Your application named ecom-web-app is deployed in three GKE clusters: ecom-web-app-dev, ecom-web-app-qa, and ecom-web-app-prod. You need to ensure that only trusted container images are deployed to the ecom-web-app-prod GKE cluster in the production environment while following Google-recommended practices. What should you do?

A. Set up Binary Authorization, and define cluster-specific rules in clusterAdmissionRules nodes in the policy YAML file. B. Set up Binary Authorization, and exempt any container images that are not deployed to the ecom-web-app-prod GKE cluster. C. Set up an image verification process that scans the container images in Artifact Registry for vulnerabilities and tags the image versions that fail the scan as untrusted. D. Set up an image verification process by using Cloud Functions where the function is invoked when a container image is built in Cloud Build and ensures that only trusted container images are stored in Artifact Registry.