Your team is establishing a vulnerability scanning and compliance pipeline for containerized microservices stored in Artifact Registry. The solution must meet the following requirements: Shift-left validation: Scan images locally during the Cloud Build stage before pushing to the repository and fail the build if vulnerabilities exceed defined severity thresholds. Continuous monitoring: Automatically detect both OS-level and application language-pack (e.g., Go, Java, Node.js, Python) vulnerabilities in pushed images, while maintaining continuously updated vulnerability metadata as new CVEs emerge. Least privilege: Grant an automated security auditing service account only the minimum permissions required to query and retrieve vulnerability occurrences and dependency metadata across the project. Which combination of configuration steps and IAM permissions should you implement?

Enable the On-Demand Scanning API and run `gcloud artifacts docker images scan` in Cloud Build before pushing; enable the Container Scanning API (`containerscanning.googleapis.com`) for continuous OS and language package analysis; and grant the `roles/containeranalysis.occurrences.viewer` role to the auditing service account.: ### What the solution is This solution combines Google Cloud **On-Demand Scanning**, **Artifact Analysis automatic continuous scanning**, and **Container Analysis IAM roles** to secure the container delivery lifecycle end-to-end. ### How it meets the requirements * **Shift-left validation**: Enabling the **On-Demand Scanning API** and invoking `gcloud artifacts docker images scan` (along with `gcloud artifacts docker images list-vulnerabilities`) allows Cloud Build to analyze locally built container images and enforce build-breaking policies prior to pushing to **Artifact Registry**. * **Continuous monitoring**: Enabling the **Container Scanning API** (`containerscanning.googleapis.com`) activates automatic on-push scanning and continuous analysis in Artifact Registry. Artifact Analysis automatically scans both operating system packages and application language packages (such as Go, Java/Maven, Node.js, and Python), refreshing occurrence metadata daily against updated CVE databases for images active within 30 days. * **Least privilege**: Granting `roles/containeranalysis.occurrences.viewer` (**Container Analysis Occurrences Viewer**) provides read-only access to view vulnerability occurrences, package dependencies, and metadata notes without granting administrative privileges or unnecessary data access. ### Key advantages * **Early defect mitigation**: Catches zero-day and known vulnerabilities in the CI phase before artifacts are stored or shared. * **Comprehensive coverage**: Provides native vulnerability analysis for both system base images and application language packages. * **Automated metadata lifecycle**: Updates vulnerability records automatically when new CVEs are published without requiring manual rescan triggers. * **Strict access control**: Limits security audit tools strictly to reading analysis occurrences. ### Why this is optimal This approach leverages native Google Cloud services following the principle of least privilege, eliminates custom scanning infrastructure, and achieves automated shift-left security coupled with continuous post-push vulnerability monitoring.

Artifact Analysis Automatic Ondemand Vulnerability Scanning | Professional Cloud DevOps Engineer

Artifact Analysis Automatic Ondemand Vulnerability Scanning

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your team is establishing a vulnerability scanning and compliance pipeline for containerized microservices stored in Artifact Registry. The solution must meet the following requirements:

Shift-left validation: Scan images locally during the Cloud Build stage before pushing to the repository and fail the build if vulnerabilities exceed defined severity thresholds.
Continuous monitoring: Automatically detect both OS-level and application language-pack (e.g., Go, Java, Node.js, Python) vulnerabilities in pushed images, while maintaining continuously updated vulnerability metadata as new CVEs emerge.
Least privilege: Grant an automated security auditing service account only the minimum permissions required to query and retrieve vulnerability occurrences and dependency metadata across the project.

Which combination of configuration steps and IAM permissions should you implement?

Enable the On-Demand Scanning API and execute gcloud artifacts docker images scan in Cloud Build; configure Cloud Scheduler to pull images daily to trigger OS-only automatic scans; and grant the roles/containeranalysis.occurrences.editor role to the auditing service account.

Enable the Container Scanning API (containerscanning.googleapis.com); execute gcloud container images describe --show-package-vulnerability during Cloud Build before pushing; and grant the roles/artifactregistry.reader role to the auditing service account.

Enable Binary Authorization to block builds during Cloud Build; enable GKE Advanced Vulnerability Insights to manage Artifact Registry scanning; and grant the roles/viewer basic role to the auditing service account.

Enable the On-Demand Scanning API and run gcloud artifacts docker images scan in Cloud Build before pushing; enable the Container Scanning API (containerscanning.googleapis.com) for continuous OS and language package analysis; and grant the roles/containeranalysis.occurrences.viewer role to the auditing service account.

Professional Cloud DevOps Engineer

Artifact Analysis Automatic Ondemand Vulnerability Scanning

Related questions