PCSE Practice Question: Managing Operations in a Cloud Solution Environment
A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.
Binary Authorization requires a policy to enforce attestation. The policy must be set to 'Require Attestations' and attached to the GKE cluster (via a policy binding). Creating the attestor alone is insufficient. The policy can be set at project level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the 'gke-binary-authorization' feature flag on the cluster and update the kubeconfig.
Why it's wrong here
Binary Authorization is enabled via the cluster settings; no feature flag or kubeconfig change is needed.
- ✓
Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.
Why this is correct
The policy must require attestation and be applied to the cluster for enforcement.
- ✗
Create a policy that allows all images and then override it with an admission webhook.
Why it's wrong here
An admission webhook is not needed; Binary Authorization uses its own policy.
- ✗
Configure the container registry to block unsigned images by setting a repository-level policy.
Why it's wrong here
Binary Authorization enforces at the cluster level, not at the registry.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.