Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ328

Designing for security and compliance

Your company is rapidly deploying containerized microservices to Google Kubernetes Engine (GKE) through a robust CI/CD pipeline. Security is a top priority, and you need a comprehensive, efficient strategy to prevent container image vulnerabilities from reaching the GKE production environment. What should you do?

Choose two
  • A Review the security reports generated by Artifact Analysis for each container image before deployment to GKE.
  • B Incorporate vulnerability scanning before building container images, and use Google-maintained base images for your container deployments.
  • C Enable Artifact Analysis for the container images, and stop deployment if critical vulnerabilities are found.
  • D Use a custom security policy within your container image that restricts access to specific network ports and resources.
  • E Enable Shielded GKE Nodes on the production cluster to automatically block the execution of container images with known vulnerabilities.
Explanation

Artifact Analysis automatically scans container images when they are pushed to Artifact Registry and continuously updates their vulnerability metadata. Reviewing those findings before promotion and making the CI/CD deployment gate fail when critical vulnerabilities are detected prevents known-vulnerable images from reaching production. Shielded GKE Nodes provide node identity and integrity protections; they do not enforce container image vulnerability blocking.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!