Your team is establishing a "shift-left" security practice for containerized applications built with Cloud Build and stored in Artifact Registry. You need to implement an automated policy gate within the continuous integration (CI) pipeline that satisfies the following requirements: Scans container images for OS and language package vulnerabilities prior to pushing them to Artifact Registry. Analyzes the effective severity of discovered vulnerabilities. Immediately fails the build and prevents upload to Artifact Registry if any vulnerability with a severity of CRITICAL or HIGH is detected. What should you do?

Incorporate On-Demand Scanning in Cloud Build by running `gcloud artifacts docker images scan` on the locally built image, then parse the results with `gcloud artifacts docker images list-vulnerabilities` and terminate the build step with an exit code of 1 if `CRITICAL` or `HIGH` severities are found before pushing.: ### What On-Demand Scanning is **Artifact Analysis On-Demand Scanning** is a feature that allows developers and CI/CD systems to initiate vulnerability scans on container images locally or during build time before pushing them to a central repository like **Artifact Registry**. ### How it meets the requirements - **Scans before pushing:** Running `gcloud artifacts docker images scan` analyzes the local container image built in the pipeline workspace prior to executing a `docker push` step. - **Analyzes effective severity:** The command `gcloud artifacts docker images list-vulnerabilities` queries the scan ID and outputs metadata including the **`vulnerability.effectiveSeverity`** level. - **Fails the build gate:** A shell conditional step checks whether the severity output contains `CRITICAL` or `HIGH`. If found, it outputs a failure message and exits with a non-zero exit code (`exit 1`), halting the Cloud Build pipeline immediately and blocking subsequent steps (such as `docker push`). ### Key advantages and capabilities - **Shifts security left:** Catches vulnerable dependencies in operating systems and language packages before they ever enter the registry. - **Customizable gate logic:** Enables granular severity filtering using regular expressions (e.g., `'CRITICAL|HIGH'`). - **Protects the artifact repository:** Keeps vulnerable or non-compliant container images out of production and staging repositories. - **Automated orchestration:** Integrates directly into native **Cloud Build** pipeline steps using the standard **Cloud SDK** builder. ### Why this is optimal On-Demand Scanning allows proactive evaluation of artifact compliance directly within the CI execution runner. Waiting until after the image is stored in the registry or deployed to a cluster increases the attack surface and requires reactive mitigation instead of preventative enforcement.

Cloud Build Artifact Analysis Ondemand Scanning Gate | Professional Cloud DevOps Engineer

Cloud Build Artifact Analysis Ondemand Scanning Gate

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your team is establishing a "shift-left" security practice for containerized applications built with Cloud Build and stored in Artifact Registry. You need to implement an automated policy gate within the continuous integration (CI) pipeline that satisfies the following requirements:

Scans container images for OS and language package vulnerabilities prior to pushing them to Artifact Registry.
Analyzes the effective severity of discovered vulnerabilities.
Immediately fails the build and prevents upload to Artifact Registry if any vulnerability with a severity of CRITICAL or HIGH is detected.

What should you do?

Configure Binary Authorization admission rules in Cloud Build to evaluate container Dockerfile instructions and block the build if vulnerable base OS layers are detected.

Push the image to Artifact Registry and run gcloud artifacts docker images describe --show-package-vulnerability in a subsequent Cloud Build step to verify compliance before deploying.

Enable automatic vulnerability scanning in Artifact Registry, push the image, and configure a Cloud Function triggered by Pub/Sub notifications to delete the image if vulnerabilities are found.

Incorporate On-Demand Scanning in Cloud Build by running gcloud artifacts docker images scan on the locally built image, then parse the results with gcloud artifacts docker images list-vulnerabilities and terminate the build step with an exit code of 1 if CRITICAL or HIGH severities are found before pushing.

Professional Cloud DevOps Engineer

Cloud Build Artifact Analysis Ondemand Scanning Gate

Related questions