Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Google Cloud Certified Associate Cloud Engineer · Google Cloud
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
gVisor is a sandboxing technology that provides an additional layer of isolation between running containers. It's particularly useful in scenarios where containers might be running untrusted or arbitrary code, as it helps in mitigating the risk of kernel exploits. By configuring a node pool with gVisor and specifying runtimeClassName: gvisor in the Pod specifications, each Pod is run within this sandboxed environment, thereby enhancing isolation between the Pods.
• Implementing gVisor can impact the performance of the containers due to the additional layer of abstraction. However, for scenarios requiring high security and isolation, particularly when running arbitrary code, the trade-off can be justified.
A. Binary Authorization: While Binary Authorization is a security control that ensures only trusted container images are deployed on GKE, it doesn't provide isolation between running Pods. It's more about image integrity and compliance. B. Container Analysis API: This API is used for scanning container images for vulnerabilities. While important for security, it doesn't directly contribute to runtime isolation between Pods. D. Using cos_containerd Image: The Container-Optimized OS with containerd (cos_containerd) is a secure choice for the node image in GKE. However, it doesn't provide the same level of isolation for arbitrary code execution in Pods as gVisor. The nodeSelector parameter is used to schedule Pods on specific nodes but doesn't enhance inter-Pod isolation.