2V0-71.23 Question 346
Select 2Your organization is deploying workloads to a Tanzu Kubernetes Grid (TKG) environment. To ensure security, the organization requires that all container images must be pulled from a trusted private registry and must not use images tagged as 'latest'. Which registry policy configurations should you implement to meet these requirements?
- A
Configure the cluster to use an allowlist to only permit images from the trusted private registry.
- B
Enable an admission controller policy to block the use of images tagged as 'latest'.
- C
Allow the use of public registries for fallback if the private registry is unavailable.
- D
Set up a policy to scan container images for vulnerabilities before deployment.
- E
Configure a denylist to block all images from public registries.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the organization's requirements, registry policies should enforce the use of a trusted private registry and prevent the use of 'latest' tags. Configuring an allowlist ensures adherence to the trusted registry, while blocking 'latest' tags avoids deploying potentially unstable or untested images. Other options, while potentially beneficial, do not directly address the stated requirements.
- A. Correct.
This option ensures that only images from the trusted private registry can be used, aligning with the organization's security requirements.
- B. Correct.
Blocking the use of 'latest' tags prevents the deployment of potentially unstable or untested images, which enhances security and consistency.
- C. Incorrect.
Allowing public registries as a fallback violates the organization's requirement to only use the trusted private registry, introducing potential risks.
- D. Incorrect.
While scanning for vulnerabilities is a good practice, it does not directly enforce the requirement of using a trusted private registry or block 'latest' tags.
- E. Incorrect.
A denylist for blocking public registries might help, but it is less effective than an allowlist for ensuring only trusted registries are used.