An enterprise is securing its software supply chain across Google Kubernetes Engine (GKE) clusters and Cloud Run services using Binary Authorization. The security architecture requires: An attestor named prod-attestor that verifies cryptographic signatures generated by the CI/CD pipeline using a Cloud KMS asymmetric key pair. Storage and discovery of attestation occurrences via an Artifact Analysis note. Default policy enforcement requiring valid attestations from prod-attestor before container deployment across all production GKE clusters and Cloud Run services. A cluster-specific rule for a pre-production cluster (us-central1-a.staging-cluster) configured to log policy violations without blocking non-compliant container deployments. Which configuration should the security engineer implement to satisfy these requirements?

1. Create an Artifact Analysis note and define a Binary Authorization attestor referencing the note and the Cloud KMS asymmetric verification key. 2. In the Binary Authorization policy, set the default rule evaluation mode to require attestations from `prod-attestor` with enforcement mode enabled. 3. Add a cluster-specific admission rule for `us-central1-a.staging-cluster` set to Dry Run mode. 4. Provision the GKE clusters with `--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE`.: ### What Binary Authorization Attestation Architecture Is **Binary Authorization** is a deploy-time security control for **Google Kubernetes Engine (GKE)** and **Cloud Run** that ensures only trusted container images are deployed. An **attestor** is a named Google Cloud resource that verifies cryptographic signatures (**attestations**) associated with a container image digest. The attestor links an **Artifact Analysis note**—which serves as the metadata anchor for storing attestation occurrences—to public keys or asymmetric **Cloud Key Management Service (Cloud KMS)** cryptographic keys used to verify those signatures. ### How It Meets the Requirements - **Cloud KMS Asymmetric Keys & Artifact Analysis Note**: Binary Authorization requires an **Artifact Analysis note** to store attestation metadata and uses asymmetric key pairs hosted in **Cloud KMS** (where the private key signs the image digest in CI/CD pipelines and the public verification key is bound to the attestor). - **Default Evaluation Rule**: Setting the `defaultAdmissionRule` to `REQUIRE_ATTESTATION` with `requireAttestationsBy: [projects/PROJECT_ID/attestors/prod-attestor]` ensures all GKE and Cloud Run deployments enforce signature validation across standard workloads. - **Cluster-Specific Override**: Adding a rule under `clusterAdmissionRules` for `us-central1-a.staging-cluster` with **Dry Run Mode** (`DRYRUN_AUDIT_LOG_ONLY`) evaluates the policy against incoming deployments and emits audit logs in Cloud Logging without rejecting unverified containers. - **GKE Cluster Enforcement**: Deploying or updating clusters with `--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE` activates the admission controller to query the project's singleton policy at deploy time. ### Key Advantages - **Cryptographic Provenance**: Eliminates unsigned or unapproved container deployments across both serverless (Cloud Run) and managed Kubernetes (GKE) runtimes. - **Centralized Key Management**: Cloud KMS ensures asymmetric signing keys remain secure and auditable with native IAM controls. - **Safe Policy Rollouts**: Dry Run mode allows platform engineers to test policy configurations in staging without interrupting development workflows. - **Hierarchical Policy Precedence**: Cluster-specific admission rules take precedence over default admission rules, providing granular multi-environment governance. ### Why This Is Optimal This solution follows Google Cloud recommended security practices by leveraging built-in Artifact Analysis metadata management, Cloud KMS cryptographic key protection, and native project singleton policy evaluation flags on GKE.

Binary Authorization Policy Attestor Kms Config | Professional Cloud Security Engineer

Binary Authorization Policy Attestor Kms Config

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is securing its software supply chain across Google Kubernetes Engine (GKE) clusters and Cloud Run services using Binary Authorization.

The security architecture requires:

An attestor named prod-attestor that verifies cryptographic signatures generated by the CI/CD pipeline using a Cloud KMS asymmetric key pair.
Storage and discovery of attestation occurrences via an Artifact Analysis note.
Default policy enforcement requiring valid attestations from prod-attestor before container deployment across all production GKE clusters and Cloud Run services.
A cluster-specific rule for a pre-production cluster (us-central1-a.staging-cluster) configured to log policy violations without blocking non-compliant container deployments.

Which configuration should the security engineer implement to satisfy these requirements?

Define a Binary Authorization attestor directly linked to a custom IAM Service Account without creating an Artifact Analysis note.
Configure the default rule evaluation mode to require attestations with dry-run mode enabled globally.
Configure a specific rule scoped to the default namespace set to Require Attestations.
Provision the GKE clusters with --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE.

Create an Artifact Analysis note and define a Binary Authorization attestor linked to a symmetric Cloud KMS encryption/decryption key.
In the Binary Authorization policy, configure the default rule evaluation mode to require attestations from prod-attestor.
Configure an admission rule override using a Kubernetes Service Account rule set to Allow All Images.
Provision the GKE clusters with --binauthz-evaluation-mode=DISABLED.

Create an Artifact Analysis note and define a Binary Authorization attestor referencing the note and the Cloud KMS asymmetric verification key.
In the Binary Authorization policy, set the default rule evaluation mode to require attestations from prod-attestor with enforcement mode enabled.
Add a cluster-specific admission rule for us-central1-a.staging-cluster set to Dry Run mode.
Provision the GKE clusters with --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE.

Create a Cloud Storage bucket metadata document and bind it to a Binary Authorization attestor configured with a Cloud KMS HMAC key.
In the Binary Authorization policy, configure the default evaluation mode to Allow All Images.
Add a cluster-specific admission rule for us-central1-a.staging-cluster set to Deny All Images.
Provision the GKE clusters with --binauthz-evaluation-mode=POLICY_BINDINGS.

Professional Cloud Security Engineer

Binary Authorization Policy Attestor Kms Config

Related questions