PCSE Practice Question: Managing Operations in a Cloud Solution Environment
A DevOps team wants to enforce that only container images signed by a specific authority can be deployed in a GKE cluster. They plan to use Binary Authorization. Which configuration is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an attestor, generate a key pair with Cloud KMS, and configure the policy to require at least one attestation from that attestor
Binary Authorization enforces deployment policies. To require signed images, you create an attestor (e.g., using Cloud KMS) and a policy that requires at least one attestation from that attestor. The policy type must be 'Require attestations' (not 'Allow all' or 'Deny all').
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an attestor and set the policy to 'Deny all' and then add exceptions for signed images
Why it's wrong here
Deny all blocks all images; exceptions would be cumbersome and not the intended approach.
- ✗
Create an attestor and set the policy to 'Allow all' so that signed images are allowed
Why it's wrong here
Allow all allows all images, regardless of attestation.
- ✓
Create an attestor, generate a key pair with Cloud KMS, and configure the policy to require at least one attestation from that attestor
Why this is correct
This is the correct approach: attestor with KMS key, policy requires attestation before deployment.
- ✗
Create a vulnerability scan policy in Artifact Registry to block unsigned images
Why it's wrong here
Artifact Registry vulnerability scanning does not block deployments; it only reports findings.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.