Resolve Vpc Sc Artifact Analysis Scanning Block

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise DevOps team manages a Cloud Build CI/CD pipeline that builds container images, executes vulnerability scans using the On-Demand Scanning API, and publishes validated artifacts to Artifact Registry.

To meet compliance mandates, all cloud development environments and build pipelines are enclosed within a VPC Service Controls (VPC-SC) service perimeter. During pipeline execution, the build step running gcloud artifacts docker images scan fails with a VPC Service Controls security perimeter violation, halting the CI/CD pipeline.

Which combination of actions should the DevOps engineer implement to resolve the perimeter violation and allow the vulnerability scanning gate to succeed?

Add containeranalysis.googleapis.com and artifactregistry.googleapis.com to the VPC Service Controls perimeter, and configure private DNS records mapping *.pkg.dev to restricted.googleapis.com or private.googleapis.com.

Assign the roles/containeranalysis.occurrences.viewer IAM role to the Cloud Build service account and configure a Cloud NAT gateway to bypass the perimeter.

Disable vulnerability scanning on the Artifact Registry repository using the --disable-vulnerability-scanning flag and execute the scan command locally outside Cloud Build.

Add containerscanning.googleapis.com directly to the VPC Service Controls perimeter and configure public DNS forwarding rules for pkg.dev.

Professional Cloud DevOps Engineer

Resolve Vpc Sc Artifact Analysis Scanning Block

Related questions