Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Your enterprise organization requires a secure CI/CD pipeline on Google Cloud for containerized microservices deployed to Google Kubernetes Engine (GKE). You need to implement a comprehensive supply chain security strategy that satisfies the following requirements:
StudyCerts
StudyCertsCRITICAL or HIGH vulnerabilities are found.Which combination of actions should you implement?
This architecture integrates Cloud Build, Artifact Analysis On-Demand Scanning, Artifact Registry continuous vulnerability scanning, and Binary Authorization to deliver an end-to-end secure software supply chain.
By integrating the On-Demand Scanning API directly into cloudbuild.yaml, the pipeline runs gcloud artifacts docker images scan on the locally built image and inspects the output with gcloud artifacts docker images list-vulnerabilities. If CRITICAL or HIGH vulnerabilities are detected, the build step returns a non-zero exit code, immediately halting the pipeline before executing docker push.
Enabling automatic scanning (containerscanning.googleapis.com) in Artifact Registry ensures that once an approved image is uploaded, Artifact Analysis continuously matches its package metadata against external CVE sources updated multiple times per day throughout the 30-day active monitoring window.
Binary Authorization acts as a Kubernetes admission controller on GKE. It enforces signature verification and attestations (such as vulnerability scan compliance and build provenance) before allowing container pods to deploy to the cluster.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.