2V0-71.23 Question 353
Select 3Your organization uses VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) and Harbor as a container registry. To ensure the security of container images, the team has configured registry scanning policies to identify Common Vulnerabilities and Exposures (CVEs). Which of the following actions are required to block the deployment of container images with critical CVEs?
- A
Enable the vulnerability scanner in Harbor and configure it to scan images automatically.
- B
Set up a policy in Harbor to prevent images with critical CVEs from being deployed to Kubernetes clusters.
- C
Manually scan all images before pushing them to the Harbor registry.
- D
Integrate Harbor with a Kubernetes admission controller to enforce image policies based on CVE severity.
- E
Enable image signing to verify the authenticity of container images before they are pulled.
Show answer and explanation
Correct answers: A, B, D
Explanation
To block the deployment of container images with critical CVEs in a VMware Tanzu Kubernetes Operations environment, you must first enable and configure the vulnerability scanner in Harbor to identify CVEs. Then, you need to set up a policy to block images with critical CVEs. Finally, integrating Harbor with a Kubernetes admission controller enforces these security policies at the cluster level. These steps ensure that only secure images are deployed while automating the process for efficiency and reliability.
- A. Correct.
Enabling the vulnerability scanner in Harbor and configuring it to scan images automatically is essential for detecting vulnerabilities in container images. This forms the foundational step in identifying CVEs.
- B. Correct.
A policy in Harbor to block images with critical CVEs ensures that such images are flagged and prevented from being deployed. This is a critical step to enforce security standards.
- C. Incorrect.
Manually scanning images is not a scalable or automated approach, especially in large environments. Automation is preferred for vulnerability scanning in enterprise-grade systems.
- D. Correct.
Integrating Harbor with a Kubernetes admission controller allows enforcement of image policies during the deployment process, ensuring that images with critical CVEs are blocked from being deployed.
- E. Incorrect.
While enabling image signing is a good practice for ensuring the authenticity of images, it does not directly address the need to block container images with critical CVEs.