Container supply chain security in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Container Image Vulnerability Scanning

Which of the following best describes the purpose of container image vulnerability scanning in a supply chain?

A It encrypts container images to prevent unauthorized access.

B It automatically updates container images to the latest version.

C It monitors container runtime performance metrics.

D It checks container images for known security issues before deployment.

💡 Hint

Think about what security scanning tools do before containers run.

Vulnerability scanning inspects container images for known security flaws before they are deployed, helping prevent vulnerable software from running.

❓ Architecture

intermediate

Securing Container Supply Chain with Binary Authorization

In Google Cloud, which component enforces that only trusted container images are deployed to GKE clusters?

A Cloud CDN

B Cloud Armor

C Binary Authorization

D Cloud Functions

💡 Hint

Consider the service that controls image deployment policies.

Binary Authorization enforces deployment policies ensuring only trusted container images are allowed to run on GKE clusters.

❓ Configuration

advanced

Identifying the Effect of a Binary Authorization Policy

Given this Binary Authorization policy snippet, what will happen if an image is not signed by the trusted authority?

{
  "defaultAdmissionRule": {
    "enforcementMode": "ENFORCED",
    "requireAttestationsBy": ["projects/my-project/attestors/my-attestor"]
  }
}

A The image will deploy but with a warning logged.

B The image deployment will be blocked by Binary Authorization.

C The image will deploy without any checks.

D The image will be automatically signed by Binary Authorization.

💡 Hint

What does enforcementMode ENFORCED imply?

With enforcementMode set to ENFORCED and required attestations specified, images not signed by the trusted attestor will be blocked from deployment.

❓ service_behavior

advanced

Behavior of Container Analysis API in Supply Chain Security

What is the primary role of the Container Analysis API in Google Cloud's container supply chain security?

A It stores and retrieves metadata about container images, including vulnerability and attestation data.

B It automatically patches vulnerabilities in running containers.

C It encrypts container images stored in Container Registry.

D It manages container orchestration and scaling.

💡 Hint

Think about metadata and security information storage.

Container Analysis API provides a centralized place to store and access metadata like vulnerability reports and attestations for container images.

❓ security

expert

Impact of Missing Attestation in a Multi-Stage Supply Chain

In a multi-stage container supply chain using Binary Authorization, what is the impact if an intermediate build stage image lacks a required attestation?

A The final image deployment will be blocked because the supply chain integrity cannot be verified.

B Binary Authorization automatically generates missing attestations for intermediate images.

C The missing attestation is ignored if the final image is signed correctly.

D Only the intermediate image deployment is blocked; the final image deploys normally.

💡 Hint

Consider how Binary Authorization verifies the entire supply chain.

Binary Authorization requires attestations for all stages in the supply chain to ensure integrity. Missing attestations in intermediate stages cause deployment to be blocked.