Container vulnerability scanning in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Container Vulnerability Scanning in GCP

Which GCP service is primarily used to automatically scan container images for vulnerabilities when they are pushed to Container Registry or Artifact Registry?

A Container Analysis

B Cloud Run

C Cloud Functions

D Cloud Build

💡 Hint

Think about the service that stores metadata and security findings about container images.

Container Analysis is the GCP service that automatically scans container images stored in Container Registry or Artifact Registry and provides vulnerability reports.

❓ Configuration

intermediate

Configuring Vulnerability Scanning for Artifact Registry

You want to ensure that all container images pushed to Artifact Registry are scanned for vulnerabilities automatically. Which configuration step is required?

A Manually run vulnerability scans using Cloud Build after pushing images.

B Enable the Container Analysis API and set up Artifact Registry to trigger scans on image push.

C Enable Cloud Run to scan images automatically on deployment.

D Configure Cloud Functions to scan images after deployment.

💡 Hint

Automatic scanning requires enabling a specific API and integration with Artifact Registry.

Enabling the Container Analysis API and configuring Artifact Registry to trigger scans on image push ensures automatic vulnerability scanning.

❓ Architecture

advanced

Designing a Secure Container Deployment Pipeline

You are designing a CI/CD pipeline on GCP that builds container images, scans them for vulnerabilities, and only deploys images that pass the scan. Which architecture best enforces this security requirement?

A Use Cloud Functions to scan images after deployment and rollback if vulnerabilities are found.

B Use Cloud Run to build and deploy images directly without scanning.

C Use Artifact Registry to build images and deploy them without scanning.

D Use Cloud Build to build images, Container Analysis to scan, and Cloud Deploy with a policy gate that blocks deployment of vulnerable images.

💡 Hint

Think about integrating scanning results into deployment gating.

Cloud Build builds images, Container Analysis scans them, and Cloud Deploy can enforce policies to block deployment of vulnerable images, ensuring security in the pipeline.

❓ security

advanced

Interpreting Vulnerability Scan Results

After scanning a container image with Container Analysis, you receive a report showing vulnerabilities with severity levels: HIGH, MEDIUM, and LOW. Which action aligns best with security best practices?

A Deploy images only if no vulnerabilities of any severity are found.

B Ignore all vulnerabilities below HIGH severity and deploy images anyway.

C Immediately block deployment if any HIGH severity vulnerabilities are found, but allow MEDIUM and LOW after review.

D Deploy images regardless of vulnerabilities but monitor logs for issues.

💡 Hint

Consider risk levels and practical deployment constraints.

Blocking deployment on HIGH severity vulnerabilities while reviewing MEDIUM and LOW is a balanced security approach that reduces risk without blocking all deployments.

❓ service_behavior

expert

Behavior of Container Analysis on Image Updates

When a new version of a container image is pushed to Artifact Registry, how does Container Analysis handle vulnerability scanning and reporting?

A It automatically scans the new image version and updates the vulnerability report without affecting previous versions.

B It rescans all previous image versions and merges reports into one summary.

C It requires manual trigger to scan the new image version.

D It deletes previous vulnerability reports and replaces them with the new image's report.

💡 Hint

Think about how scanning is version-specific and automated.

Container Analysis automatically scans each new image version independently and maintains separate vulnerability reports per version.

Practice

1. What is the main purpose of container vulnerability scanning in Google Cloud Platform?

easy

A. To find security issues in container images before deployment

B. To increase the speed of container startup

C. To reduce the size of container images

D. To monitor container CPU usage

Solution

1. Step 1: Understand container vulnerability scanning

   It is a process to detect security problems in container images.

2. Step 2: Identify the main goal in GCP context

   GCP uses scanning to find vulnerabilities before containers run, keeping apps safe.

3. Final Answer:

   To find security issues in container images before deployment -> Option A

4. Quick Check:

   Purpose = Find security issues [OK]

Hint: Focus on security purpose, not performance or size [OK]

Common Mistakes:

• Confusing scanning with performance monitoring
• Thinking scanning reduces image size
• Assuming scanning manages CPU usage

2. Which gcloud command correctly scans a container image named gcr.io/my-project/my-image:latest for vulnerabilities?

easy

A. gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities

B. gcloud container images scan gcr.io/my-project/my-image:latest

C. gcloud container images list-tags gcr.io/my-project/my-image:latest --vulnerabilities

D. gcloud container images scan-vulnerabilities gcr.io/my-project/my-image:latest

Solution

1. Step 1: Recall correct gcloud syntax for vulnerability scanning

   The command to view vulnerabilities is gcloud container images describe with --show-vulnerabilities.

2. Step 2: Check each option's validity

   gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities matches the correct syntax; others are invalid or do not exist.

3. Final Answer:

   gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities -> Option A

4. Quick Check:

   Correct command = describe + --show-vulnerabilities [OK]

Hint: Use 'describe' with '--show-vulnerabilities' to scan images [OK]

Common Mistakes:

• Using non-existent 'scan' command
• Confusing 'list-tags' with scanning
• Omitting the '--show-vulnerabilities' flag

3. Given the command gcloud container images describe gcr.io/my-project/app:1.0 --show-vulnerabilities, what output should you expect if the image has no vulnerabilities?

medium

A. A list of vulnerabilities with severity levels

B. An error saying image not found

C. A summary of image size and tags only

D. An empty vulnerabilities section or message indicating no issues

Solution

1. Step 1: Understand the command's purpose

   The command shows vulnerability details for the specified image.

2. Step 2: Predict output when no vulnerabilities exist

   The output will show an empty vulnerabilities section or a message indicating no issues found.

3. Final Answer:

   An empty vulnerabilities section or message indicating no issues -> Option D

4. Quick Check:

   No vulnerabilities = empty or no issues message [OK]

Hint: No vulnerabilities means empty or no issues message [OK]

Common Mistakes:

• Expecting a list when none exist
• Confusing errors with no vulnerabilities
• Looking for unrelated image metadata

4. You run gcloud container images describe gcr.io/my-project/app:latest --show-vulnerabilities= but get an error: ERROR: (gcloud.container.images.describe) argument --show-vulnerabilities: Expected bool value. What is the likely cause?

medium

A. The image name is incorrect

B. You need to authenticate with gcloud first

C. You forgot to provide a value for --show-vulnerabilities flag

D. The command does not support vulnerability scanning

Solution

1. Step 1: Analyze the error message

   The error says the flag --show-vulnerabilities expects a boolean value (true or false).

2. Step 2: Identify the command mistake

   The flag was used without specifying true or false, causing the error.

3. Final Answer:

   You forgot to provide a value for --show-vulnerabilities flag -> Option C

4. Quick Check:

   Flag needs true/false value [OK]

Hint: Always provide true or false for boolean flags [OK]

Common Mistakes:

• Omitting the boolean value for flags
• Assuming image name causes this error
• Ignoring authentication errors

5. You want to automate vulnerability scanning for all container images pushed to your GCP project. Which approach best ensures every new image is scanned automatically?

hard

A. Manually run gcloud container images describe --show-vulnerabilities after each push

B. Set up Container Analysis API for automatic scanning of images on push

C. Use Stackdriver logs to detect image pushes and scan images manually

D. Schedule a daily cron job to scan all images regardless of push events

Solution

1. Step 1: Understand automation needs for scanning

   Automatic scanning requires integration with image push events.

2. Step 2: Evaluate options for automatic scanning

   Container Analysis API automatically scans images on push, ensuring no image is missed.

3. Step 3: Compare alternatives

   Manual commands or cron jobs are less efficient and risk missing images or delays.

4. Final Answer:

   Set up Container Analysis API for automatic scanning of images on push -> Option B

5. Quick Check:

   Automate scanning on push = Container Analysis API [OK]

Hint: Use triggers to scan images automatically on push [OK]

Common Mistakes:

• Relying on manual scanning after push
• Using logs instead of triggers for automation
• Scheduling scans without event triggers