An enterprise is designing a secure software supply chain pipeline for containerized applications deployed to Google Kubernetes Engine (GKE). The security architecture must satisfy the following requirements: Store build artifacts in Artifact Registry with encryption controlled by company-managed keys in Cloud KMS. Protect the repository and vulnerability scanning services against data exfiltration using network perimeters. Prevent unverified images or container images containing policy violations from being deployed to production GKE clusters. Which combination of Google Cloud security controls and architectural practices should the DevOps engineer implement?

Create an Artifact Registry repository configured with Customer-Managed Encryption Keys (CMEK), include Artifact Registry and Container Security APIs inside a VPC Service Controls perimeter, and enforce Binary Authorization policies with admission webhooks on GKE.: ### What the solution is This architecture combines **Artifact Registry Customer-Managed Encryption Keys (CMEK)**, **VPC Service Controls (VPC SC)** perimeters, and **Binary Authorization** on Google Kubernetes Engine (GKE) to establish an end-to-end secure software supply chain. ### How it meets the requirements - **Company-controlled encryption**: Configuring Artifact Registry with CMEK ensures that container images and layers are encrypted at rest using a dedicated Cloud KMS key managed by the organization's security team. - **Exfiltration and perimeter protection**: Adding the Artifact Registry and **Container Security API** (`containersecurity.googleapis.com`) services to a VPC Service Controls perimeter prevents data exfiltration and restricts unauthorized ingress/egress across project boundaries. - **Block non-compliant deployments**: Deploying **Binary Authorization** admission controllers on GKE ensures that images must possess valid cryptographic attestations (such as passing vulnerability scan checks in CI/CD) before they are permitted to run in production. ### Key advantages and capabilities - **Comprehensive perimeter isolation**: Secures artifact access and vulnerability reporting endpoints without exposing service APIs to public data exfiltration. - **Cryptographic verification**: Enforces deploy-time compliance by checking attestations generated during CI vulnerability scanning. - **Centralized key rotation**: Allows instant revocation of repository data access by disabling the Cloud KMS key. - **Automated enforcement**: Prevents human error or unauthorized deployments via Kubernetes validating admission webhooks. ### Why this is optimal This approach directly addresses storage encryption, network-level data exfiltration boundaries, and deploy-time admission enforcement natively within Google Cloud without requiring third-party runtime agents or unmanaged custom scripts.

Artifact Registry Vpc Sc Cmek Binary Authorization | Professional Cloud DevOps Engineer

Artifact Registry Vpc Sc Cmek Binary Authorization

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a secure software supply chain pipeline for containerized applications deployed to Google Kubernetes Engine (GKE). The security architecture must satisfy the following requirements:

Store build artifacts in Artifact Registry with encryption controlled by company-managed keys in Cloud KMS.
Protect the repository and vulnerability scanning services against data exfiltration using network perimeters.
Prevent unverified images or container images containing policy violations from being deployed to production GKE clusters.

Which combination of Google Cloud security controls and architectural practices should the DevOps engineer implement?

Create an Artifact Registry repository using default Google-managed encryption keys, apply Kubernetes Network Policies to the GKE ingress namespace, and use Cloud Service Mesh sidecar injection to block unverified images.

Create an Artifact Registry repository configured with Customer-Managed Encryption Keys (CMEK), include Artifact Registry and Container Security APIs inside a VPC Service Controls perimeter, and enforce Binary Authorization policies with admission webhooks on GKE.

Configure automated vulnerability scanning in Artifact Registry, configure GKE Enterprise Policy Controller to audit container security contexts, and configure Istiod control plane isolation with VPC firewall rules.

Configure an Artifact Registry repository with CMEK, apply VPC firewall rules to restrict node pool outbound access, and restrict GKE cluster operations exclusively using namespace-scoped Kubernetes RBAC roles.

Professional Cloud DevOps Engineer

Artifact Registry Vpc Sc Cmek Binary Authorization

Related questions