Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A DevOps team uses Google Cloud Build to run automated tests and build container images for a critical application. The organization's security policy requires shifting security left by validating that container images do not contain severe vulnerabilities before they are stored in the artifact repository.
The team has the following requirements:
StudyCerts
StudyCertsCRITICAL or HIGH severity vulnerabilities are detected.Which strategy should the team implement in their Cloud Build configuration?
Configure build steps in cloudbuild.yaml to execute gcloud artifacts docker images scan on the local image, evaluate the results using gcloud artifacts docker images list-vulnerabilities, and fail the pipeline prior to executing docker push if matching severity levels are found.
Enable automatic vulnerability scanning in Artifact Registry, push all built container images immediately after unit testing, and trigger a Cloud Function via Pub/Sub to delete the image if vulnerabilities are discovered.
Configure a Binary Authorization policy inside Cloud Build that evaluates the local Docker build context and prevents the Docker daemon from outputting image layers that contain critical vulnerabilities.
Incorporate a Web Security Scanner execution step into cloudbuild.yaml to scan the local container image filesystem for CVEs and halt the build upon detection of high-risk vulnerabilities.
Configure build steps in cloudbuild.yaml to execute gcloud artifacts docker images scan on the local image, evaluate the results using gcloud artifacts docker images list-vulnerabilities, and fail the pipeline prior to executing docker push if matching severity levels are found.
Artifact Analysis On-Demand Scanning allows developers and CI/CD pipelines to initiate vulnerability scans on container images stored locally or in Artifact Registry. By leveraging the Google Cloud SDK within Cloud Build, organizations can scan images as a build step immediately after compilation and containerization.
gcloud artifacts docker images scan followed by gcloud artifacts docker images list-vulnerabilities, the build pipeline can parse the effective severity levels. If vulnerabilities matching CRITICAL or HIGH are discovered, the script exits with a non-zero code, failing the build and preventing subsequent docker push execution.This approach directly prevents vulnerable images from reaching the repository, saving storage and network overhead while establishing a clean separation between validated release candidates and failed builds.
Enable automatic vulnerability scanning in Artifact Registry, push all built container images immediately after unit testing, and trigger a Cloud Function via Pub/Sub to delete the image if vulnerabilities are discovered.
Configure a Binary Authorization policy inside Cloud Build that evaluates the local Docker build context and prevents the Docker daemon from outputting image layers that contain critical vulnerabilities.
Incorporate a Web Security Scanner execution step into cloudbuild.yaml to scan the local container image filesystem for CVEs and halt the build upon detection of high-risk vulnerabilities.