A security engineer is designing an automated CI/CD pipeline in Google Cloud to build and publish hardened base container images. The pipeline must enforce security guardrails by shifting vulnerability detection left. The pipeline must fulfill the following requirements: Build container images locally within the build environment using a hardened Dockerfile. Inspect the container image for known operating system and language package vulnerabilities before it is published. Automatically fail the build pipeline and prevent pushing the image to the production Artifact Registry repository if any CRITICAL or HIGH severity vulnerabilities are detected. Use native Google Cloud CLI tools and services within the build workflow. Which pipeline workflow should the security engineer implement in Cloud Build?

Cloud Build Artifact Analysis Ondemand Scan | Professional Cloud Security Engineer

Cloud Build Artifact Analysis Ondemand Scan

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing an automated CI/CD pipeline in Google Cloud to build and publish hardened base container images. The pipeline must enforce security guardrails by shifting vulnerability detection left.

The pipeline must fulfill the following requirements:

Build container images locally within the build environment using a hardened Dockerfile.
Inspect the container image for known operating system and language package vulnerabilities before it is published.
Automatically fail the build pipeline and prevent pushing the image to the production Artifact Registry repository if any CRITICAL or HIGH severity vulnerabilities are detected.
Use native Google Cloud CLI tools and services within the build workflow.

Which pipeline workflow should the security engineer implement in Cloud Build?

Configure cloudbuild.yaml to run docker build, execute gcloud artifacts docker images scan against the local image, query the scan results using gcloud artifacts docker images list-vulnerabilities with a severity filter to fail the build on CRITICAL or HIGH findings, and execute docker push only after the check passes.

Configure cloudbuild.yaml to upload the container image archive to a Cloud Storage bucket, execute Vulnerability Assessment for Google Cloud to inspect the archive disk image, and push the image to Artifact Registry if no findings occur.

Configure cloudbuild.yaml with the Artifact Registry repository destination declared in the images: field, rely on automatic on-push scanning in Artifact Registry, and trigger an Eventarc Cloud Function to delete the image if vulnerabilities are discovered.

Configure cloudbuild.yaml to run Web Security Scanner against the local container filesystem, evaluate the findings against the OWASP Top 10 benchmark, and use Binary Authorization to block pushing the image to Artifact Registry.

Professional Cloud Security Engineer

Cloud Build Artifact Analysis Ondemand Scan

Related questions