Google Professional Cloud Developer Question 252
Select 3Google Cloud PlatformYou are tasked with building a secure container image for your application to be deployed on Google Kubernetes Engine (GKE). Which steps should you take to ensure the container image is secure?
- A
Use a minimal base image such as
distrolessoralpineto reduce the attack surface. - B
Store sensitive information such as database credentials in environment variables within the Dockerfile.
- C
Scan the container image for known vulnerabilities using tools like Google Cloud Container Analysis.
- D
Run the application in the container as a non-root user.
- E
Embed hard-coded secrets in the application code to simplify deployment.
Show answer and explanation
Correct answers: A, C, D
Explanation
To create secure container images, follow best practices such as minimizing the base image to reduce vulnerabilities, scanning images for known issues, and running containers as non-root users. Avoid insecure practices like hard-coding secrets or storing sensitive information in Dockerfiles. These steps help ensure your containerized application is secure and compliant with cloud security standards.
- A. Correct.
Using minimal base images such as
distrolessoralpinereduces the attack surface by minimizing unnecessary packages and libraries, which could contain vulnerabilities. - B. Incorrect.
Storing sensitive information like database credentials directly in the Dockerfile or environment variables is a security risk, as these can be exposed in image layers or logs.
- C. Correct.
Scanning the container image for known vulnerabilities is a critical step to ensure that the image does not contain any known security flaws. Tools like Google Cloud Container Analysis can help automate this process.
- D. Correct.
Running the application as a non-root user helps reduce the impact of potential container breaches by limiting access and privileges.
- E. Incorrect.
Embedding hard-coded secrets in the application code is highly insecure and violates best practices for secret management. Using secret management tools like Google Secret Manager is recommended instead.