2V0-71.23 Question 172
Select 3Your organization is using VMware Tanzu Kubernetes Grid (TKG) for deploying Kubernetes clusters. The security team has mandated that only images from a trusted private registry should be used, and all images must be scanned for vulnerabilities before deployment. Which image registry policies should you implement to comply with these requirements?
- A
Enforce image signing and verification to ensure the authenticity of images.
- B
Configure the cluster to allow unrestricted access to public image registries.
- C
Enable image vulnerability scanning in the private registry.
- D
Restrict Kubernetes clusters to only pull images from the trusted private registry.
- E
Allow developers to use any registry for faster prototyping and deployments.
Show answer and explanation
Correct answers: A, C, D
Explanation
To comply with the organization's security policies, it is essential to implement an image registry policy that enforces image signing, restricts access to a trusted private registry, and scans images for vulnerabilities. These measures ensure that only secure and verified images are used, reducing the risk of deploying compromised or malicious containers.
- A. Correct.
Enforcing image signing and verification ensures images are authentic and have not been tampered with, which is critical for security compliance.
- B. Incorrect.
Allowing unrestricted access to public image registries contradicts the requirement to use only a trusted private registry and introduces potential security risks.
- C. Correct.
Enabling image vulnerability scanning in the private registry ensures that only secure and compliant images are deployed, meeting the organization's security policies.
- D. Correct.
Restricting the Kubernetes clusters to pull images only from the trusted private registry ensures compliance with the security team's mandate and prevents unauthorized images from being used.
- E. Incorrect.
Allowing developers to use any registry violates the security requirement of using only a trusted private registry and exposes the environment to potential risks.