Prevent deploying container images with known critical vulnerabilities using CI/CD. Which approach should you use?

The correct approach involves using the Container Scanning API for vulnerability detection and integrating it into a CI/CD pipeline. The Container Scanning API (part of Artifact Analysis) automatically scans container images for known vulnerabilities. Programmatically reviewing these results allows for automated decision-making within the CI/CD pipeline. If the image passes vulnerability checks, an attestation is created. Binary Authorization then enforces that only images with this attestation can be deployed, preventing vulnerable images from reaching production. The incorrect options involving Web Security Scanner are wrong because Web Security Scanner is designed for scanning web applications for vulnerabilities like XSS or SQL injection, not for scanning container images for OS package vulnerabilities. While it can identify issues in a running application, it doesn't scan the underlying container image itself. Reviewing logs or the Cloud Console for scan results is less efficient for automated CI/CD than programmatic API interaction.