You build images with Cloud Build, store them in Artifact Registry, and deploy to production with Cloud Deploy. How do you ensure only secure images reach production?

Binary Authorization is the correct choice because it enforces policies at deployment time, ensuring only trusted, signed images can be deployed to production environments. This creates a strong security gate. Cloud Armor protects running services from external threats, not the image itself before deployment. Artifact Analysis scans for vulnerabilities but doesn't prevent deployment of unapproved images; it provides information. Cloud KMS encrypts images, which is good for data at rest, but doesn't enforce deployment policies based on image trustworthiness. Secret Manager is for storing secrets, not for managing and deploying container images.