Your organization is establishing a secure CI/CD deployment pipeline for containerized microservices running on Google Kubernetes Engine (GKE). The security team has defined the following compliance requirements: All container images pushed to Artifact Registry must automatically undergo vulnerability scanning. Images containing vulnerabilities exceeding defined severity thresholds must be prevented from deploying. Deployments must be cryptographically verified using an asymmetric key pair before admission to the GKE cluster. Workload deployments must ensure immutability by preventing image tag mutability exploits. Which combination of steps should you implement to configure this deployment gate?

Enable Artifact Analysis vulnerability scanning on the repository. Create a Binary Authorization attestor associated with an Artifact Analysis note and register the PKIX public key. Configure the Binary Authorization policy default admission rule to require attestations from this attestor and enable enforcement on the GKE cluster. In the pipeline, evaluate the scan results, sign the container image digest with the private key to create an attestation occurrence, and deploy the workload to GKE using the image digest.: ### What Binary Authorization with Attestation is **Binary Authorization** is a deploy-time security control that ensures only trusted and verified container images are deployed to **Google Kubernetes Engine (GKE)**. It integrates directly with **Artifact Analysis**, which automatically scans container images stored in **Artifact Registry** for known vulnerabilities (Common Vulnerabilities and Exposures - CVEs) and records metadata notes and occurrences. ### How it meets the requirements - **Automated vulnerability scanning**: Enabling Artifact Analysis ensures that whenever images are pushed to Artifact Registry, automatic scans evaluate packages against known vulnerability databases and assign severity scores based on the Common Vulnerability Scoring System (CVSS). - **Deploy-time enforcement gate**: Creating a **Binary Authorization attestor** links a public verification key with an **Artifact Analysis note**. The Binary Authorization policy is configured with an admission rule that mandates attestations from this specific attestor, blocking any unverified container from admission. - **Cryptographic signing**: In the CI/CD pipeline, automated scripts inspect the vulnerability scan occurrences. If the image satisfies the security threshold, the pipeline signs the container image digest using the corresponding private cryptographic key (such as an asymmetric ECDSA or RSA key) and creates an attestation occurrence in Artifact Analysis. - **Immutability and tag protection**: Deploying workloads via the **container image digest** (`image@sha256:...`) rather than mutable tags guarantees that the cryptographic signature matches the exact bits being executed, preventing tag-swapping or drift. ### Key advantages/capabilities - **Cryptographic non-repudiation**: Uses PKIX/X.509 keys or Cloud Key Management Service (Cloud KMS) to sign image digests, preventing tampering. - **Centralized policy governance**: Enforces admission rules at the Kubernetes API admission controller layer before any pod execution begins. - **Full audit trail**: GKE logs admission decisions, attestation checks, and policy evaluations directly to Cloud Audit Logs. - **Granular multi-stage validation**: Allows pipelines to require distinct attestations across multiple stages (e.g., build verification, security scanning, QA approval). ### Why this is optimal This approach uses native Google Cloud security services to form an automated, end-to-end software supply chain security gate. It eliminates manual intervention while guaranteeing that only cryptographically signed, vulnerability-free container digests are admitted into the production GKE environment.

Gke Binary Authorization Attestation Deployment Gate | Professional Cloud DevOps Engineer

Gke Binary Authorization Attestation Deployment Gate

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization is establishing a secure CI/CD deployment pipeline for containerized microservices running on Google Kubernetes Engine (GKE). The security team has defined the following compliance requirements:

All container images pushed to Artifact Registry must automatically undergo vulnerability scanning.
Images containing vulnerabilities exceeding defined severity thresholds must be prevented from deploying.
Deployments must be cryptographically verified using an asymmetric key pair before admission to the GKE cluster.
Workload deployments must ensure immutability by preventing image tag mutability exploits.

Which combination of steps should you implement to configure this deployment gate?

Enable Artifact Analysis scanning on the repository. Configure the GKE cluster with Binary Authorization evaluation mode set to Audit-only with Continuous Validation. In the CI/CD pipeline, sign the Git commit SHA using an asymmetric private key and store the signature as a Kubernetes annotation on the deployment manifest before deploying to GKE.

Enable Artifact Analysis vulnerability scanning. In Binary Authorization, set the admission rule to ALWAYS_DENY and grant the roles/binaryauthorization.attestorsVerifier role to the GKE service account. In the CI/CD pipeline, trigger the Binary Authorization breakglass workflow upon detecting acceptable scan scores to bypass policy checks and deploy the image.

Enable Artifact Analysis vulnerability scanning on the repository. Create a Binary Authorization attestor associated with an Artifact Analysis note and register the PKIX public key. Configure the Binary Authorization policy default admission rule to require attestations from this attestor and enable enforcement on the GKE cluster. In the pipeline, evaluate the scan results, sign the container image digest with the private key to create an attestation occurrence, and deploy the workload to GKE using the image digest.

Enable Artifact Analysis scanning on the repository. Deploy a custom admission webhook in GKE to query Artifact Analysis CVSS scores during pod scheduling. Set the Binary Authorization policy default rule to ALWAYS_ALLOW. In the CI/CD pipeline, tag the container image with a unique build ID, sign the tag name with a private key, and deploy the workload to GKE using the mutable image tag.

Professional Cloud DevOps Engineer

Gke Binary Authorization Attestation Deployment Gate

Related questions