Google Professional Cloud Security Engineer Question 390
Single answerGoogle Cloud PlatformYour organization is implementing a CI/CD pipeline to deploy containerized applications on Google Kubernetes Engine (GKE). To enhance security, you need to automate the detection of Common Vulnerabilities and Exposures (CVEs) in container images before deployment. Which approach should you take to achieve this?
- A
Integrate Google Cloud Artifact Registry with Cloud Build to scan container images for vulnerabilities during the build process.
- B
Manually scan container images stored in Cloud Storage using a third-party vulnerability scanning tool before deployment.
- C
Use Binary Authorization to enforce deployment policies based on vulnerability scanning results.
- D
Enable Workload Identity to automatically scan container images for vulnerabilities after deployment to GKE.
Show answer and explanation
Correct answer: A
Explanation
The correct approach to automate security scanning for CVEs in a CI/CD pipeline is to use Google Cloud services like Artifact Registry and Cloud Build. By integrating these services, you can scan container images for vulnerabilities during the build process, ensuring that only secure images are deployed. Other options either involve manual processes, are unrelated to scanning, or occur after deployment, which is not ideal for a proactive security strategy.
- A. Correct.
Correct: Google Cloud Artifact Registry integrates directly with Cloud Build to perform automated vulnerability scanning on container images during the CI/CD build process. This ensures that vulnerabilities are identified and addressed before deployment.
- B. Incorrect.
Incorrect: Manually scanning container images is not an automated process and does not fit into a CI/CD pipeline. It is also less efficient and prone to human error.
- C. Incorrect.
Incorrect: Binary Authorization is used to enforce deployment policies, not to scan for vulnerabilities. While it can prevent the deployment of non-compliant images, it does not perform scanning itself.
- D. Incorrect.
Incorrect: Workload Identity is used for securely managing access to Google Cloud resources by applications running in GKE. It does not provide vulnerability scanning functionality.