Google Professional Cloud DevOps Engineer Question 223
Select 3Google Cloud PlatformYour organization stores container images in Google Artifact Registry. As a DevOps engineer, you need to ensure that the container images are free from known vulnerabilities before they are deployed. Which of the following actions will help you achieve this goal?
- A
Enable vulnerability scanning in Artifact Registry and review scan results.
- B
Manually inspect each container image before deployment for vulnerabilities.
- C
Set up a Cloud Build trigger to fail builds if a container image has critical vulnerabilities.
- D
Use Binary Authorization to prevent the deployment of untrusted container images.
- E
Deploy the container image and rely on runtime monitoring to identify vulnerabilities.
Show answer and explanation
Correct answers: A, C, D
Explanation
To ensure container images are free from known vulnerabilities, you should leverage automated tools and processes. Enabling vulnerability scanning in Artifact Registry helps identify issues proactively. Integrating this with CI/CD pipelines using Cloud Build triggers and enforcing deployment policies with Binary Authorization ensures that vulnerable images are blocked before deployment. Relying on runtime monitoring or manual inspections is either reactive or impractical for modern DevOps workflows.
- A. Correct.
Enabling vulnerability scanning in Artifact Registry allows you to automatically scan container images for known vulnerabilities and review the results to decide on actions.
- B. Incorrect.
Manually inspecting each container image is not scalable or reliable for vulnerability analysis, especially in automated CI/CD workflows.
- C. Correct.
Setting up a Cloud Build trigger to fail builds if critical vulnerabilities are detected ensures that images with issues are flagged during the CI/CD process.
- D. Correct.
Binary Authorization enforces deployment policies, such as blocking untrusted or vulnerable container images, which complements vulnerability scanning.
- E. Incorrect.
Deploying the container image and relying on runtime monitoring is reactive and does not prevent known vulnerabilities from being deployed initially.