An enterprise is establishing an automated CI/CD pipeline using Cloud Build, Artifact Registry, Artifact Analysis, and Binary Authorization to deploy containerized workloads to Google Kubernetes Engine (GKE). The security team mandates the following security gates: Container images must be scanned for vulnerabilities before pushing them to Artifact Registry. The pipeline must immediately abort if vulnerabilities classified as CRITICAL or HIGH are discovered. If the image satisfies the vulnerability threshold, the pipeline must push the image and generate an automated cryptographic attestation over the container image digest using an asymmetric Cloud KMS key. The attestation must be attached to the appropriate Binary Authorization attestor note in Artifact Analysis so GKE can validate the signature prior to admitting pods. Which workflow sequence in Cloud Build should the security team implement to satisfy these requirements?

1. Build the local image and calculate its exact digest. 2. Run `gcloud artifacts docker images scan` to perform On-Demand Scanning, and check effective severity levels with `gcloud artifacts docker images list-vulnerabilities` to fail the build if `CRITICAL` or `HIGH` findings exist. 3. Push the image to Artifact Registry using its digest. 4. Execute `gcloud beta container binauthz attestations sign-and-create` using the image digest, the target attestor, and the Cloud KMS key version to register the attestation.: ### What the Automated Attestation Workflow Is This workflow integrates **Artifact Analysis On-Demand Scanning API**, **Cloud Key Management Service (Cloud KMS)**, and **Binary Authorization** directly into a **Cloud Build** pipeline to enforce shift-left security and cryptographic provenance across the software supply chain. ### How It Meets the Security Requirements - **Pre-Push Vulnerability Gate**: The pipeline builds the container locally and triggers an on-demand scan with `gcloud artifacts docker images scan`. It inspects `vulnerability.effectiveSeverity` with `gcloud artifacts docker images list-vulnerabilities`, parsing findings with an exit code condition (`grep -Exq 'CRITICAL|HIGH'`) that terminates the build before pushing unauthorized artifacts to **Artifact Registry**. - **Immutable Digest Referencing**: By calculating and pinning the container's cryptographic digest (`sha256`), the pipeline guarantees that the attestation and the deployed artifact are immutably linked, eliminating time-of-check to time-of-use (TOCTOU) tag mutation risks. - **Cryptographic Attestation Generation**: Using `gcloud beta container binauthz attestations sign-and-create`, Cloud Build invokes an asymmetric signing key in **Cloud KMS** to sign the image digest payload and records the signed attestation as an occurrence under the attestor's **Artifact Analysis Note**. - **Deploy-Time Enforcement**: GKE's admission controller intercepts deployment manifests, checks Binary Authorization policy rules requiring the specific attestor authority, validates the Cloud KMS signature against the attestor's registered public key, and admits the pod. ### Key Advantages and Capabilities - **Fail-Closed Security**: Images containing unapproved vulnerabilities are never pushed to production repositories. - **Tamper-Proof Verification**: Signatures are anchored in hardware-backed or managed **Cloud KMS** keys without exposing private key material to local developers. - **Separation of Concerns**: Cryptographic attestor identities remain distinct across pipeline stages (e.g., build verification, security scanning, QA testing). - **Auditability and Traceability**: Detailed attestation occurrences in **Artifact Analysis** maintain historical records of exactly which build job signed which image digest. ### Why This Is Optimal This architecture establishes a strict gatekeeper mechanism inside CI/CD, preventing vulnerable or non-compliant containers from reaching deployment targets by cryptographically binding policy compliance to immutable image digests.

Cloud Build Binary Authorization Attestation Pipeline | Professional Cloud Security Engineer

Cloud Build Binary Authorization Attestation Pipeline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is establishing an automated CI/CD pipeline using Cloud Build, Artifact Registry, Artifact Analysis, and Binary Authorization to deploy containerized workloads to Google Kubernetes Engine (GKE).

The security team mandates the following security gates:

Container images must be scanned for vulnerabilities before pushing them to Artifact Registry.
The pipeline must immediately abort if vulnerabilities classified as CRITICAL or HIGH are discovered.
If the image satisfies the vulnerability threshold, the pipeline must push the image and generate an automated cryptographic attestation over the container image digest using an asymmetric Cloud KMS key.
The attestation must be attached to the appropriate Binary Authorization attestor note in Artifact Analysis so GKE can validate the signature prior to admitting pods.

Which workflow sequence in Cloud Build should the security team implement to satisfy these requirements?

Build the local image and calculate its exact digest.
Run gcloud artifacts docker images scan to perform On-Demand Scanning, and check effective severity levels with gcloud artifacts docker images list-vulnerabilities to fail the build if CRITICAL or HIGH findings exist.
Push the image to Artifact Registry using its digest.
Execute gcloud beta container binauthz attestations sign-and-create using the image digest, the target attestor, and the Cloud KMS key version to register the attestation.

Build and push the container image to Artifact Registry using the :latest tag.
Allow asynchronous automated container scanning to complete in Artifact Registry.
Grant the Compute Engine default service account roles/binaryauthorization.attestorsViewer permissions.
Sign the container image's mutable tag reference using an asymmetric Cloud KMS key without writing an occurrence to Artifact Analysis.

Sign the build context directory using a Cloud KMS asymmetric key.
Push the built image directly to Artifact Registry and initiate deployment to GKE using kubectl apply --dry-run=server.
Subscribe to the clouddeploy-operations Pub/Sub topic to detect deployment errors.
Create an unsigned metadata note in Artifact Analysis to record that the GKE server dry-run completed successfully.

Build and scan the image with On-Demand Scanning.
Verify package lock files and dependency hashes inside the container.
Configure Cloud Deploy with verify: true using a custom Skaffold verification test container to check vulnerabilities at runtime.
Configure the Binary Authorization policy with evaluation_mode: ALWAYS_ALLOW and rely on Cloud Deploy verification job rollbacks.

Professional Cloud Security Engineer

Cloud Build Binary Authorization Attestation Pipeline

Related questions