Google PCA Designing for Security and Compliance Practice Question
An organization wants to enforce that all container images deployed to their Google Kubernetes Engine (GKE) clusters are signed and have passed a vulnerability scan. Which GCP service should they use to enforce this policy?
⚠ Common exam trap
PCA often tests the difference between services that scan images (Artifact Registry/Container Analysis) and the service that enforces deployment-time policy (Binary Authorization); candidates frequently pick the scanning service instead of the enforcement service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Binary Authorization
Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed to GKE or Cloud Run. It works by requiring attestations (cryptographically signed proofs) that images have been built by a trusted builder and passed required checks such as vulnerability scanning. If an image lacks the required attestation, the admission controller rejects the deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Build
Why it's wrong here
Cloud Build compiles and packages images; it cannot block unsigned or unscanned images from being admitted to a cluster. It is tempting because it can run vulnerability scans during builds, and would be correct for automating image creation and CI pipelines.
- ✗
Artifact Registry
Why it's wrong here
Artifact Registry stores and scans images but does not itself enforce admission policy on GKE clusters. It is tempting because it performs vulnerability scanning and signing support, and would be correct for hosting and managing container artefacts.
- ✗
IAM
Why it's wrong here
IAM governs who may call Google Cloud APIs; it cannot evaluate image signatures or scan results at deployment time. It is tempting because IAM controls cluster access, and would be correct for restricting which principals can create or modify GKE resources.
- ✓
Binary Authorization
Why this is correct
Binary Authorization enforces deploy-time attestations on GKE, admitting only images signed by trusted authorities and carrying vulnerability-scan attestations. This directly satisfies the stem's requirement that images be both signed and scanned before deployment, blocking non-compliant images at admission rather than merely detecting them afterwards.
Go deeper
Related to this question
Learn chapter
Virtual Machine Instances in Compute Engine
Key term
Binary Authorization
Binary Authorization is a security control that ensures only trusted container images are deployed in a Kubernetes or cloud environment.
Key term
Image
An image is a complete snapshot of a system's operating system, applications, and settings, used to deploy or restore computing environments quickly.
About these practice questions
Courseiva writes every PCA question from scratch — 807 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.