewer' access to Container Analysis results for your development team.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure application binaries, dependencies, and manifests, leveraging automated tools like the Container Analysis API is essential for vulnerability scanning. Integrating these tools with CI/CD pipelines (e.g., via Cloud Build) ensures continuous security checks. Additionally, Binary Authorization enforces the use of trusted and verified container images during deployment, enhancing the overall security posture. Manual inspection is not practical, and while IAM roles are important, they do not directly address scanning or enforcement needs in this scenario.
- A. Correct.
Correct: Enabling the Container Analysis API is the first step to ensure container images stored in Container Registry or Artifact Registry are scanned for vulnerabilities.
- B. Correct.
Correct: Integrating Cloud Build with Container Analysis ensures that application artifacts are automatically scanned during the CI/CD process, providing proactive security.
- C. Incorrect.
Incorrect: Manually downloading and inspecting container images is not a scalable or recommended practice when automated tools like Container Analysis are available.
- D. Correct.
Correct: Binary Authorization ensures that only trusted, verified container images are deployed, adding an additional layer of security.
- E. Incorrect.
Incorrect: While configuring IAM roles is important for access control, granting 'Viewer' access to the development team does not directly implement vulnerability scanning or enforcement mechanisms.