Google Professional Cloud Security Engineer Question 394
Select 3Google Cloud PlatformYour organization is using Google Kubernetes Engine (GKE) to deploy containerized workloads. To meet security compliance requirements, you need to ensure that only trusted container images are deployed to your GKE cluster. Which of the following steps are required to configure Binary Authorization for this purpose?
- A
Enable Binary Authorization on the GKE cluster.
- B
Create an attestor and configure it with a trusted key or policy.
- C
Enable Kubernetes RBAC to enforce namespace-level access control.
- D
Sign container images with a private key and store the signatures in Container Registry.
- E
Edit the GKE node pool to disable workload identity.
Show answer and explanation
Correct answers: A, B, D
Explanation
Binary Authorization is a security feature that allows you to enforce signature verification for container images before deployment to GKE or Cloud Run. To configure Binary Authorization, you need to enable it on the GKE cluster, create attestors for signing and verifying images, and ensure images are signed with a private key. This process ensures that only trusted and verified images are deployed, meeting compliance and security standards.
- A. Correct.
Correct: Enabling Binary Authorization on the GKE cluster ensures that only container images meeting your policy configurations can be deployed.
- B. Correct.
Correct: Creating an attestor and configuring it with a trusted key or policy is required for verifying signed images against the defined policy.
- C. Incorrect.
Incorrect: While Kubernetes RBAC is important for access control, it is not directly involved in Binary Authorization configuration.
- D. Correct.
Correct: Signing container images with a private key and storing the signatures in Container Registry ensures the images can be validated during deployment.
- E. Incorrect.
Incorrect: Disabling workload identity on the node pool is not related to Binary Authorization configuration and could reduce security.