Google Professional Cloud DevOps Engineer Question 224
Select 3Google Cloud PlatformYour team is developing a containerized application and deploying it to Google Kubernetes Engine (GKE). To enhance the software supply chain security, you want to ensure only trusted container images are deployed to the cluster. Additionally, you aim to follow industry best practices for securing the software supply chain. Which of the following actions should you take?
- A
Implement Binary Authorization to enforce deployment policies for trusted container images.
- B
Adopt the Supply-chain Levels for Software Artifacts (SLSA) framework to assess and improve the security posture of your software supply chain.
- C
Use a custom-built image scanner instead of integrating with Google Container Analysis for vulnerability scanning.
- D
Allow developers to pull container images directly from public registries for faster deployments.
- E
Enable Google Cloud Artifact Registry and configure it as a trusted source for container images.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure a containerized application in GKE, you should implement Binary Authorization to enforce deployment policies for trusted images. Adopting the SLSA framework ensures your organization follows industry best practices for software supply chain security. Additionally, enabling Artifact Registry as a trusted source prevents unvetted container images from being used. Avoiding direct pulls from public registries and using integrated vulnerability scanning tools like Google Container Analysis further enhances security.
- A. Correct.
Correct. Binary Authorization helps enforce deployment policies, ensuring only trusted container images are deployed to the cluster. This is critical for securing your software supply chain.
- B. Correct.
Correct. The SLSA framework provides a structured approach to assess and improve the security of your software supply chain, aligning with industry best practices.
- C. Incorrect.
Incorrect. While custom-built solutions can be useful in specific cases, Google Container Analysis is a proven and integrated solution for vulnerability scanning in Google Cloud. It is recommended over a custom-built scanner in this scenario.
- D. Incorrect.
Incorrect. Pulling container images directly from public registries introduces significant security risks as the images may not be vetted or trusted.
- E. Correct.
Correct. Google Cloud Artifact Registry allows you to manage and control your container images, ensuring they come from a trusted and secure source.