Google Professional Cloud Security Engineer Question 388
Select 3Google Cloud PlatformYou are tasked with setting up a CI/CD pipeline in Google Cloud to automatically scan container images for Common Vulnerabilities and Exposures (CVEs) before deploying them to production. Which of the following steps should you include in your pipeline to ensure this is achieved?
- A
Integrate Google Cloud Container Analysis to scan container images for vulnerabilities.
- B
Use Google Cloud Build as the CI/CD platform to build and test container images.
- C
Manually trigger vulnerability scans on container images after they are deployed to production.
- D
Enable Binary Authorization to enforce only trusted and vulnerability-free images are deployed.
- E
Configure a GKE PodSecurityPolicy to restrict the execution of containers with known vulnerabilities.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate security scanning for CVEs in a CI/CD pipeline, you should integrate Google Cloud Container Analysis to scan container images for vulnerabilities, use Google Cloud Build to orchestrate the process, and enforce security policies with Binary Authorization to ensure only trusted images are deployed. Manual triggers and runtime restrictions like PodSecurityPolicy do not provide the same level of proactive security as these automated measures.
- A. Correct.
Correct: Google Cloud Container Analysis is a key service that scans container images for vulnerabilities, including CVEs, as part of an automated pipeline.
- B. Correct.
Correct: Google Cloud Build is well-integrated with Google Cloud services like Container Analysis and can be used to automate the building and scanning of container images.
- C. Incorrect.
Incorrect: Manually triggering vulnerability scans after deployment defeats the purpose of automating security checks and risks deploying vulnerable images.
- D. Correct.
Correct: Binary Authorization ensures that only container images that meet security policies, such as being free of critical vulnerabilities, are deployed to production.
- E. Incorrect.
Incorrect: GKE PodSecurityPolicy is used to enforce runtime security policies, but it does not directly prevent the deployment of vulnerable images.