Professional Cloud Security EngineerManaging operationsMedium
A development team is deploying a new web application to Google Kubernetes Engine (GKE). As part of their security best practices, they want to automatically scan their container images for known vulnerabilities before deployment. Which Google Cloud service can help them achieve this by integrating with their CI/CD pipeline?
- AArtifact Analysis
- BCloud Build with custom scripts
- CContainer Threat Detection (CTD)
- DWeb Security Scanner
Show answer & explanationAnswer & explanation
Correct answer: A. Artifact Analysis
Artifact Analysis (formerly Container Analysis) provides vulnerability scanning for container images stored in Container Registry or Artifact Registry. It integrates with CI/CD pipelines to automatically scan images for known vulnerabilities during the build or push process.
Why the other options are wrong
- B. While custom scripts could be used, Artifact Analysis provides a managed, integrated solution specifically for container image vulnerability scanning.
- C. Container Threat Detection focuses on runtime threats within GKE clusters, not pre-deployment image scanning.
- D. Web Security Scanner focuses on identifying vulnerabilities in deployed web applications, not container images.
Artifact Analysis
A Google Cloud service that provides vulnerability scanning, metadata management, and policy enforcement for software artifacts, particularly container images, stored in Container Registry or Artifact Registry.
- Scans container images for known vulnerabilities.
- Integrates with CI/CD pipelines.
- Supports various vulnerability databases (e.g., OSV, CVE).
- Helps enforce security policies for artifacts.
Memory trick: Artifact Analysis inspects your container 'artifacts' for any hidden 'vulnerabilities'.