Google Professional Cloud DevOps Engineer Question 88
Select 3Google Cloud PlatformYour organization uses Google Cloud's Artifact Registry to store container images, and you are tasked with ensuring that no vulnerable images are deployed to production. How can you configure Artifact Registry to identify vulnerabilities in stored container images and prevent their deployment?
- A
Enable vulnerability scanning in Artifact Registry and ensure that CI/CD pipelines verify image vulnerabilities before deployment.
- B
Manually run a vulnerability scan for each container image stored in Artifact Registry before deployment.
- C
Set up a policy in Google Cloud Binary Authorization to block deployments of images with vulnerabilities.
- D
Use Cloud Logging to monitor vulnerability scan results and raise alerts for high-severity vulnerabilities.
- E
Configure Artifact Registry to automatically remove images flagged with vulnerabilities.
Show answer and explanation
Correct answers: A, C, D
Explanation
To maintain a secure software supply chain, Artifact Registry can perform automated vulnerability scanning on container images. Enabling vulnerability scanning, enforcing policies via Binary Authorization, and monitoring results through Cloud Logging are essential steps to identify and mitigate risks. While manual scans and automatic image deletion are not practical or supported features, leveraging automation and policy enforcement ensures a more robust security posture.
- A. Correct.
Enabling vulnerability scanning in Artifact Registry automatically scans container images for vulnerabilities and integrates well with CI/CD pipelines to verify images before deployment. This is a recommended approach.
- B. Incorrect.
Manually running vulnerability scans for each image is not efficient or scalable, especially in automated DevOps workflows.
- C. Correct.
Google Cloud Binary Authorization can enforce policies to block the deployment of container images with vulnerabilities, making it a critical component of secure deployments.
- D. Correct.
Cloud Logging can be used to monitor vulnerability scan results and generate alerts for high-severity vulnerabilities, enabling proactive responses.
- E. Incorrect.
Artifact Registry does not provide an option to automatically remove images flagged with vulnerabilities. Instead, it provides reports and integration with other tools to prevent their usage.