Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A financial services organization is implementing a CI/CD pipeline using Cloud Build and Artifact Registry for containerized microservices. The security team establishes a strict shift-left security policy:
StudyCerts
StudyCertsCRITICAL or HIGH severity are identified.Which pipeline orchestration strategy should the security engineer implement in cloudbuild.yaml?
On-Demand Scanning (ODS) is a feature of Artifact Analysis that allows developers and automated build pipelines to initiate vulnerability scans on local container images before pushing them to a container repository. Unlike automated registry scanning, which triggers only after an image is uploaded, On-Demand Scanning allows scanning directly within the Cloud Build workspace.
cloudbuild.yaml, the image is built locally using docker build. The build pipeline calls gcloud artifacts docker images scan against the local image tag, generating an on-demand scan resource without requiring the image to be uploaded to Artifact Registry.gcloud artifacts docker images list-vulnerabilities with a filter for vulnerability.effectiveSeverity. By checking for regular expression matches against CRITICAL|HIGH, the script exits with code 1 if matched, terminating the Cloud Build execution.docker push step from ever running, ensuring no vulnerable artifacts reach the registry.CRITICAL, HIGH, or MEDIUM) tailored to organizational compliance policies.This approach natively satisfies shift-left security requirements by scanning the artifact inside the build execution environment and conditioning repository publication on passing vulnerability thresholds.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.