Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise organization requires a secure CI/CD pipeline on Google Cloud for containerized microservices deployed to Google Kubernetes Engine (GKE). You need to implement a comprehensive supply chain security strategy that satisfies the following requirements:
StudyCerts
StudyCertsCRITICAL or HIGH vulnerabilities are found.Which combination of actions should you implement?
Execute Web Security Scanner inside the Cloud Build pipeline before pushing the container; disable the Container Scanning API to reduce overhead; and rely on Cloud Deploy manual release approvals for GKE rollout gating.
Set up a Cloud Scheduler cron job to pull and re-tag images every 7 days; invoke gcloud container images describe to parse CVE outputs into BigQuery; and use a custom Kubernetes mutating webhook to reject pods with unapproved tags.
In Cloud Build, use the On-Demand Scanning API to scan the locally built image and evaluate vulnerability severity prior to running docker push; enable automatic scanning via the Container Scanning API on Artifact Registry for continuous analysis; and configure Binary Authorization policies on the GKE cluster.
Configure Artifact Registry with on-push scanning only; write a Cloud Function triggered by Pub/Sub to delete non-compliant images after upload; and use IAM condition bindings on the GKE service account to block unauthorized workload deployments.
Execute Web Security Scanner inside the Cloud Build pipeline before pushing the container; disable the Container Scanning API to reduce overhead; and rely on Cloud Deploy manual release approvals for GKE rollout gating.
Set up a Cloud Scheduler cron job to pull and re-tag images every 7 days; invoke gcloud container images describe to parse CVE outputs into BigQuery; and use a custom Kubernetes mutating webhook to reject pods with unapproved tags.
In Cloud Build, use the On-Demand Scanning API to scan the locally built image and evaluate vulnerability severity prior to running docker push; enable automatic scanning via the Container Scanning API on Artifact Registry for continuous analysis; and configure Binary Authorization policies on the GKE cluster.
This architecture integrates Cloud Build, Artifact Analysis On-Demand Scanning, Artifact Registry continuous vulnerability scanning, and Binary Authorization to deliver an end-to-end secure software supply chain.
By integrating the On-Demand Scanning API directly into cloudbuild.yaml, the pipeline runs gcloud artifacts docker images scan on the locally built image and inspects the output with gcloud artifacts docker images list-vulnerabilities. If CRITICAL or HIGH vulnerabilities are detected, the build step returns a non-zero exit code, immediately halting the pipeline before executing docker push.
Enabling automatic scanning (containerscanning.googleapis.com) in Artifact Registry ensures that once an approved image is uploaded, Artifact Analysis continuously matches its package metadata against external CVE sources updated multiple times per day throughout the 30-day active monitoring window.
Binary Authorization acts as a Kubernetes admission controller on GKE. It enforces signature verification and attestations (such as vulnerability scan compliance and build provenance) before allowing container pods to deploy to the cluster.
Configure Artifact Registry with on-push scanning only; write a Cloud Function triggered by Pub/Sub to delete non-compliant images after upload; and use IAM condition bindings on the GKE service account to block unauthorized workload deployments.