GCP Professional Cloud Security Engineer Practice Question

Your organization runs multiple Anthos clusters on VMware (GKE Enterprise edition). A centralized Cloud project already hosts a Binary Authorization policy named team-policy that requires every container image to carry an attestation signed by the CI/CD system's KMS key. You must ensure that:

All workloads deployed to the production user cluster are blocked at deploy-time unless they comply with team-policy.
Developers should be able to test non-attested images on the dev user cluster, but any violations must be logged for later review.

Which approach meets these requirements while minimizing operational overhead?

Disable Binary Authorization at the project level and instead run vulnerability scans post-deployment with Cloud Run Jobs in both clusters.
Duplicate team-policy into each cluster's namespace and annotate any deployment in production with breakglass: "true"; leave dev without Binary Authorization enabled.
Reference the centralized team-policy in both user-cluster configuration files, set enableBinaryAuthorization: true, and specify defaultAdmissionRule.enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG for production while using DRYRUN_AUDIT_LOG_ONLY for the dev cluster.
Set defaultAdmissionRule.enforcementMode: DRYRUN_AUDIT_LOG_ONLY in the centralized policy so both clusters log violations, and instruct platform admins to manually delete non-compliant pods in production.

Report Issue

Answer Description

Anthos clusters on VMware inherit Binary Authorization policies defined in a Google Cloud project, but each user cluster decides whether the admission controller blocks non-compliant images or only audits them. Enabling Binary Authorization by setting enableBinaryAuthorization: true in the user cluster configuration activates the admission webhook. Setting

defaultAdmissionRule.enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG on the production cluster stops deployments that lack the required attestation and records the event.
defaultAdmissionRule.enforcementMode: DRYRUN_AUDIT_LOG_ONLY on the dev cluster leaves the same policy in place but merely logs any violations.

This enforces the shared team-policy everywhere, guarantees production protection, and avoids separate policy copies or disabling the controller on dev. Using the break-glass annotation would allow uncontrolled bypass, and disabling Binary Authorization or switching the policy to dry run at the project level would weaken security for production.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.