Question

Your platform team builds container images with Cloud Build and stores them in Artifact Registry before deploying to GKE. Security wants to be automatically notified whenever a newly pushed image contains a known CVE, without requiring developers to trigger manual scans or run third-party scanners in the pipeline. What should you do?

Accepted Answer

Enable Artifact Analysis automatic vulnerability scanning on the Artifact Registry repository and route the resulting Container Scanning findings in Security Command Center to a Pub/Sub notification.

Answer

Add a Cloud Build step that runs an open-source scanner such as Trivy against each image and fails the build if any CVE is found.

Answer

Configure Binary Authorization with a vulnerability attestor so GKE rejects images that have unresolved CVEs at deploy time.

Answer

Create a Cloud Scheduler job that invokes a Cloud Function to pull each image daily and inspect its package manifest for outdated libraries.