Exam Professional Cloud Security Engineer topic 1 question 125 discussion

On-demand container analysis can be integrated into a Cloud Build Pipeline: https://cloud.google.com/container-analysis/docs/ods-cloudbuild Also binary attestation is a complementary mechanism "cloud-native".

A. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue. This approach integrates vulnerability scanning into your CI/CD pipeline using native Google Cloud services. E. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster. This approach enforces security policies through Binary Authorization, ensuring only images with proper attestations (i.e., no known vulnerabilities) are deployed.

AE is the answer. https://cloud.google.com/container-analysis/docs/container-analysis Container Analysis is a service that provides vulnerability scanning and metadata storage for containers. The scanning service performs vulnerability scans on images in Container Registry and Artifact Registry, then stores the resulting metadata and makes it available for consumption through an API. https://cloud.google.com/binary-authorization/docs/attestations After a container image is built, an attestation can be created to affirm that a required activity was performed on the image such as a regression test, vulnerability scan, or other test. The attestation is created by signing the image's unique digest. During deployment, instead of repeating the activities, Binary Authorization verifies the attestations using an attestor. If all of the attestations for an image are verified, Binary Authorization allows the image to be deployed.

AE is the answer, C has too much manual operations

Ans: A,E https://cloud.google.com/architecture/binary-auth-with-cloud-build-and-gke#setting_the_binary_authorization_policy