Answer-first summary for fast verification
Answer: Enable Binary Authorization on the existing Cloud Run service., Set the organization policy constraint constraints/run.allowedBinaryAuthorizationPolicies to the list or allowed Binary Authorization policy names.
The question requires ensuring only trusted container images are deployed on Cloud Run, with container vulnerability scanning already enabled. Option A (Enable Binary Authorization on the existing Cloud Run service) is correct because Binary Authorization enforces policies that specify which container images are allowed, directly addressing the requirement. Option B (Set the organization policy constraint constraints/run.allowedBinaryAuthorizationPolicies to the list of allowed Binary Authorization policy names) is correct as it enforces Binary Authorization policies at the organization level, ensuring compliance across Cloud Run services. Option C is incorrect as it applies to Kubernetes clusters, not Cloud Run. Option D is unnecessary and not a standard approach; breakglass is for emergency overrides, not primary enforcement. Option E is incorrect because constraints/compute.trustedImageProjects is specific to Compute Engine, not Cloud Run. The community discussion strongly supports AB (86% consensus), with upvoted comments citing official Google documentation and clarifying that E is for Compute Engine, not Cloud Run.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
You want to enforce that only trusted container images can be deployed to Cloud Run. Your environment already has container vulnerability scanning enabled. Which two actions should you take?
A
Enable Binary Authorization on the existing Cloud Run service.
B
Set the organization policy constraint constraints/run.allowedBinaryAuthorizationPolicies to the list or allowed Binary Authorization policy names.
C
Enable Binary Authorization on the existing Kubernetes cluster.
D
Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
E
Set the organization policy constraint constraints/compute.trustedImageProjects to the list of projects that contain the trusted container images.
No comments yet.