2V0-71.23 Question 347
Select 3An organization is deploying applications to Kubernetes clusters managed by VMware Tanzu. The organization wants to ensure only trusted container images are used and that no unauthorized or vulnerable images are pulled from external sources. Which of the following registry policies should the organization implement to achieve this goal?
- A
Configure image registry access control to restrict access to authorized users only.
- B
Enable vulnerability scanning and enforce deployment of only images that pass the scan.
- C
Allow unrestricted access to public container registries for flexibility in image sourcing.
- D
Limit deployments to images signed with a trusted signature using Content Trust or Notary.
- E
Disable image caching on Kubernetes nodes to ensure images are always pulled fresh from registries.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure only trusted container images are deployed, organizations should implement registry policies such as access control, vulnerability scanning, and image signing verification. These measures help prevent unauthorized, vulnerable, or tampered images from being used in Kubernetes clusters. Allowing unrestricted access to public registries or disabling caching does not align with best practices for secure image deployment.
- A. Correct.
Configuring image registry access control ensures only authorized users can push or pull images, reducing the risk of unauthorized or malicious images being used.
- B. Correct.
Enabling vulnerability scanning ensures that only secure, compliant images are deployed, helping to prevent vulnerabilities from being introduced into the environment.
- C. Incorrect.
Allowing unrestricted access to public registries introduces security risks, as it permits the use of unverified or malicious images. This is not a best practice.
- D. Correct.
Using trusted signatures ensures the integrity and authenticity of container images, preventing tampered or untrusted images from being deployed.
- E. Incorrect.
Disabling image caching can lead to performance issues and is not directly related to enforcing trusted image policies. This is not a recommended approach.