Google Professional Cloud Security Engineer Question 386
Select 2Google Cloud PlatformYou are a security engineer tasked with automating the security controls for a Google Cloud environment. The team has decided to implement policies that ensure only approved container images are deployed to Google Kubernetes Engine (GKE) and that these policies are enforced automatically. Which combination of tools or services should you use to achieve this?
- A
Binary Authorization
- B
Cloud Build with custom build steps
- C
IAM Policies with deny conditions
- D
Cloud Armor
- E
Policy Controller with Config Sync
Show answer and explanation
Correct answers: A, E
Explanation
To automate infrastructure and application security in this scenario, Binary Authorization is the primary tool for ensuring only approved container images are deployed to GKE. Additionally, Policy Controller with Config Sync can complement this by enforcing broader policies and validating configurations across the environment. Together, these tools ensure automated and robust security controls for the deployment process.
- A. Correct.
Binary Authorization is specifically designed to enforce deployment policies, such as ensuring only approved container images are deployed to GKE.
- B. Incorrect.
Cloud Build with custom build steps is used to automate the CI/CD pipeline, but it does not directly enforce deployment policies on GKE.
- C. Incorrect.
IAM Policies with deny conditions are used to restrict access to Google Cloud resources but are not applicable to enforcing container image policies on GKE.
- D. Incorrect.
Cloud Armor is used for application-level security, such as protecting web applications from DDoS attacks, and is not relevant to container image enforcement.
- E. Correct.
Policy Controller with Config Sync allows you to enforce organization-wide policies, including container image policies, by syncing configurations and validating policy compliance in real-time.