GCP Professional Cloud Security Engineer Practice Question

Your security team needs an end-to-end control that automatically scans every container image built by Cloud Build as soon as it is pushed to Artifact Registry, and blocks deployment of any image that contains HIGH or CRITICAL CVEs from reaching the production GKE clusters. The solution must rely solely on managed Google Cloud services, avoid custom scanning steps in Cloud Build, and surface findings centrally in Security Command Center. What should you do?

Migrate images to Container Registry, enable its legacy vulnerability scanning feature, and configure Cloud Build to query the Container Analysis API; if any HIGH or CRITICAL vulnerability is reported, tag the image with "do-not-deploy" and push it back to the registry.
Add a Cloud Build step that runs the gcloud artifacts docker images scan command for each image and fails the build if any HIGH or CRITICAL vulnerability is found before pushing the image to Artifact Registry.
Deploy an open-source scanning DaemonSet such as Trivy on each GKE cluster, configure it to poll images pulled from Artifact Registry, and create Cloud Monitoring alerts for HIGH or CRITICAL findings.
Enable vulnerability scanning on the Artifact Registry repository and turn on Binary Authorization vulnerability-based admission with a maximum allowed severity of MEDIUM, then enforce Binary Authorization on the production GKE clusters.

Report Issue

Answer Description

Enabling built-in vulnerability scanning on the Artifact Registry repository ensures that every image is scanned automatically on upload, and the results are published to Container Analysis where Security Command Center can ingest them. Configuring Binary Authorization with a vulnerability-based admission policy that rejects images whose maximum allowed severity is above MEDIUM lets GKE enforce the organization's risk threshold at deploy time without any extra code in the CI pipeline. Because both services are fully managed, the approach meets the requirement to avoid custom scanning steps while providing centralized visibility of findings. The other options either require custom build logic, third-party components that must be maintained, or depend on a deprecated registry and cannot provide deploy-time enforcement through a managed control plane.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.