The city’s enhanced OKE cluster must admit only trusted images from OCIR. Which image-integrity approach is in scope for this developer exam?
Select an answer to reveal the explanation.
Short Explanation
Sign the image with a Vault key like a wax seal, then tell the cluster to accept only sealed images—simple integrity without dragging in the whole security catalog.
Full Explanation
For an enhanced OKE cluster that must admit only trusted images from OCIR, the image-integrity approach in scope for this cloud-native developer exam is to sign container images with a Vault master key and configure the cluster to admit only signed images. Signature verification at admission blocks unsigned or tampered municipal images even when they sit in a registry the cluster can reach, tying trust to cryptographic signing rather than to network location alone.
Enabling OCI WAF and Cloud Guard detectors as the only way to block unsigned images misuses edge/web and posture products for an admission-control problem; they are not the image-signature gate described here. Disabling image pulls and copying binaries onto nodes with SSH abandons declarative cluster deployment and creates unverifiable, hand-maintained node state. Requiring Vulnerability Scanning recipes on every Object Storage bucket addresses object scanning, not container image signature admission on OKE.
Exam caveat: signing without enforcing admission policy still allows unsigned pulls—both signing with the Vault key and cluster configuration to require signatures are required. Operational check: sign a known-good OCIR image with the municipal Vault master key, confirm it deploys, then attempt to deploy an unsigned image and verify the cluster rejects it.