Build a GKE container pipeline where only pipeline-built images can deploy and all code/artifacts stay inside your environment to prevent data exfiltration. How should you build the pipeline?

The correct answer ensures maximum security and data residency. A private Cloud Build worker pool prevents public IP access, keeping builds isolated. VPC Service Controls create a security perimeter around your CI/CD components and Artifact Registry, preventing data exfiltration to unauthorized services. Binary Authorization on GKE ensures that only images signed by trusted authorities (like your pipeline) can be deployed, preventing unauthorized or tampered images from running. Incorrect options: Using a default worker pool for Cloud Build allows public IP access, which violates the requirement for keeping all code/artifacts inside your environment and preventing data exfiltration. Encrypting images with CMEK in Artifact Registry is good practice but doesn't prevent data exfiltration from the build process itself or unauthorized deployments to GKE. Storing images in Artifact Registry is correct, but using a default worker pool for Cloud Build still introduces a risk of data exfiltration. While Binary Authorization is good, it doesn't address the build environment's security.