PCSE Practice Question: Managing Operations in a Cloud Solution Environment
An organization uses Binary Authorization with a GKE cluster that enforces attestation. A developer builds a container and pushes it to Artifact Registry. The image must be signed before it can be deployed. Which steps are required to allow this image to run on the cluster?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign the image using Cloud KMS and an attestor, then create a signed attestation in Container Analysis, and deploy the image.
Binary Authorization requires a signed attestation from a trusted attestor, stored in Cloud KMS. The image must be signed using a private key associated with the attestor, and the attestation is typically stored as a note in Container Analysis. Simply having a vulnerability scan or pushing without signing will not satisfy the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Push the image to Artifact Registry and allow the Binary Authorization policy to automatically sign it.
Why it's wrong here
Binary Authorization does not automatically sign images; signing must be done separately.
- ✗
Configure the cluster to allow all images by setting the policy to 'Allow All' for the developer's namespace.
Why it's wrong here
This bypasses the attestation requirement, which is not the intended solution.
- ✓
Sign the image using Cloud KMS and an attestor, then create a signed attestation in Container Analysis, and deploy the image.
Why this is correct
This is the correct workflow: sign the image digest with the attestor's key, store the attestation as a note in Container Analysis, and the policy will verify it.
- ✗
Use the Binary Authorization API to create an attestation by specifying the image URL and the attestor, then deploy.
Why it's wrong here
An attestation must be cryptographically signed using the attestor's key; simply creating an API object without signing will not satisfy the policy.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.