2V0-71.23 Question 173
Select 4Your organization is deploying applications using VMware Tanzu Kubernetes Grid (TKG) and needs to enforce strict security policies for container images. The team wants to ensure that only images from a trusted private registry are used for deployments, while also preventing the use of images with critical vulnerabilities. Which image registry policies should you implement to meet these requirements?
- A
Configure the Kubernetes cluster to only allow images signed with a trusted certificate.
- B
Enforce namespace-level policies to restrict image pulls to a specific private registry.
- C
Implement an image vulnerability scanning tool integrated with the registry.
- D
Allow unrestricted image pulls from public registries to promote developer flexibility.
- E
Set up admission controllers to validate image sources and enforce security policies.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To meet the organization's requirements for security and compliance, multiple measures must be implemented. Restricting image sources to trusted private registries ensures control over the images being used. Image signing and vulnerability scanning further enhance the security by verifying image integrity and identifying potential risks. Admission controllers enforce these policies dynamically, and avoiding unrestricted access to public registries minimizes risks associated with unverified images.
- A. Correct.
Configuring the cluster to only allow images signed with a trusted certificate ensures that only verified and secure images can be used, reducing the risk of compromised images.
- B. Correct.
Namespace-level policies to restrict image pulls to a specific private registry prevent unauthorized images from being used, ensuring compliance with organizational standards.
- C. Correct.
Image vulnerability scanning helps detect and block deployment of images with critical vulnerabilities, enhancing the application's security posture.
- D. Incorrect.
Allowing unrestricted image pulls from public registries undermines security policies and increases the risk of deploying unverified or malicious images.
- E. Correct.
Admission controllers validate image sources and enforce security policies dynamically during deployments, playing a crucial role in ensuring compliance.