Google Cloud Professional Cloud DevOps Engineer — Question 110

You are building and running client applications in Cloud Run and Cloud Functions. Your client requires that all logs must be available for one year so that the client can import the logs into their logging service. You must minimize required code changes. What should you do?

Answer options

• A. Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods.
• B. Configure Identity and Access Management (IAM) policies to create a least privilege model on your GKE clusters.
• C. Use Binary Authorization to attest images during your CI/CD pipeline.
• D. Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images.

Correct answer: C

Explanation

The correct answer is C because using Binary Authorization allows you to ensure that only trusted images are deployed, which is essential for maintaining the integrity of your application logs. The other options focus on security aspects unrelated to log retention, such as monitoring vulnerabilities (A), managing access permissions (B), and analyzing container images (D), which do not directly assist in meeting the logging requirements specified by the client.