Google Professional Cloud Developer Question 97
Select 3Google Cloud PlatformYou are developing a containerized application and deploying it on Google Kubernetes Engine (GKE). To ensure the security of your application, you need to scan the container images for vulnerabilities in the application binaries, dependencies, and manifests before deployment. Which combination of steps will help you achieve this using Google Cloud services?
- A
Enable and configure Container Analysis to scan container images stored in Artifact Registry for vulnerabilities.
- B
Integrate Binary Authorization with your deployment pipeline to enforce only trusted images are deployed.
- C
Use the Cloud Storage API to manually scan container images for vulnerabilities before deployment.
- D
Leverage the Cloud Build service to automate security scanning during the CI/CD process.
- E
Manually inspect the Dockerfile and application dependencies before building the container image.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure application binaries, dependencies, and manifests in containerized applications, Google Cloud offers tools like Container Analysis for vulnerability scanning, Binary Authorization for deployment enforcement, and Cloud Build for automated CI/CD security integration. Together, these services provide a robust, automated solution for ensuring application security. Manual processes or unrelated services, like Cloud Storage, are not recommended for these tasks.
- A. Correct.
Correct: Container Analysis is a Google Cloud service that automatically scans container images stored in Artifact Registry or Container Registry for vulnerabilities. Enabling this ensures your images are monitored for known security issues.
- B. Correct.
Correct: Binary Authorization is a security measure that ensures only images that meet your security policies can be deployed to GKE. It integrates well with Container Analysis to block vulnerable images.
- C. Incorrect.
Incorrect: Cloud Storage is not designed for vulnerability scanning or security analysis of container images. Using it for this purpose is not a valid approach.
- D. Correct.
Correct: Cloud Build can automate the integration of vulnerability scanning in your CI/CD pipeline, ensuring all images are scanned before they are pushed to Artifact Registry or deployed.
- E. Incorrect.
Incorrect: While manual inspection might catch some issues, it is not a scalable or reliable security mechanism, and it doesn't utilize Google Cloud's powerful tools for automated scanning and enforcement.