2V0-71.23 Question 350
Select 3You are managing a VMware Tanzu Kubernetes cluster integrated with a container registry that supports image vulnerability scanning. The organization has mandated that images with critical CVEs must be blocked from deployment. Which steps must you configure to enforce this policy?
- A
Enable vulnerability scanning on the integrated registry
- B
Create a policy to block images with critical CVEs from being pulled into the cluster
- C
Set a policy to allow images with low and medium CVEs while blocking critical CVEs
- D
Manually scan images for CVEs before pushing them into the registry
- E
Integrate the registry scanner with Kubernetes admission controllers to enforce deployment restrictions
Show answer and explanation
Correct answers: A, B, E
Explanation
To enforce a policy that blocks images with critical CVEs, you must enable vulnerability scanning in the registry to identify vulnerabilities, configure a policy to block critical CVEs, and integrate the registry scanner with Kubernetes admission controllers for automated enforcement. This ensures compliance with security mandates and prevents risky images from being deployed in the Tanzu Kubernetes environment.
- A. Correct.
Enabling vulnerability scanning on the container registry is the first step to identify CVEs in images stored within the registry.
- B. Correct.
A policy to block images with critical CVEs is necessary to prevent their usage within the Tanzu Kubernetes cluster, aligning with the organization's requirements.
- C. Incorrect.
While setting a policy to allow low and medium CVEs can be part of the configuration, the question explicitly focuses on blocking critical CVEs, making this insufficient on its own.
- D. Incorrect.
Manually scanning images is not a scalable or automated solution and does not align with the Tanzu Kubernetes Operations best practices.
- E. Correct.
Integrating the registry scanner with Kubernetes admission controllers ensures that only approved images (free of critical CVEs) are deployed, enforcing the required policy at the cluster level.