How to Secure an ML Model Deployment Pipeline Against Supply Chain Attacks?
Your organization is building a real-time recommendation engine using ML models that process live user activity data stored in BigQuery and Cloud Storage. Each new model developed is saved to Artifact Registry. This new system deploys models to Google Kubernetes Engine, and uses Pub/Sub for message queues. Recent industry news have been reporting attacks exploiting ML model supply chains. You need to enhance the security in this serverless architecture, specifically against risks to the development and deployment pipeline. What should you do?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests recognition of cloud-native supply chain defenses, with the common trap being misdirection toward training data sanitization or runtime network monitoring instead of artifact integrity.
Securing ML model supply chains requires strict artifact validation and pipeline enforcement. This page establishes why Binary Authorization and automated container scanning are the definitive controls for your CI/CD workflow.
Option D is frequently selected due to keywords like real-time and anomaly detection, but it incorrectly targets Cloud Run and proposes network controls that cannot prevent compromised containers from entering the cluster.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The scenario emphasizes securing the development and deployment pipeline against supply chain attacks targeting ML models. Binary Authorization acts as a policy gatekeeper that validates container images stored in Artifact Registry before they reach GKE, directly preventing compromised artifacts from entering production. Pairing this with automated vulnerability scanning ensures that known weaknesses are identified and remediated prior to deployment, aligning perfectly with Google’s recommended DevSecOps practices.Why the Other Options Are Wrong
Option B focuses on training data sanitation, which addresses data poisoning rather than artifact supply chain integrity. Option C suggests limiting dependencies and rotating encryption keys, which are general hygiene practices but do not enforce pipeline governance or prevent malicious image pushes. Option D incorrectly references Cloud Run, which is absent from the architecture, and proposes network-level controls that cannot stop a compromised container image already inside the cluster.Community Comment Notes
Several learners correctly identified the pipeline focus, noting that "Supply chain risks happen by exploiting vulnerabilities in the images" and emphasizing pre-deployment validation. Others initially leaned toward network monitoring but quickly recognized that runtime anomaly detection does not mitigate upstream artifact tampering. The consensus accurately reflects that governance tools must precede runtime defenses in this context.Official Reference
Exam Strategy
Always map the question's architectural components to the exact service offering; if the scenario names GKE and Artifact Registry, ignore options referencing unrelated services like Cloud Run. Prioritize pipeline governance tools over runtime defenses when asked about deployment-stage risks.
Frequently Asked Questions
Why isn't data sanitization the right choice for supply chain security?
Data sanitization prevents training-phase poisoning, whereas supply chain attacks target build artifacts and deployment pipelines. The question explicitly asks about the development and deployment stages.
Does Binary Authorization replace container scanning?
No. Scanning identifies known vulnerabilities in images, while Binary Authorization enforces admission policies to block unauthorized or unscanned images from deploying to GKE.