Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ16

Ensuring data protection

A company uses Google Kubernetes Engine (GKE) with container images for a mission-critical application. The company wants to scan these images for known security vulnerabilities and securely share the report with the security team without exposing it outside Google Cloud.

What should you do?

  • A
    1. Enable Container Threat Detection in the Security Command Center Premium tier.2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version.3. View and share the results from the Security Command Center.
  • B
    1. Use an open source tool in Cloud Build to scan the images.2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil.3. Share the scan report link with your security department.
  • C
    1. Enable vulnerability scanning in the Artifact Registry settings.2. Use Cloud Build to build the images.3. Push the images to the Artifact Registry for automatic scanning.4. View the reports in the Artifact Registry.
  • D
    1. Get a GitHub subscription.2. Build the images in Cloud Build and store them in GitHub for automatic scanning.3. Download the report from GitHub and share with the Security Team.
Explanation

Artifact Analysis provides automatic vulnerability scanning for container images in Artifact Registry. After automatic scanning is enabled, new images pushed to Artifact Registry are scanned and their vulnerability results can be viewed within Google Cloud. Container Threat Detection instead monitors runtime activity in containers for attacks; it is not the image-vulnerability scanning service.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!