Google Professional Cloud Developer Question 250
Select 3Google Cloud PlatformYou are tasked with creating secure container images for a web application as part of your deployment pipeline on Google Cloud. Which steps should you include in your CI/CD process to ensure the security of the container images?
- A
Use a minimal base image to reduce the attack surface.
- B
Store secrets such as API keys and database passwords directly in the Dockerfile.
- C
Scan the container image for vulnerabilities before deploying it to production.
- D
Use a private container registry like Artifact Registry to store your images securely.
- E
Run the container as the root user to simplify permissions management.
Show answer and explanation
Correct answers: A, C, D
Explanation
To create secure container images, you should minimize the attack surface by using minimal base images, scan your container images for vulnerabilities, and store them securely in a private registry. Avoid bad practices such as embedding secrets in the Dockerfile or running containers with privileged users.
- A. Correct.
Using a minimal base image reduces the attack surface by limiting the unnecessary software and dependencies present in the container.
- B. Incorrect.
Storing secrets in the Dockerfile is a bad practice because it can expose sensitive information. Secrets should be managed securely using tools like Secret Manager.
- C. Correct.
Scanning the container image for vulnerabilities ensures that known security flaws are identified and addressed before deployment.
- D. Correct.
Using a private container registry like Artifact Registry ensures that your images are stored securely and access is controlled.
- E. Incorrect.
Running the container as the root user is a security risk and should generally be avoided. Containers should run with the least privileges needed.