Question 270
A back-office container service should be invoked only by scheduled jobs from a controlled service account, not by anonymous internet clients. Which limitation must be considered before claiming the issue is fully resolved?
Explanation
Correct Answer
Private networking alone does not substitute for verifying an application caller. This caution prevents extrapolating beyond the specific evidence or product boundary. Serverless identity boundaries are separate from container image provenance. The unresolved point should be tested using Cloud Run service IAM, identity tokens, ingress settings and request audit traces rather than assuming a working interface proves full compliance or resilience.
Incorrect Answers
Cloud Run container images cannot be invoked by unauthorized identities if the job is periodic. This limitation is framed as a blanket exception, but the case requires a different, narrower caution. The relevant boundary is that private networking alone does not substitute for verifying an application caller. Serverless identity boundaries are separate from container image provenance. Inspect Cloud Run service IAM, identity tokens, ingress settings and request audit traces.
An identity token is sufficient even if the principal lacks invocation permission. The proposed claim mistakes an incomplete signal or product feature for a universal guarantee. The relevant boundary is that private networking alone does not substitute for verifying an application caller. Serverless identity boundaries are separate from container image provenance. Inspect Cloud Run service IAM, identity tokens, ingress settings and request audit traces.
A Cloud Scheduler cron schedule cannot be imitated by an unauthorized actor. This claim exceeds the evidence and ignores an important risk or operational dependency. The relevant boundary is that private networking alone does not substitute for verifying an application caller. Serverless identity boundaries are separate from container image provenance. Inspect Cloud Run service IAM, identity tokens, ingress settings and request audit traces.