Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise security policy mandates that Google Kubernetes Engine (GKE) clusters in your production Google Cloud project only deploy container images that have verified build provenance and an attestation from Cloud Build. You execute builds inside Cloud Build private worker pools.
During pipeline testing, your single Cloud Build configuration file builds the Docker container, pushes it to Artifact Registry via an explicit docker push build step, and attempts to deploy the image directly to GKE. However, Binary Authorization blocks the deployment because the required built-by-cloud-build attestation is missing.
Which combination of actions should you take to ensure the attestation is properly generated and verified?
Create a custom Cloud Build step that signs the container digest using Cloud KMS and manually creates an attestation occurrence before running 'kubectl apply' in the same build configuration file.
Update the Binary Authorization policy's default admission rule evaluation mode to 'ALWAYS_ALLOW' and switch enforcement mode to 'DRYRUN_AUDIT_LOG_ONLY'.
Add 'requestedVerifyOption: VERIFIED' to the build options, push the container image to Artifact Registry using the top-level 'images' field instead of 'docker push', and separate the build and deployment workloads into distinct pipeline configurations.
Assign the 'roles/binaryauthorization.attestorsViewer' role to the Cloud Build service account, keep the single build configuration, and add the '--digest-file' flag to the 'docker push' command.
Create a custom Cloud Build step that signs the container digest using Cloud KMS and manually creates an attestation occurrence before running 'kubectl apply' in the same build configuration file.
Update the Binary Authorization policy's default admission rule evaluation mode to 'ALWAYS_ALLOW' and switch enforcement mode to 'DRYRUN_AUDIT_LOG_ONLY'.
Add 'requestedVerifyOption: VERIFIED' to the build options, push the container image to Artifact Registry using the top-level 'images' field instead of 'docker push', and separate the build and deployment workloads into distinct pipeline configurations.
Google Cloud provides automated build provenance and attestation generation through Cloud Build and Binary Authorization. When properly configured, Cloud Build generates a verifiable cryptographic attestation associated with the built-by-cloud-build attestor upon successful completion of a build.
StudyCerts
StudyCertsrequestedVerifyOption: VERIFIED to the options block of the build configuration explicitly enables attestation generation.docker push step is used. Images must be specified under the top-level images field in the build config so that Cloud Build manages the upload and captures the digest necessary for the attestation.This approach leverages native, fully managed platform controls to ensure zero-trust supply chain validation while adhering directly to Cloud Build's architectural lifecycle requirements.
Assign the 'roles/binaryauthorization.attestorsViewer' role to the Cloud Build service account, keep the single build configuration, and add the '--digest-file' flag to the 'docker push' command.