Google Professional Cloud DevOps Engineer Question 89
Single answerGoogle Cloud PlatformYour organization is implementing a CI/CD pipeline for deploying applications to Google Kubernetes Engine (GKE). To enhance software supply chain security, the organization wants to ensure that only trusted container images are deployed to production. How can you achieve this using Google Cloud services while following best practices for software supply chain security?
- A
Enable Binary Authorization on the GKE cluster and configure it to only allow signed images from a trusted registry.
- B
Use Cloud Build to scan container images for vulnerabilities and deploy them directly to GKE without additional verification.
- C
Implement the SLSA framework by manually verifying the source code and container image metadata before allowing deployment.
- D
Use Artifact Registry to store container images and configure GKE to automatically reject unsigned images.
Show answer and explanation
Correct answer: A
Explanation
Binary Authorization is a Google Cloud service designed to enforce deployment policies by requiring that container images are signed by trusted authorities before being deployed to GKE. This ensures that only verified and trusted images are used, mitigating the risk of deploying compromised or unauthorized software. While other tools like Cloud Build and Artifact Registry are important in the software supply chain, they do not provide the same level of enforcement as Binary Authorization.
- A. Correct.
Correct: Enabling Binary Authorization ensures that only trusted and signed container images are allowed for deployment to GKE. This aligns with software supply chain security best practices.
- B. Incorrect.
Incorrect: While Cloud Build can scan for vulnerabilities, deploying images without additional verification does not ensure they are trusted or meet security policies.
- C. Incorrect.
Incorrect: Manually verifying source code and metadata can be error-prone and does not provide an automated enforcement mechanism for software supply chain security.
- D. Incorrect.
Incorrect: Artifact Registry can store container images, but it does not automatically enforce the rejection of unsigned images. Binary Authorization is required for such enforcement.