2V0-71.23 Question 349
Select 3Your organization uses VMware Tanzu Kubernetes Grid and wants to establish registry policies for deploying container images to ensure security and compliance. Which of the following actions should be implemented to enforce secure and compliant image usage in the organization?
- A
Configure the Kubernetes cluster to only allow images signed by a trusted certificate authority.
- B
Ensure that only container images from a pre-approved private registry are allowed to be deployed.
- C
Allow unrestricted use of public container registries for faster deployment workflows.
- D
Implement image scanning tools to detect vulnerabilities in container images before deployment.
- E
Disable image pull policies on the Kubernetes cluster to avoid unnecessary overhead.
Show answer and explanation
Correct answers: A, B, D
Explanation
Registry policies play a critical role in ensuring security and compliance in Kubernetes environments managed by VMware Tanzu. Trusted certificate authorities, private registries, and image scanning tools are essential components of a robust image deployment strategy. These measures help secure the cluster by preventing the use of unverified or vulnerable images. On the other hand, allowing unrestricted registry use and disabling pull policies increase the risk of introducing vulnerabilities and losing control over image management.
- A. Correct.
This option is correct because configuring the cluster to accept only signed images ensures that the images are verified and trusted, reducing the risk of using compromised or tampered images.
- B. Correct.
This option is correct because restricting image deployments to a pre-approved private registry ensures control over the source of images and minimizes the risk of using unverified images.
- C. Incorrect.
This option is incorrect because unrestricted use of public registries increases the risk of deploying unverified or malicious images, which can compromise the security and compliance of the cluster.
- D. Correct.
This option is correct because implementing image scanning tools helps identify vulnerabilities in container images before deployment, ensuring that only secure images are used.
- E. Incorrect.
This option is incorrect because disabling image pull policies could lead to unmanaged image usage and undermine control over how and when images are updated.