A DevOps engineer is designing an automated CI/CD pipeline on Google Cloud to deploy containerized microservices to Google Kubernetes Engine (GKE). The organization mandates strict supply chain security and deployment governance: Build artifacts must undergo automated vulnerability scanning for operating system and language dependencies. Container images must only run on GKE clusters if they have verified attestations confirming that pre-deployment quality gates and security tests passed. Progressive delivery across staging and production targets must include built-in auditability and automated rollback support. Which combination of Google Cloud services and architectural components satisfies these requirements?

Configure Cloud Build to run automated tests and generate attestations, store images in Artifact Registry with Artifact Analysis automated scanning, enforce deploy-time signature validation on GKE using Binary Authorization, and orchestrate progressive multi-target rollouts with automated rollbacks using Cloud Deploy.: ### What the Solution Is This architecture combines **Cloud Build**, **Artifact Registry** with **Artifact Analysis**, **Binary Authorization**, and **Cloud Deploy** to establish a secure, policy-driven software supply chain on Google Cloud. ### How It Meets the Requirements - **Automated vulnerability scanning**: **Artifact Analysis** integrates with **Artifact Registry** to provide proactive, automated scanning of container images for both operating system package vulnerabilities and language package vulnerabilities. - **Deploy-time cryptographic verification**: **Binary Authorization** enforces signature validation at deploy time on **GKE**. It checks that images are signed by designated trusted authorities (attestors) after **Cloud Build** successfully runs automated test suites and validation steps. - **Progressive rollout and rollback**: **Cloud Deploy** provides declarative continuous delivery pipelines to deploy workloads across multiple target environments in sequence, featuring native approval workflows and one-click or automated rollbacks. ### Key Advantages - **Shifts security left**: Detects vulnerabilities early in the build lifecycle before deployment occurs. - **Prevents unauthorized deployments**: Restricts runtime environments to cryptographically verified container images. - **Enterprise delivery governance**: Delivers end-to-end auditability and traceability from source commit to production deployment. - **Standardized release pipelines**: Reduces operational friction by unifying automated testing, vulnerability gating, and target orchestration. ### Why This Is Optimal Native integration between Cloud Build, Artifact Analysis, Binary Authorization, and Cloud Deploy creates a zero-trust software supply chain pipeline without requiring third-party plugins or custom admission webhooks.

Gke Binary Authorization Artifact Analysis Cloud Deploy | Professional Cloud DevOps Engineer

Gke Binary Authorization Artifact Analysis Cloud Deploy

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A DevOps engineer is designing an automated CI/CD pipeline on Google Cloud to deploy containerized microservices to Google Kubernetes Engine (GKE). The organization mandates strict supply chain security and deployment governance:

Build artifacts must undergo automated vulnerability scanning for operating system and language dependencies.
Container images must only run on GKE clusters if they have verified attestations confirming that pre-deployment quality gates and security tests passed.
Progressive delivery across staging and production targets must include built-in auditability and automated rollback support.

Which combination of Google Cloud services and architectural components satisfies these requirements?

...

Configure Cloud Workstations to compile container images, use Security Command Center Event Threat Detection to block unsigned container deployments, and execute gcloud container clusters update commands to roll back failed GKE releases.

...

Configure Cloud Build to package applications into virtual repositories in Artifact Registry, enable Assured Open Source Software for all internal containers, and enforce GKE cluster admission using PodSecurityPolicies with manual rollback procedures.

...

Configure Cloud Build to run automated tests and generate attestations, store images in Artifact Registry with Artifact Analysis automated scanning, enforce deploy-time signature validation on GKE using Binary Authorization, and orchestrate progressive multi-target rollouts with automated rollbacks using Cloud Deploy.

...

Configure Cloud Build to push images to Artifact Registry remote repositories, configure Web Security Scanner to scan containers for runtime vulnerabilities, deploy workloads using Deployment Manager templates, and configure Cloud Monitoring alerts to trigger automated rollbacks via Cloud Functions.

...

Professional Cloud DevOps Engineer

Gke Binary Authorization Artifact Analysis Cloud Deploy

Related questions

Ask Scout