Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ147

Designing for security and compliance

Refer to the EHR Healthcare case study for this question. You must define the technical architecture for securely deploying workloads to Google Cloud. You must also ensure that only verified containers are deployed by using Google Cloud services. What should you do?

Choose two
  • A Enable Binary Authorization on GKE, and sign containers as part of a CI/CD pipeline.
  • B Configure Jenkins to utilize Kritis to cryptographically sign a container as part of a CI/CD pipeline.
  • C Configure Container Registry to only allow trusted service accounts to create and deploy containers from the registry.
  • D Configure Container Registry to use vulnerability scanning to confirm that there are no vulnerabilities before deploying the workload.
Explanation

Binary Authorization for GKE enforces deployment policy and can require trusted, cryptographically signed image attestations. Container images can be signed as part of a CI/CD process, including with Kritis-compatible attestation tooling, so GKE permits deployment only after the required signature is verified. Registry access controls and vulnerability scanning alone do not provide deploy-time verification of signed container images.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!