Google Professional Cloud Security Engineer Question 393
Select 3Google Cloud PlatformYour organization uses Google Cloud and wants to automate security scanning for Common Vulnerabilities and Exposures (CVEs) in container images as part of the CI/CD pipeline. Which steps should you take to ensure that only secure container images are deployed to production?
- A
Integrate Google Cloud Artifact Registry with Container Analysis to automatically scan images for vulnerabilities after they are pushed.
- B
Configure Binary Authorization to enforce deployment of only trusted container images to production.
- C
Manually review all CI/CD pipeline logs after each build to identify vulnerabilities in container images.
- D
Use a Cloud Build pipeline with a scanning step that invokes an open-source tool like Trivy or a security plugin to scan for CVEs.
- E
Automatically allow the deployment of container images to staging and production environments without scanning them.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate security scanning for CVEs in a CI/CD pipeline, you must integrate tools and practices that enforce security checks at every stage of the pipeline. Google Cloud Artifact Registry and Container Analysis allow you to automatically scan container images for vulnerabilities. Binary Authorization ensures only trusted images are deployed to production, and using tools like Trivy in a Cloud Build pipeline enables automated CVE scanning. Manual or bypassed approaches do not align with the goal of automation and security enforcement.
- A. Correct.
This option is correct because Google Cloud Artifact Registry integrates with Container Analysis to scan container images for vulnerabilities and provides detailed reports, which is a key step in automating CVE scanning.
- B. Correct.
This option is correct because Binary Authorization ensures that only container images that meet specific security criteria (such as passing vulnerability scans) can be deployed to production, adding an extra layer of security.
- C. Incorrect.
This option is incorrect because manually reviewing logs is error-prone, time-consuming, and not an automated approach. It does not align with the goal of automating CVE scanning.
- D. Correct.
This option is correct because a Cloud Build pipeline can include custom steps to invoke tools like Trivy for vulnerability scanning, allowing for automated CVE detection as part of the CI/CD process.
- E. Incorrect.
This option is incorrect because bypassing security scans for staging and production environments increases the risk of deploying vulnerable container images, which is a serious security oversight.