Exam Professional Cloud DevOps Engineer topic 1 question 134 discussion

Actual exam question from Google's Professional Cloud DevOps Engineer

Question #: 134
Topic #: 1

[All Professional Cloud DevOps Engineer Questions]

As part of your company's initiative to shift left on security, the InfoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the deployment of trusted and approved images. You need to determine how to satisfy the InfoSec team's goal of shifting left on security. What should you do?

A. Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images
B. Use Binary Authorization to attest images during your CI/CD pipeline
C. Configure Identity and Access Management (IAM) policies to create a least privilege model on your GKE clusters.
D. Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods

Show Suggested Answer

Suggested Answer: B 🗳️

by koo_kai at Oct. 28, 2023, 7:45 p.m.

Comments

Submit Cancel

mzansikiller

10 months, 3 weeks ago

Question 134 is question 119.

upvoted 1 times

...

xhilmi

1 year, 6 months ago

Selected Answer: B

To satisfy the goal of shifting left on security and implement guardrails to only allow the deployment of trusted and approved images on Google Kubernetes Engine (GKE) clusters, the recommended approach is (option B) Use Binary Authorization to attest images during your CI/CD pipeline. Binary Authorization allows you to define and enforce policies that determine which container images can run in your GKE environment based on image signatures. By integrating Binary Authorization into your CI/CD pipeline, you can ensure that only trusted and approved images, with the correct attestations, are deployed to the GKE clusters. This proactive security measure aligns with the concept of shifting security left, as it establishes controls early in the development and deployment process, minimizing the risk of deploying compromised or unapproved images in production.

upvoted 2 times

...