A DevOps engineer is designing a secure CI/CD pipeline using Cloud Build and Artifact Registry. The security policy mandates two key requirements: Container images must be scanned for operating system and language package vulnerabilities within the build pipeline prior to release. Event-driven notifications must be published to Pub/Sub so downstream services can immediately process build status updates, vulnerability results, and trigger automated remediation workflows. Which approach should the DevOps engineer implement to satisfy these requirements?

Incorporate a Cloud Build step that invokes the On-Demand Scanning API to scan container images during execution, and configure a Pub/Sub subscription on the build notification topic to trigger downstream event-driven remediation services.: ### What the solution is This approach integrates shifting security left with event-driven automation. By invoking the **On-Demand Scanning API** within the **Cloud Build** pipeline, container images are scanned for vulnerabilities before they are deployed or promoted. Downstream services leverage **Pub/Sub** build notifications to act instantly upon build completion and vulnerability reports. ### How it meets the requirements - **In-pipeline vulnerability scanning**: The **On-Demand Scanning API** allows **Cloud Build** steps to extract package metadata and scan local container images for known OS and language package vulnerabilities before they are pushed or deployed. - **Real-time event-driven alerts**: **Cloud Build** automatically publishes build status events (such as `SUCCESS`, `FAILURE`, or step metadata) to the `cloud-builds` **Pub/Sub** topic. Downstream subscribers—such as Cloud Functions, Cloud Run, or custom **Cloud Build notifiers**—can listen to these messages to execute immediate automated remediation. ### Key advantages and capabilities - **Shift-Left Security**: Detects vulnerabilities early in the build phase, preventing flawed artifacts from entering production repositories. - **Decoupled Architecture**: **Pub/Sub** enables asynchronous, scalable delivery of build and scanning events to multiple subscribers without tightly coupling pipeline steps. - **Automated Remediation**: Triggers immediate downstream webhooks, Slack alerts, or policy evaluation engines upon build status updates. - **SLSA Alignment**: Keeps security scanning inside managed, isolated **Cloud Build** workers rather than relying on unvetted local developer environments. ### Why this is optimal Using the native **On-Demand Scanning API** combined with **Pub/Sub** event streams provides end-to-end automation, low latency, and adherence to Google Cloud supply chain security best practices.

Cloud Build Ondemand Scanning Pubsub Alerts | Professional Cloud DevOps Engineer

Cloud Build Ondemand Scanning Pubsub Alerts

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A DevOps engineer is designing a secure CI/CD pipeline using Cloud Build and Artifact Registry. The security policy mandates two key requirements:

Container images must be scanned for operating system and language package vulnerabilities within the build pipeline prior to release.
Event-driven notifications must be published to Pub/Sub so downstream services can immediately process build status updates, vulnerability results, and trigger automated remediation workflows.

Which approach should the DevOps engineer implement to satisfy these requirements?

Execute vulnerability scanning by running ad-hoc scripts on developer workstations prior to commit, and export Cloud Logging audit logs to BigQuery using scheduled hourly queries to alert the remediation team.

Configure Cloud Scheduler to poll Artifact Registry every 30 minutes, invoke an external third-party vulnerability scanner over HTTP, and directly email engineers when issues are found.

Rely exclusively on post-deployment GKE runtime scanning, disabling pipeline build steps, and use Cloud Monitoring log-based metrics to trigger synchronous webhook alerts directly to Slack.

Incorporate a Cloud Build step that invokes the On-Demand Scanning API to scan container images during execution, and configure a Pub/Sub subscription on the build notification topic to trigger downstream event-driven remediation services.

Professional Cloud DevOps Engineer

Cloud Build Ondemand Scanning Pubsub Alerts

Related questions