Google Professional Cloud Developer Question 99
Select 3Google Cloud PlatformYou are a developer creating a containerized application and want to ensure the security of your application's container images by scanning for vulnerabilities in the binaries, dependencies, and manifests. Which of the following steps should you take to achieve this in Google Cloud?
- A
Use Container Analysis to scan the container images stored in Artifact Registry or Container Registry.
- B
Enable Binary Authorization to enforce only trusted and verified container images during deployment.
- C
Manually inspect the container image layers for any vulnerabilities.
- D
Integrate Google Cloud's Security Command Center to monitor and report any security issues with container images.
- E
Use Cloud Build with built-in vulnerability scanning to validate container images as part of the CI/CD pipeline.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure containerized applications in Google Cloud, developers should use tools like Container Analysis and Cloud Build for vulnerability scanning, and Binary Authorization for enforcing trusted deployments. These tools automate and integrate security checks into the application development and deployment lifecycle, ensuring robust security practices. Manual inspection and unrelated tools like Security Command Center are not sufficient or directly relevant for this specific use case.
- A. Correct.
Container Analysis is a Google Cloud service that scans container images for vulnerabilities in dependencies, binaries, and manifests. This is a key step in securing containerized applications.
- B. Correct.
Binary Authorization ensures only trusted container images are deployed to production by verifying that they meet defined security policies. This complements vulnerability scanning by enforcing security measures.
- C. Incorrect.
Manually inspecting container image layers is impractical and prone to errors. Automated tools like Container Analysis are more effective and reliable for vulnerability scanning.
- D. Incorrect.
Security Command Center is a centralized service for monitoring and managing security across Google Cloud resources, but it is not specifically designed for scanning container images.
- E. Correct.
Cloud Build can integrate with vulnerability scanning as part of the CI/CD process, ensuring container images are checked for security issues before deployment.