An enterprise is modernizing its continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud. The security team requires a shift-left approach to software delivery with the following constraints: Container images must be scanned for operating system and package vulnerabilities early in the build pipeline prior to being uploaded to Artifact Registry. Builds that introduce vulnerabilities above a specific severity threshold must be blocked immediately. Only verified container images that comply with organizational security policies and have been signed can be deployed to Google Kubernetes Engine (GKE) clusters. Which solution should you implement to meet these requirements?

Incorporate the On-Demand Scanning API within Cloud Build to scan images post-build and block registry upload on policy failure, and configure Binary Authorization on GKE to enforce deployment attestations.: ### What the Solution Is This architecture combines **Cloud Build**, the **Artifact Analysis On-Demand Scanning API**, and **Binary Authorization** to build a comprehensive end-to-end secure software supply chain on Google Cloud. It directly operationalizes the **shift-left security** paradigm by testing and enforcing compliance before images are stored in registries or deployed to runtime environments. ### How It Meets the Requirements - **Early Vulnerability Scanning & Blocking Uploads**: The **On-Demand Scanning API** allows **Cloud Build** to scan container images locally right after the `docker build` step. If the scan identifies CVEs exceeding the defined severity threshold, Cloud Build fails the pipeline and blocks the upload to **Artifact Registry**. - **Attestation & Deployment Gatekeeping**: When an image successfully passes scanning and quality gates, an automated signer creates a cryptographic **attestation**. **Binary Authorization** is configured as an admission controller on the **Google Kubernetes Engine (GKE)** cluster to evaluate deployment requests and block any Pod whose container image lacks a valid signature from authorized attestors. ### Key Advantages and Capabilities - **Prevents Registry Pollution**: Vulnerable artifacts are stopped before they are published to centralized repositories. - **Cryptographic Provenance**: Binary Authorization validates that deployed binaries strictly originate from trusted CI/CD pipelines. - **Continuous Compliance**: Integrates seamlessly with **Artifact Analysis** metadata storage to maintain automated audit trails. - **Fail-Closed Security**: Clusters enforce policy admission at the Kubernetes API server level regardless of how deployment manifests are applied. ### Why This Is Optimal This solution implements preventive controls across both the build and deployment phases of the **SDLC**. It prevents defective images from ever entering production environments without relying on manual approvals or post-deployment remediation.

StudyCerts

Shift Left Container Scanning Binary Authorization | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Shift Left Container Scanning Binary Authorization

Section: Software development lifecycle (SDLC)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is modernizing its continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud. The security team requires a shift-left approach to software delivery with the following constraints:

Container images must be scanned for operating system and package vulnerabilities early in the build pipeline prior to being uploaded to Artifact Registry.
Builds that introduce vulnerabilities above a specific severity threshold must be blocked immediately.
Only verified container images that comply with organizational security policies and have been signed can be deployed to Google Kubernetes Engine (GKE) clusters.

Which solution should you implement to meet these requirements?

Incorporate the On-Demand Scanning API within Cloud Build to scan images post-build and block registry upload on policy failure, and configure Binary Authorization on GKE to enforce deployment attestations.

Enable Security Command Center posture monitoring across the environment, and establish Virtual Private Cloud (VPC) Service Controls perimeters to block GKE from pulling unauthorized images.

Use GKE Workload Identity to sign container images upon build completion, and implement Kubernetes Network Policies to isolate pods that run unverified images.

Enable Artifact Registry automatic scanning for uploaded images, and configure Google Cloud Armor security policies at the ingress load balancer to block requests directed to vulnerable containers.

Professional Cloud Architect

Shift Left Container Scanning Binary Authorization

Related questions