Google Professional Cloud Security Engineer Question 389
Select 3Google Cloud PlatformYou are a security engineer at a company that uses Google Cloud for its infrastructure. The company wants to implement automated security scanning for Common Vulnerabilities and Exposures (CVEs) as part of its CI/CD pipeline. Which of the following steps should you take to achieve this?
- A
Integrate a container image scanning tool such as Cloud Build's built-in vulnerability scanning or a third-party scanner.
- B
Enable Google Cloud's Web Security Scanner to automatically scan application endpoints during deployment.
- C
Use Google Cloud Artifact Registry to store and automatically scan container images for vulnerabilities.
- D
Set up a policy in Binary Authorization to block deployments of container images with critical vulnerabilities.
- E
Create a Pub/Sub notification system to alert developers in real time when new vulnerabilities are found in deployed images.
Show answer and explanation
Correct answers: A, C, D
Explanation
To automate security scanning for CVEs in a CI/CD pipeline, you need to integrate tools that can scan container images for vulnerabilities (e.g., Cloud Build vulnerability scanning or Artifact Registry). Implementing Binary Authorization ensures that only secure images are deployed. Other tools like Web Security Scanner or Pub/Sub notifications are valuable for different aspects of security but are not central to CVE scanning automation in the CI/CD pipeline.
- A. Correct.
Integrating a container image scanning tool is essential for identifying vulnerabilities before deployment, making it a key step in automating CVE scanning within the CI/CD pipeline.
- B. Incorrect.
Google Cloud's Web Security Scanner is designed for scanning application endpoints for potential vulnerabilities, not for automating CVE scanning during the CI/CD process.
- C. Correct.
Using Google Cloud Artifact Registry enables you to store and scan container images for vulnerabilities, which is a critical part of automating security checks in a CI/CD pipeline.
- D. Correct.
Setting up a policy in Binary Authorization helps block the deployment of vulnerable container images, which adds an enforcement layer to the automated scanning process.
- E. Incorrect.
While Pub/Sub notifications are useful for alerting developers, they are not directly related to automating CVE scanning as part of the CI/CD pipeline.