Container vulnerability scanning in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Container Vulnerability Scanning in GCP

Which GCP service is primarily used to automatically scan container images for vulnerabilities when they are pushed to Container Registry or Artifact Registry?

A Container Analysis

B Cloud Run

C Cloud Functions

D Cloud Build

💡 Hint

Think about the service that stores metadata and security findings about container images.

Container Analysis is the GCP service that automatically scans container images stored in Container Registry or Artifact Registry and provides vulnerability reports.

❓ Configuration

intermediate

Configuring Vulnerability Scanning for Artifact Registry

You want to ensure that all container images pushed to Artifact Registry are scanned for vulnerabilities automatically. Which configuration step is required?

A Manually run vulnerability scans using Cloud Build after pushing images.

B Enable the Container Analysis API and set up Artifact Registry to trigger scans on image push.

C Enable Cloud Run to scan images automatically on deployment.

D Configure Cloud Functions to scan images after deployment.

💡 Hint

Automatic scanning requires enabling a specific API and integration with Artifact Registry.

Enabling the Container Analysis API and configuring Artifact Registry to trigger scans on image push ensures automatic vulnerability scanning.

❓ Architecture

advanced

Designing a Secure Container Deployment Pipeline

You are designing a CI/CD pipeline on GCP that builds container images, scans them for vulnerabilities, and only deploys images that pass the scan. Which architecture best enforces this security requirement?

A Use Cloud Functions to scan images after deployment and rollback if vulnerabilities are found.

B Use Cloud Run to build and deploy images directly without scanning.

C Use Artifact Registry to build images and deploy them without scanning.

D Use Cloud Build to build images, Container Analysis to scan, and Cloud Deploy with a policy gate that blocks deployment of vulnerable images.

💡 Hint

Think about integrating scanning results into deployment gating.

Cloud Build builds images, Container Analysis scans them, and Cloud Deploy can enforce policies to block deployment of vulnerable images, ensuring security in the pipeline.

❓ security

advanced

Interpreting Vulnerability Scan Results

After scanning a container image with Container Analysis, you receive a report showing vulnerabilities with severity levels: HIGH, MEDIUM, and LOW. Which action aligns best with security best practices?

A Deploy images only if no vulnerabilities of any severity are found.

B Ignore all vulnerabilities below HIGH severity and deploy images anyway.

C Immediately block deployment if any HIGH severity vulnerabilities are found, but allow MEDIUM and LOW after review.

D Deploy images regardless of vulnerabilities but monitor logs for issues.

💡 Hint

Consider risk levels and practical deployment constraints.

Blocking deployment on HIGH severity vulnerabilities while reviewing MEDIUM and LOW is a balanced security approach that reduces risk without blocking all deployments.

❓ service_behavior

expert

Behavior of Container Analysis on Image Updates

When a new version of a container image is pushed to Artifact Registry, how does Container Analysis handle vulnerability scanning and reporting?

A It automatically scans the new image version and updates the vulnerability report without affecting previous versions.

B It rescans all previous image versions and merges reports into one summary.

C It requires manual trigger to scan the new image version.

D It deletes previous vulnerability reports and replaces them with the new image's report.

💡 Hint

Think about how scanning is version-specific and automated.

Container Analysis automatically scans each new image version independently and maintains separate vulnerability reports per version.