Google Professional Cloud Security Engineer Question 395
Select 3Google Cloud PlatformYour organization uses Google Kubernetes Engine (GKE) to deploy containerized workloads. To comply with security policies, you need to ensure that only trusted container images signed by your organization's security team are deployed to the GKE cluster. Which steps should you take to properly configure Binary Authorization for this purpose?
- A
Enable Binary Authorization on the GKE cluster.
- B
Create an attestor and configure it to verify container image signatures.
- C
Disable the Binary Authorization policy to allow flexibility during development.
- D
Configure a policy in Binary Authorization to require image attestation before deployment.
- E
Grant the GKE service account the 'Binary Authorization Admin' role.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure your GKE cluster using Binary Authorization, you need to enable Binary Authorization on the cluster and set up policies that enforce attestation for container images. This includes creating an attestor to verify image signatures and configuring a policy to require attestation before deployment. These steps ensure that only trusted and signed images are deployed, in line with your organization's security requirements.
- A. Correct.
Correct: Enabling Binary Authorization on the GKE cluster is required to enforce policies for image attestation.
- B. Correct.
Correct: Creating an attestor and configuring it to verify signatures ensures that only signed and authorized container images can be executed.
- C. Incorrect.
Incorrect: Disabling the Binary Authorization policy would bypass all security controls, which is against the goal of securing the cluster.
- D. Correct.
Correct: Configuring a Binary Authorization policy to enforce image attestation ensures that only trusted images pass the verification process.
- E. Incorrect.
Incorrect: Granting the 'Binary Authorization Admin' role is not necessary for the GKE service account. This role is typically assigned to administrators managing Binary Authorization configurations.