Google Cloud Professional Cloud Security Engineer Practice Exam

What is the best approach to prevent the deployment of containers with known vulnerabilities in a CI/CD pipeline on GKE?

1. Manually review logs before deployment

2. Create a Cloud Build pipeline and implement a Binary Authorization policy

3. Use third-party vulnerability scanning tools

4. Deploy containers in a staging environment first

The correct answer is: Create a Cloud Build pipeline and implement a Binary Authorization policy

Implementing a Binary Authorization policy within a Cloud Build pipeline is the most effective approach to prevent the deployment of containers with known vulnerabilities in a CI/CD pipeline on Google Kubernetes Engine (GKE). Binary Authorization is a security control that ensures only trusted container images are deployed on the GKE clusters by enforcing specific policies at deployment time. By creating a Binary Authorization policy, you can specify criteria that must be met for an image to be considered trusted. This can include requirements such as having certain signatures or passing specific compliance checks, which helps to guarantee that only verified images are used in your production environment. This proactive security measure significantly reduces the risk of deploying containers that could expose your application to vulnerabilities. Using this approach automates security checks and integrates directly into your CI/CD process, bringing efficiency to the pipeline while maintaining strong security practices. This is crucial for organizations wanting to maintain a secure application environment without slowing down their deployment processes. The other options, while useful in certain contexts, do not provide the same level of protection that Binary Authorization offers. For example, manually reviewing logs can be time-consuming and prone to human error, while staging environments, although useful for testing, can still lead to vulnerabilities if the deployment criteria are not rigorously enforced. Third-party tools can