An enterprise is designing an automated CI/CD pipeline on Google Cloud to deploy containerized workloads to Google Kubernetes Engine (GKE). The security team requires strict software supply chain controls and compliance enforcement across the SDLC: Build credentials and sensitive access tokens must be managed securely without being exposed in source repositories or build logs. Container images stored in Artifact Registry must automatically be analyzed for vulnerabilities. Only container images that pass security checks and have been cryptographically verified by the automated pipeline must be allowed to deploy and run on production GKE clusters. Which combination of Google Cloud services and controls should the enterprise implement?

Store sensitive build credentials in Secret Manager, enable automatic vulnerability scanning in Artifact Registry, configure the pipeline to sign images with an attestation, and enforce a Binary Authorization policy on the GKE cluster.: ### What the Solution Is This architecture establishes an end-to-end secure software supply chain by integrating **Secret Manager**, automated vulnerability scanning (**Artifact Analysis** / **Artifact Registry**), and **Binary Authorization** into an automated CI/CD delivery pipeline. ### How It Meets the Requirements - **Secure Credential Management**: Sensitive build tokens and credentials are stored securely in **Secret Manager** and injected into the pipeline at runtime using IAM-governed access, ensuring secrets are never hardcoded in source control or container layers. - **Automated Vulnerability Scanning**: Enabling automatic vulnerability scanning on **Artifact Registry** ensures that all pushed container images are immediately analyzed for known vulnerabilities, package issues, and exposures. - **Cryptographic Attestation & Admission Control**: Once automated tests and vulnerability scanning criteria pass, an attestor cryptographically signs the image metadata. **Binary Authorization** enforces a cluster admission rule on GKE, rejecting any image deployment that lacks a valid signature from the authorized attestor. ### Key Advantages and Capabilities - **Tamper-Proof Deployments**: Guarantees that only container images verified and built by trusted CI/CD pipelines run in production environments. - **Automated Compliance**: Eliminates manual verification gates while enforcing organizational security policies at container admission time. - **Centralized Secrets Governance**: Provides audit logging, rotation, and fine-grained IAM controls for sensitive build-time credentials through **Secret Manager**. - **Continuous Security Insights**: Continually tracks vulnerabilities against image package manifests as new CVEs are discovered. ### Why This Is Optimal This combination follows Google Cloud security best practices for supply chain integrity (SLSA framework alignment) by embedding preventive security controls directly into the deployment pipeline.

StudyCerts

Secure Supply Chain Binary Authorization Gke | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Secure Supply Chain Binary Authorization Gke

Section: Continuous integration/continuous deployment

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing an automated CI/CD pipeline on Google Cloud to deploy containerized workloads to Google Kubernetes Engine (GKE). The security team requires strict software supply chain controls and compliance enforcement across the SDLC:

Build credentials and sensitive access tokens must be managed securely without being exposed in source repositories or build logs.
Container images stored in Artifact Registry must automatically be analyzed for vulnerabilities.
Only container images that pass security checks and have been cryptographically verified by the automated pipeline must be allowed to deploy and run on production GKE clusters.

Which combination of Google Cloud services and controls should the enterprise implement?

Store sensitive build credentials in Secret Manager, enable automatic vulnerability scanning in Artifact Registry, configure the pipeline to sign images with an attestation, and enforce a Binary Authorization policy on the GKE cluster.

Store build credentials as encrypted environment variables in Cloud Source Repositories, sign container images with Cloud KMS directly during build, and implement Kubernetes Network Policies with GKE Pod Security Standards to restrict running unapproved images.

Store credentials in Secret Manager, execute vulnerability scans manually through custom Compute Engine scripts, and configure Identity-Aware Proxy (IAP) with Cloud Armor at the GKE ingress to prevent unauthorized image execution.

Store build secrets in Cloud Storage with IAM bucket policies, enable Artifact Registry vulnerability scanning, and deploy a custom mutating admission webhook in GKE to query Cloud Logging for build approval events.

Professional Cloud Architect

Secure Supply Chain Binary Authorization Gke

Related questions