Google Professional Cloud Security Engineer Question 399
Select 2Google Cloud PlatformYour organization uses Google Kubernetes Engine (GKE) to deploy containerized applications. The security team has mandated that only trusted container images that meet specific compliance requirements should be deployed to GKE clusters. You need to configure Binary Authorization to enforce these requirements. Which steps should you take to achieve this?
- A
Enable Binary Authorization on the GKE cluster and configure it in 'Enforce' mode.
- B
Create an attestor in Binary Authorization and bind it to a trusted Container Registry.
- C
Sign container images with an attestation authority before deploying them to GKE.
- D
Grant the Kubernetes Engine Service Agent role to the Binary Authorization service account.
- E
Enable Binary Authorization in 'Dry Run' mode to allow testing of policy violations without blocking deployments.
Show answer and explanation
Correct answers: A, C
Explanation
To secure GKE clusters using Binary Authorization, you must enable Binary Authorization on the cluster in 'Enforce' mode to block unauthorized images. Additionally, trusted container images must be signed by an attestation authority to ensure compliance with organizational policies. These steps ensure that only trusted and verified container images are deployed to the cluster.
- A. Correct.
Correct. Binary Authorization must be enabled on the GKE cluster in 'Enforce' mode to block untrusted or unsigned images during deployment.
- B. Incorrect.
Incorrect. Attestors are created to verify signatures, but they are not directly bound to a Container Registry. Attestors are used to validate signed images.
- C. Correct.
Correct. Signing images with an attestation authority ensures that only trusted images are allowed to be deployed.
- D. Incorrect.
Incorrect. The Kubernetes Engine Service Agent role is not required for Binary Authorization configuration. It is used for GKE operations but not specifically for Binary Authorization.
- E. Incorrect.
Incorrect. 'Dry Run' mode is useful for testing, but it does not enforce policies, which is a requirement in this scenario.