Google Exam Professional-Cloud-DevOps-Engineer Topic 3 Question 63 Discussion

Actual exam question for Google's Professional Cloud DevOps Engineer exam

Question #: 63
Topic #: 3

[All Professional Cloud DevOps Engineer Questions]

Your company operates in a highly regulated domain. Your security team requires that only trusted container images can be deployed to Google Kubernetes Engine (GKE). You need to implement a solution that meets the requirements of the security team, while minimizing management overhead. What should you do?

AGrant the roles/artifactregistry. writer role to the Cloud Build service account. Confirm that no employee has Artifact Registry write permission.

BUse Cloud Run to write and deploy a custom validator Enable an Eventarc trigger to perform validations when new images are uploaded.

CConfigure Kritis to run in your GKE clusters to enforce deploy-time security policies.

DConfigure Binary Authorization in your GKE clusters to enforce deploy-time security policies

Show Suggested Answer

Suggested Answer: D

by Talia at Mar 21, 2024, 11:06 PM

Limited Time Offer

25%

Off

Get Premium Professional-Cloud-DevOps-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Hershel

8 days ago

Option C with Kritis is also an interesting option. It lets us define custom security policies and apply them to our deployments. But it might be a bit more complex to set up and maintain.

upvoted 0 times

...

Otis

9 days ago

Yeah, Binary Authorization seems like the most straightforward solution. We don't have to worry about managing additional services or permissions. It just handles the policy enforcement for us.

upvoted 0 times

...

Franchesca

10 days ago

Haha, yeah, the less we have to manage, the better. I'm all about that low-maintenance approach. Binary Authorization is sounding better and better.

upvoted 0 times

...

Kimberely

11 days ago

True, Kritis could be a bit more hands-on. Plus, I'm a little worried about the management overhead with a custom validator in Option B. Gotta keep that overhead to a minimum, you know?

upvoted 0 times

...