Your enterprise is establishing an end-to-end software supply chain security architecture for containerized microservices deployed to Google Kubernetes Engine (GKE). Your design must satisfy the following requirements: Automatically and continuously scan container images stored in Artifact Registry for newly discovered vulnerabilities. Generate cryptographic build provenance and verify security attestations throughout the CI/CD pipeline. Enforce that only verified, non-vulnerable container images are admitted into the GKE clusters at deploy time. Continuously monitor running GKE Pods to detect policy violations if new vulnerabilities or invalid attestations emerge post-deployment. Which strategy should you implement?

Enable Artifact Analysis for continuous vulnerability scanning in Artifact Registry, configure Cloud Build to generate SLSA build provenance and attestations, and enforce Binary Authorization deploy-time policies on GKE combined with Continuous Validation (CV).: ### What the Solution Is This architecture establishes a complete, automated software supply chain security framework across Google Cloud by combining **Artifact Analysis**, **Cloud Build**, and **Binary Authorization** with **Continuous Validation (CV)**. ### How It Meets the Requirements - **Continuous Vulnerability Scanning**: Enabling **Artifact Analysis** automatically scans container images when pushed to **Artifact Registry** and continuously updates vulnerability metadata as new Common Vulnerabilities and Exposures (CVEs) are discovered in public vulnerability databases. - **Cryptographic Provenance**: **Cloud Build** automatically produces verifiable build provenance (compliant with the **SLSA** framework) and creates signed attestations storing metadata about the build process and source commit in **Artifact Analysis** notes. - **Deploy-Time Enforcement**: **Binary Authorization** acts as an admission controller on **Google Kubernetes Engine (GKE)** to intercept deployment requests, evaluating the container image against defined signature and attestation policies before admitting the Pod to the cluster. - **Post-Deployment Workload Monitoring**: **Continuous Validation (CV)** extends Binary Authorization by periodically re-evaluating running Pods against check-based platform policies, logging alerts to **Cloud Logging** if images develop new critical CVEs or have expired attestations. ### Key Advantages and Capabilities - **End-to-End Governance**: Protects artifacts across the entire lifecycle from source and build to admission and post-deploy runtime. - **Shift-Left and Shift-Right Synergy**: Catches known vulnerabilities early in CI while ensuring post-deployment posture remains compliant as threat databases evolve. - **Cryptographic Tamper-Resistance**: Uses asymmetric public/private key pairs and KMS-backed attestations to guarantee image provenance. - **Zero Overhead on Developers**: Integrates natively with managed GCP services without requiring custom admission webhooks or manual scripts. ### Why This Is Optimal This design provides a unified, cloud-native control plane across Google Cloud managed services, meeting all compliance and security requirements without adding third-party operational burdens or complex self-managed tooling.

Gke Supply Chain Binary Authorization Artifact Analysis | Professional Cloud DevOps Engineer

Gke Supply Chain Binary Authorization Artifact Analysis

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise is establishing an end-to-end software supply chain security architecture for containerized microservices deployed to Google Kubernetes Engine (GKE).

Your design must satisfy the following requirements:

Automatically and continuously scan container images stored in Artifact Registry for newly discovered vulnerabilities.
Generate cryptographic build provenance and verify security attestations throughout the CI/CD pipeline.
Enforce that only verified, non-vulnerable container images are admitted into the GKE clusters at deploy time.
Continuously monitor running GKE Pods to detect policy violations if new vulnerabilities or invalid attestations emerge post-deployment.

Which strategy should you implement?

Enable Artifact Analysis for continuous vulnerability scanning in Artifact Registry, configure Cloud Build to generate SLSA build provenance and attestations, and enforce Binary Authorization deploy-time policies on GKE combined with Continuous Validation (CV).

Execute the On-Demand Scanning API manually from developer workstations during local builds, write the scan output to Cloud Logging, and configure GKE Network Policies to block traffic from non-compliant pods.

Deploy a self-hosted Harbor registry instance on Compute Engine with the 'Automatically scan images on push' option enabled, export container logs to BigQuery, and use custom Kubernetes admission controllers to evaluate image hashes.

Configure Anthos Config Sync with read-only OCI authentication to pull manifests from Artifact Registry, and rely on signed Git commits to verify supply chain integrity at deploy time.

Professional Cloud DevOps Engineer

Gke Supply Chain Binary Authorization Artifact Analysis

Related questions