Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A security engineer is designing an automated CI/CD pipeline in Google Cloud to build and publish hardened base container images. The pipeline must enforce security guardrails by shifting vulnerability detection left.
The pipeline must fulfill the following requirements:
CRITICAL or HIGH severity vulnerabilities are detected.Which pipeline workflow should the security engineer implement in Cloud Build?
cloudbuild.yaml to run Web Security Scanner against the local container filesystem, evaluate the findings against the OWASP Top 10 benchmark, and use Binary Authorization to block pushing the image to Artifact Registry.Web Security Scanner is a dynamic application security testing (DAST) tool in Security Command Center that crawls publicly accessible web applications (on Compute Engine, GKE, or App Engine) to discover web-layer vulnerabilities like Cross-Site Scripting (XSS) and cleartext credential transmission. Binary Authorization is a deploy-time policy enforcement engine that ensures only signed, attestable container images are deployed to GKE or Cloud Run.
docker push command from storing an image in a repository.The requirement focused on performing dynamic DAST scanning against deployed web services and enforcing cryptographically signed attestations before deploying workloads to a Google Kubernetes Engine cluster.
cloudbuild.yaml to run docker build, execute gcloud artifacts docker images scan against the local image, query the scan results using gcloud artifacts docker images list-vulnerabilities with a severity filter to fail the build on CRITICAL or HIGH findings, and execute docker push only after the check passes.Artifact Analysis On-Demand Scanning is a Google Cloud capability that allows developers and security pipelines to perform vulnerability assessments on container images locally or in a build workspace before pushing them to an artifact repository. By combining the gcloud artifacts docker images scan and gcloud artifacts docker images list-vulnerabilities commands within a Cloud Build configuration (cloudbuild.yaml), organizations can automate vulnerability gatekeeping in CI/CD pipelines.
docker build) to assemble the hardened container layers inside the Cloud Build workspace.gcloud artifacts docker images scan submits the locally tagged image to the On-Demand Scanning API, returning a unique scan ID without requiring the image to exist in a public or production registry.gcloud artifacts docker images list-vulnerabilities retrieves the scan occurrences. A conditional shell filter inspects vulnerability.effectiveSeverity against the configured regular expression (CRITICAL|HIGH). If any match occurs, the script executes exit 1, immediately failing the Cloud Build job.docker push is placed as a downstream step in cloudbuild.yaml, the push step will never execute if the severity check step fails, preventing vulnerable images from ever entering the Artifact Registry repository.gcr.io/google.com/cloudsdktool/cloud-sdk builder images without requiring external third-party vulnerability scanners.This approach stops vulnerable artifacts at the pipeline gate before they enter the repository, avoiding complex post-push quarantine workflows or accidental consumption by deployment pipelines.
cloudbuild.yaml with the Artifact Registry repository destination declared in the images: field, rely on automatic on-push scanning in Artifact Registry, and trigger an Eventarc Cloud Function to delete the image if vulnerabilities are discovered.This architecture relies on Artifact Analysis automatic scanning, which triggers asynchronously when an image is pushed to Artifact Registry. If vulnerabilities are found, an asynchronous notification is sent via Pub/Sub or Eventarc to trigger a serverless function that deletes or quarantines the image.
images: field of cloudbuild.yaml causes Cloud Build to automatically push the image to Artifact Registry immediately upon successful step completion, before any post-push vulnerability scan executes.The requirement was to continuously monitor and clean up existing artifacts stored in Artifact Registry over time as new zero-day CVEs are disclosed, rather than gating image publication during build time.
cloudbuild.yaml to upload the container image archive to a Cloud Storage bucket, execute Vulnerability Assessment for Google Cloud to inspect the archive disk image, and push the image to Artifact Registry if no findings occur.Vulnerability Assessment for Google Cloud (built into Security Command Center) detects operating system and software package vulnerabilities in running Compute Engine VM instances and GKE nodes/containers by creating agentless disk clones every 12 hours and analyzing them using the SCALIBR scanner engine.
The requirement was to perform scheduled, non-intrusive vulnerability scanning across running Compute Engine VM fleets without installing local OS agents.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated