Binary Authorization for containers in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Binary Authorization Policy Enforcement

What happens when a container image is deployed to Google Kubernetes Engine (GKE) with Binary Authorization enabled, but the image is not signed by a trusted authority?

A The deployment is blocked and the container does not start.

B The container starts but logs a warning about the unsigned image.

C The container starts normally without any restrictions.

D The deployment is allowed only if the image is from a public registry.

💡 Hint

Think about the purpose of Binary Authorization in enforcing image trust.

Binary Authorization blocks deployment of container images that are not signed by trusted authorities to ensure only verified images run in the cluster.

❓ Architecture

intermediate

Configuring Binary Authorization with Attestors

You want to enforce that only container images signed by your internal CI system can be deployed to your GKE cluster. Which component must you configure in Binary Authorization to achieve this?

A Enable Shielded Nodes on the GKE cluster.

B Create an Attestor linked to your CI system's signing keys.

C Configure a Network Policy to restrict image downloads.

D Set up a Cloud Armor policy for the cluster.

💡 Hint

Consider how Binary Authorization verifies image signatures.

Attestors are entities in Binary Authorization that verify signatures from trusted sources like your CI system.

❓ security

advanced

Impact of Missing Attestor in Binary Authorization Policy

What is the effect on container image deployment if a Binary Authorization policy requires an Attestor that is not configured or missing?

A The policy is ignored and deployment proceeds normally.

B All container images are allowed without signature verification.

C Only images signed by other Attestors are allowed; unsigned images are blocked.

D All container image deployments are blocked until the Attestor is configured.

💡 Hint

Think about how Binary Authorization enforces policies with required Attestors.

If a required Attestor is missing, Binary Authorization cannot verify signatures and blocks all deployments to maintain security.

❓ service_behavior

advanced

Binary Authorization Behavior with Multiple Attestors

If a Binary Authorization policy requires multiple Attestors, what is the expected behavior when a container image is signed by only some of them?

A The deployment is blocked because all Attestors must approve the image.

B The deployment is allowed if at least one Attestor approves the image.

C The deployment is allowed only if the image is signed by the first Attestor in the list.

D The deployment is allowed regardless of Attestor signatures.

💡 Hint

Consider the strictness of requiring multiple Attestors in a policy.

Binary Authorization requires that all specified Attestors approve the image for deployment to proceed.

✅ Best Practice

expert

Best Practice for Managing Binary Authorization Keys

Which practice is best for managing signing keys used by Binary Authorization Attestors to ensure security and operational reliability?

A Share signing keys publicly to allow easy verification by all developers.

B Use the same signing key indefinitely to avoid deployment failures.

C Rotate signing keys regularly and store private keys securely using Cloud KMS.

D Store private signing keys on developer laptops for quick access.

💡 Hint

Think about key security and operational continuity.

Regular key rotation and secure storage using Cloud KMS reduce risk of key compromise and ensure trusted signing.

Practice

1. What is the main purpose of Binary Authorization in Google Cloud?

easy

A. To allow only trusted container images to run

B. To speed up container deployment

C. To monitor network traffic between containers

D. To automatically scale container clusters

Solution

1. Step 1: Understand Binary Authorization's role

   Binary Authorization is designed to protect cloud environments by ensuring only trusted container images are deployed.

2. Step 2: Identify the main function

   It uses policies and signatures to verify container images before they run, preventing untrusted code execution.

3. Final Answer:

   To allow only trusted container images to run -> Option A

4. Quick Check:

   Binary Authorization = Trusted container enforcement [OK]

Hint: Binary Authorization controls which containers can run [OK]

Common Mistakes:

• Confusing it with scaling or monitoring tools
• Thinking it speeds up deployment
• Assuming it manages network traffic

2. Which of the following is the correct way to enable Binary Authorization on a Google Kubernetes Engine (GKE) cluster?

easy

A. gcloud container clusters create my-cluster --enable-binauthz

B. gcloud container clusters create my-cluster --enable-auth-binary

C. gcloud container clusters create my-cluster --enable-binary-auth

D. gcloud container clusters create my-cluster --enable-binary-authorization

Solution

1. Step 1: Recall the correct flag for enabling Binary Authorization

   The official gcloud command uses the flag --enable-binary-authorization to enable this feature on a GKE cluster.

2. Step 2: Compare options

   Only gcloud container clusters create my-cluster --enable-binary-authorization uses the exact correct flag syntax; others are incorrect or invalid flags.

3. Final Answer:

   gcloud container clusters create my-cluster --enable-binary-authorization -> Option D

4. Quick Check:

   Enable Binary Authorization flag = --enable-binary-authorization [OK]

Hint: Look for the full phrase 'binary-authorization' in the flag [OK]

Common Mistakes:

• Using shortened or incorrect flag names
• Mixing up flag order or syntax
• Assuming 'binauthz' is the flag

3. Consider this policy snippet for Binary Authorization:

{
  "attestors": ["projects/my-project/attestors/my-attestor"],
  "defaultAdmissionRule": {
    "enforcementMode": "ENFORCED",
    "requireAttestationsBy": ["projects/my-project/attestors/my-attestor"]
  }
}

What happens if a container image is not signed by the specified attestor?

medium

A. The container image will be deployed but logged

B. The container image will be blocked from deployment

C. The container image will be deployed without checks

D. The container image will be automatically signed

Solution

1. Step 1: Analyze the enforcement mode

   The policy sets "enforcementMode" to "ENFORCED", meaning only images meeting the policy are allowed.

2. Step 2: Check attestation requirement

   The policy requires attestations by the specified attestor. Unsigned images do not meet this requirement.

3. Final Answer:

   The container image will be blocked from deployment -> Option B

4. Quick Check:

   Enforced mode + missing signature = block deployment [OK]

Hint: Enforced mode means no unsigned images allowed [OK]

Common Mistakes:

• Confusing enforcement with audit mode
• Thinking unsigned images are allowed with logs
• Assuming automatic signing happens

4. You configured Binary Authorization but your container deployments are failing unexpectedly. Which of the following is a likely cause?

medium

A. The attestor's public key is not correctly configured

B. The cluster does not have enough CPU resources

C. The container image is too large

D. The network firewall blocks container traffic

Solution

1. Step 1: Identify Binary Authorization failure reasons

   Binary Authorization failures often happen if the attestor's public key is missing or misconfigured, preventing signature verification.

2. Step 2: Eliminate unrelated causes

   CPU resources, image size, and network firewall issues do not directly cause Binary Authorization failures.

3. Final Answer:

   The attestor's public key is not correctly configured -> Option A

4. Quick Check:

   Signature verification fails if attestor key is wrong [OK]

Hint: Check attestor keys first when deployments fail [OK]

Common Mistakes:

• Blaming resource or network issues for auth failures
• Ignoring attestor key setup
• Assuming image size affects authorization

5. You want to test your Binary Authorization policy without blocking any container deployments. Which mode should you use and why?

hard

A. Disabled mode, to turn off Binary Authorization temporarily

B. Enforced mode, to block all untrusted images immediately

C. Audit mode, to log policy violations without blocking deployments

D. Strict mode, to require multiple attestations

Solution

1. Step 1: Understand Binary Authorization modes

   Audit mode allows policy violations to be logged but does not block container deployments, ideal for testing.

2. Step 2: Compare other modes

   Enforced mode blocks untrusted images, Disabled mode turns off checks, and Strict mode is not a standard mode.

3. Final Answer:

   Audit mode, to log policy violations without blocking deployments -> Option C

4. Quick Check:

   Audit mode = test without blocking [OK]

Hint: Use audit mode to test policies safely [OK]

Common Mistakes:

• Confusing audit with enforced mode
• Thinking disabled mode logs violations
• Assuming strict mode exists