Professional Cloud Developer · Free Practice Question Hard
Question 4
The financial services company you work for follows a container-first approach, where microservices applications are developed by your team. The process involves a Cloud Build pipeline that generates the container image, conducts regression tests, and uploads the image to Artifact Registry. To ensure that only the containers that have passed regression tests are deployed to Google Kubernetes Engine (GKE) clusters, you need to take specific measures. You have already enabled Binary Authorization on the GKE clusters.
What is the next step you need to take?
- A Create an attestor and a policy. Attest container images that pass regression tests as a step in the Cloud Build pipeline.
- B Deploy Voucher Server and Voucher Client components. Run Voucher Client in the Cloud Build pipeline after container image passes regression tests.
- C Create an attestor and a policy. After a container image passes regression tests, use Cloud Build to execute Kritis Signer and attest the image.
- D Configure Restricted Pod Security Standard for relevant namespaces. Digitally sign container images that pass regression tests using Cloud Build.
Reveal correct answer
Correct answer: C
Explanation
To ensure that only containers that have passed the regression tests are deployed to GKE clusters, the correct approach is to create an attestor and a policy. An attestor is an entity that vouches for the integrity of the container image. A policy is a set of rules that determine which container images are allowed to be deployed based on the attestations they have received. After a container image has successfully passed the regression tests, Cloud Build can be used to run Kritis Signer to create an attestation for the container image. The attestation can then be submitted to Binary Authorization, which enforces the policy to ensure that only container images with valid attestations are deployed. This approach helps to ensure the security and integrity of the microservices applications in the container-first environment.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
