Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A company wants to enforce that only container images built and signed by their CI/CD pipeline can be deployed in their GKE cluster. Which Google Cloud service should they use?
⚠ Common exam trap
The trap is confusing Artifact Analysis (scanning/metadata) with Binary Authorization (enforcement) — candidates pick Artifact Analysis because it deals with images, but only Binary Authorization enforces the signed-image policy at deploy time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Binary Authorization
Binary Authorization is the Google Cloud service that enforces deploy-time policies on GKE, allowing only container images that meet attestation requirements (e.g., signed by the CI/CD pipeline) to be deployed. It integrates with Container Analysis/Artifact Analysis to verify signatures and attestations before admitting a pod.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Artifact Analysis
Why it's wrong here
Artifact Analysis scans container images for known vulnerabilities and OS package issues; a clean scan says nothing about who built or signed the image, so unsigned images pass. It fits vulnerability management in Artifact Registry, not admission control requiring CI/CD signatures.
- ✓
Binary Authorization
Why this is correct
Binary Authorization enforces deploy-time attestations, letting only images signed by your CI/CD pipeline's attestors run in GKE. It satisfies the stem's constraint that solely pipeline-built and pipeline-signed container images be admitted, by validating cryptographic attestations against a defined policy before the admission controller permits the workload.
- ✗
Cloud Audit Logs
Why it's wrong here
Cloud Audit Logs records API activity and admin actions for forensics and compliance; it observes deployments after the fact and cannot block unsigned images. It is the right choice for auditing who deployed what, not for admission-time signature verification.
- ✗
Cloud Security Command Center
Why it's wrong here
Security Command Center aggregates findings, misconfigurations and threat detections across assets; it reports posture rather than gating pod admission, so unsigned images still schedule. It suits centralised vulnerability and threat visibility, not enforcing CI/CD signature provenance at deploy time.
Go deeper
Related to this question
Learn chapter
IAM Policies, Service Accounts, and Auditing
Key term
Binary Authorization
Binary Authorization is a security control that ensures only trusted container images are deployed in a Kubernetes or cloud environment.
Key term
GKE
GKE is Google's managed Kubernetes service that automates deploying, scaling, and managing containerized applications in the cloud.
About these practice questions
Courseiva writes every PCA question from scratch — 807 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.