Google Professional Cloud Developer Question 101
Select 3Google Cloud PlatformYou are developing a containerized application that will be deployed on Google Kubernetes Engine (GKE). To enhance security, you want to ensure that the container images used in your application are free from known vulnerabilities in application binaries, dependencies, and manifests. Which steps should you take to achieve this using Google Cloud services?
- A
Enable Container Analysis to automatically scan container images for vulnerabilities.
- B
Use Binary Authorization to only allow deployment of trusted container images.
- C
Manually inspect each dependency in your container images for known vulnerabilities.
- D
Integrate Cloud Build with Container Analysis to scan images during the CI/CD pipeline.
- E
Store container images in a third-party registry to reduce vulnerability risks.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure your application binaries, dependencies, and manifests, you should leverage Google Cloud services like Container Analysis and Binary Authorization. These tools automate the detection of vulnerabilities and enforce security policies, reducing the risk of deploying vulnerable images. Integrating these tools into your CI/CD pipeline ensures a secure development lifecycle.
- A. Correct.
Enabling Container Analysis is a critical step to automatically scan container images for vulnerabilities. This is a primary service provided by Google Cloud to assess potential risks.
- B. Correct.
Binary Authorization ensures that only trusted container images that meet security policies are deployed. It provides an additional layer of security.
- C. Incorrect.
Manually inspecting dependencies is not practical or scalable, especially in modern CI/CD workflows. Automated tools like Container Analysis should be used instead.
- D. Correct.
Integrating Cloud Build with Container Analysis allows for vulnerability scanning at the build stage, ensuring that insecure images do not progress further in the pipeline.
- E. Incorrect.
Storing container images in a third-party registry does not inherently reduce vulnerability risks and does not utilize Google Cloud's security mechanisms for scanning.