To securely deploy workloads and ensure only verified containers run, which actions should you take? (Choose two.)

To ensure only verified containers run, Binary Authorization on GKE is crucial. It enforces deployment policies, preventing unsigned or unapproved images from running. Integrating container signing into your CI/CD pipeline ensures that only images that have passed your quality gates are signed and thus allowed to deploy. Vulnerability scanning in Container Registry (now Artifact Registry) identifies known security issues in your container images. This helps ensure that even verified containers are free from critical vulnerabilities before they are deployed, reducing your attack surface. Configuring Jenkins with Kritis is a specific implementation detail for signing, but Binary Authorization is the Google Cloud service that enforces the policy. Restricting service accounts for deployment is a good security practice but doesn't directly verify container integrity or contents.