Google Cloud Professional Cloud Security Engineer Practice Exam

What approach should be taken to ensure only trusted container images are deployed on Cloud Run?

1. Enable Binary Authorization for the Cloud Run service

2. Use public container images only

3. Run all containers in a staging environment first

4. Disable container analysis after initial deployment

The correct answer is: Enable Binary Authorization for the Cloud Run service

Enabling Binary Authorization for the Cloud Run service is the most effective approach to ensure that only trusted container images are deployed. Binary Authorization is a security feature that provides a policy-based framework for protecting your deployment process. It ensures that only container images that have been signed by trusted authorities can be deployed. By integrating with CI/CD pipelines, Binary Authorization allows organizations to establish policies that verify the source and integrity of container images, significantly reducing the risk of deploying vulnerable or malicious containers. In this context, using only public container images does not guarantee trustworthiness because public images can come from unverified sources and may contain vulnerabilities. Running all containers in a staging environment could help catch issues before production deployment, but it does not inherently validate the trust of the images themselves. Disabling container analysis after initial deployment would reduce the capability to monitor and assess vulnerabilities in your deployed images over time, which is contrary to maintaining a secure environment.