An enterprise runs containerized workloads across Google Kubernetes Engine (GKE) and Cloud Run. The security compliance team establishes a mandatory software supply chain policy: Container images must only deploy to production if they have been verified and cryptographically signed during the CI/CD pipeline. Images lacking the required digital signatures must be blocked from running, and the denial must be recorded in Cloud Audit Logs. Attestation signatures must be verified against specific cryptographic public keys stored in Google Cloud. Which solution should you implement to enforce this deployment control?

Configure a Binary Authorization policy rule with evaluationMode set to REQUIRE_ATTESTATION and enforcementMode set to ENFORCED_BLOCK_AND_AUDIT_LOG, specifying attestors configured with the corresponding public keys and Artifact Analysis notes.: ### What Binary Authorization Attestation Enforcement Is **Binary Authorization** is a Google Cloud deploy-time security service that ensures only trusted container images are deployed across platforms such as **Google Kubernetes Engine (GKE)** and **Cloud Run**. It uses a policy model where deployment admission is gated by verifiable cryptographic signatures called **attestations**. ### How it meets the requirements - **Cryptographic Signature Verification:** Setting `evaluationMode` to `REQUIRE_ATTESTATION` ensures that the admission controller requires digital signatures created by trusted signers before allowing execution. - **Blocking Unauthorized Deployments and Logging:** Setting `enforcementMode` to `ENFORCED_BLOCK_AND_AUDIT_LOG` blocks any container deployment attempt that fails attestation verification and writes an audit event directly to **Cloud Audit Logs**. - **Public Key Infrastructure & Attestors:** An **attestor** resource anchors the trusted authority by storing the cryptographic public key (PKIX or PGP) that validates the digital signature stored in the associated **Artifact Analysis note**. ### Key advantages and capabilities - **Decoupled Architecture:** Separates the role of signers (CI/CD build pipelines, vulnerability scanners) from attestor management (security teams). - **Centralized Enforcement:** Provides a consistent policy engine across multiple container platforms including GKE clusters and Cloud Run services. - **Multi-Attestor Chaining:** Supports demanding multiple attestations (e.g., build verification AND security scan clearance) prior to production deployment. - **Tamper Evidence:** Attestations reference the immutable image digest rather than mutable container tags. ### Why this is optimal This approach directly satisfies the enterprise requirement for automated signature verification prior to container execution while leveraging native Google Cloud deploy-time enforcement and centralized logging without altering workload code.

StudyCerts

Configure Binary Authorization Attestation Enforcement | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Binary Authorization Attestation Enforcement

Section: Securing software supply chain

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise runs containerized workloads across Google Kubernetes Engine (GKE) and Cloud Run. The security compliance team establishes a mandatory software supply chain policy:

Container images must only deploy to production if they have been verified and cryptographically signed during the CI/CD pipeline.
Images lacking the required digital signatures must be blocked from running, and the denial must be recorded in Cloud Audit Logs.
Attestation signatures must be verified against specific cryptographic public keys stored in Google Cloud.

Which solution should you implement to enforce this deployment control?

Configure a Binary Authorization policy rule with evaluationMode set to ALWAYS_DENY and define admissionWhitelistPatterns matching the container image repository URLs in Artifact Registry.

Configure a Binary Authorization policy rule with evaluationMode set to REQUIRE_ATTESTATION and enforcementMode set to ENFORCED_BLOCK_AND_AUDIT_LOG, specifying attestors configured with the corresponding public keys and Artifact Analysis notes.

Configure IAM conditions on Artifact Registry to restrict roles/artifactregistry.reader permissions to service accounts that present valid X.509 client certificates during image pulls.

Configure a Binary Authorization policy rule with evaluationMode set to REQUIRE_ATTESTATION and enforcementMode set to DRYRUN_AUDIT_LOG_ONLY, binding attestors to Cloud KMS asymmetric signing keys.

Professional Cloud Architect

Configure Binary Authorization Attestation Enforcement

Related questions