Google Professional Cloud Security Engineer Question 392
Select 3Google Cloud PlatformYour organization has implemented a CI/CD pipeline to build and deploy containerized applications on Google Kubernetes Engine (GKE). As a Professional Cloud Security Engineer, you are tasked with ensuring that every container image is scanned for Common Vulnerabilities and Exposures (CVEs) before deployment. Which combination of steps should you take to automate CVE scanning in the CI/CD pipeline?
- A
Integrate Google Cloud's Container Analysis API to automatically scan container images for vulnerabilities.
- B
Configure Binary Authorization to block the deployment of container images with high-severity vulnerabilities.
- C
Use Cloud Build to trigger custom vulnerability scans during the image build process.
- D
Store container images in Cloud Storage instead of a container registry to simplify vulnerability scanning.
- E
Enable Artifact Registry's vulnerability scanning feature for all container images.
Show answer and explanation
Correct answers: A, B, E
Explanation
To automate CVE scanning in a CI/CD pipeline, you should leverage Google Cloud's built-in tools such as the Container Analysis API and Artifact Registry's vulnerability scanning feature. Additionally, Binary Authorization can enforce policies to prevent deployment of images with critical vulnerabilities. These steps ensure a secure and efficient pipeline for managing and deploying containerized applications.
- A. Correct.
Integrating Google Cloud's Container Analysis API allows you to automatically scan container images stored in Artifact Registry for known vulnerabilities. This is a recommended step for automating CVE scanning.
- B. Correct.
Binary Authorization can be configured to enforce security policies, such as blocking deployment of container images with high-severity vulnerabilities, ensuring only secure images are deployed.
- C. Incorrect.
Cloud Build can be used for custom operations in the CI/CD pipeline, but it is not a native vulnerability scanning tool. While possible, it is not the most efficient or recommended method for automating CVE scans.
- D. Incorrect.
Storing container images in Cloud Storage does not provide built-in vulnerability scanning capabilities. Artifact Registry is specifically designed for container image management and security.
- E. Correct.
Artifact Registry includes a built-in vulnerability scanning feature that identifies CVEs in container images. Enabling this feature ensures that all images are scanned automatically.