Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Your team is establishing a vulnerability scanning and compliance pipeline for containerized microservices stored in Artifact Registry. The solution must meet the following requirements:
Which combination of configuration steps and IAM permissions should you implement?
This solution combines Google Cloud On-Demand Scanning, Artifact Analysis automatic continuous scanning, and Container Analysis IAM roles to secure the container delivery lifecycle end-to-end.
StudyCerts
StudyCertsgcloud artifacts docker images scan (along with gcloud artifacts docker images list-vulnerabilities) allows Cloud Build to analyze locally built container images and enforce build-breaking policies prior to pushing to Artifact Registry.containerscanning.googleapis.com) activates automatic on-push scanning and continuous analysis in Artifact Registry. Artifact Analysis automatically scans both operating system packages and application language packages (such as Go, Java/Maven, Node.js, and Python), refreshing occurrence metadata daily against updated CVE databases for images active within 30 days.roles/containeranalysis.occurrences.viewer (Container Analysis Occurrences Viewer) provides read-only access to view vulnerability occurrences, package dependencies, and metadata notes without granting administrative privileges or unnecessary data access.This approach leverages native Google Cloud services following the principle of least privilege, eliminates custom scanning infrastructure, and achieves automated shift-left security coupled with continuous post-push vulnerability monitoring.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.