Google PCA Designing for Security and Compliance Practice Question
An organization wants to enforce that all container images deployed to their Google Kubernetes Engine (GKE) clusters are signed and have passed a vulnerability scan. Which GCP service should they use to enforce this policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Binary Authorization
Binary Authorization enforces policies that require container images to be signed by trusted authorities and optionally pass vulnerability scans before deployment. Cloud Build can be used to sign images, but the enforcement is done by Binary Authorization. Artifact Registry stores images, and IAM controls access but does not enforce signing policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Build
Why it's wrong here
Cloud Build can sign images but does not enforce policies at deployment time.
- ✗
Artifact Registry
Why it's wrong here
Artifact Registry stores container images but does not enforce deployment policies.
- ✗
IAM
Why it's wrong here
IAM controls who can deploy but does not enforce image signing policies.
- ✓
Binary Authorization
Why this is correct
Binary Authorization is the correct service for enforcing attestation-based policies on container images deployed to GKE.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Binary Authorization
Binary Authorization is a security control that ensures only trusted container images are deployed in a Kubernetes or cloud environment.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.