PCSE Practice Question: Managing Operations in a Cloud Solution Environment
A security team is setting up Binary Authorization for their GKE clusters. They want to enforce that only images signed by an approved attestor can be deployed. Which TWO of the following are required for this setup?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an attestor in Binary Authorization.
Binary Authorization requires creating an attestor and associating it with a Cloud KMS key pair for signing verification. The attestor's public key must be added to the Binary Authorization policy. A Container Analysis note is used to store attestations, but it is not a separate requirement for the policy itself; it is used when creating attestations. Disabling vulnerability scanning is not required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an attestor in Binary Authorization.
Why this is correct
Required to define who can attest to an image.
- ✗
Enable Vulnerability Scanning on Artifact Registry.
Why it's wrong here
Not required for Binary Authorization attestation.
- ✗
Disable the default 'Allow All' policy.
Why it's wrong here
The policy must be set to require attestation, not just disable allow all.
- ✗
Create a Container Analysis note for each image.
Why it's wrong here
Notes are used for storing attestations but not a policy requirement.
- ✓
Create a Cloud KMS key pair and associate it with the attestor.
Why this is correct
The attestor's public key is used to verify signatures.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.