Google Professional Cloud Security Engineer Question 391
Select 3Google Cloud PlatformYour organization is building a CI/CD pipeline to deploy containerized applications on Google Kubernetes Engine (GKE). As part of your security requirements, you need to automate the scanning of container images for Common Vulnerabilities and Exposures (CVEs) before deployment. Which of the following steps should you include in your pipeline to achieve this?
- A
Integrate Google Cloud's Container Analysis API to scan container images in Artifact Registry for vulnerabilities.
- B
Use a custom script to manually check for CVEs after the container is deployed to the GKE cluster.
- C
Configure Cloud Build to invoke a vulnerability scanning tool during the build process.
- D
Enable Binary Authorization to enforce deployment policies that require passing a vulnerability scan.
- E
Use Cloud Logging to monitor runtime CVE alerts instead of scanning before deployment.
Show answer and explanation
Correct answers: A, C, D
Explanation
To automate security scanning for CVEs in a CI/CD pipeline, it is critical to integrate tools and processes that identify vulnerabilities before deployment. The Container Analysis API enables automated vulnerability scanning for container images stored in Artifact Registry. Cloud Build can run vulnerability scans during the build process, and Binary Authorization enforces policies to ensure only secure images are deployed to production. These steps help secure the pipeline proactively, whereas relying solely on runtime monitoring or manual checks is insufficient.
- A. Correct.
This is correct. Google Cloud's Container Analysis API integrates with Artifact Registry to perform automated CVE scans on container images, providing detailed vulnerability reports.
- B. Incorrect.
This is incorrect. Manually checking for CVEs after deployment is not an automated process and does not align with best practices for securing the CI/CD pipeline.
- C. Correct.
This is correct. Cloud Build can be configured to invoke a vulnerability scanning tool during the build process, ensuring that vulnerabilities are identified early in the pipeline.
- D. Correct.
This is correct. Binary Authorization can enforce deployment policies, such as requiring container images to pass vulnerability scans before they are deployed to the GKE cluster.
- E. Incorrect.
This is incorrect. While Cloud Logging can help monitor runtime CVE alerts, it does not replace the need for proactive CVE scanning before deployment.