Examkin

Question

Difficulty: Very hardVulnerability Scanning, Container Security, and Threat Detection

An enterprise financial corporation is migrating its containerized workloads to Google Kubernetes Engine (GKE). To comply with strict regulatory frameworks (PCI-DSS and SOC 2), the Lead Cloud Architect must implement an automated end-to-end container security governance model. The architecture must enforce the following requirements:
1. All container images stored in Artifact Registry must undergo continuous scanning for OS and language package vulnerabilities.
2. Only container images built by the official CI/CD pipeline and cryptographically signed by authorized attestors can be deployed to production GKE clusters.
3. Unauthorized or unverified container deployments must be automatically blocked at the Kubernetes API server admission control layer.
4. Near real-time runtime threat detection must monitor container behavior and GKE audit logs without installing third-party agents on node virtual machines.

Which architectural strategy should the Cloud Architect implement to fulfill all security requirements while minimizing operational complexity?

  1. Enable Container Analysis for continuous vulnerability scanning in Artifact Registry. Enforce a Binary Authorization policy on GKE requiring cryptographic attestations signed via Cloud KMS keys. Activate Security Command Center Premium to utilize Event Threat Detection and Container Threat Detection.Answer
  2. B
    Grant the Owner primitive role to the CI/CD service account to ensure full administrative access for container deployment while bypassing Binary Authorization policies, and rely on custom Cloud Logging export sinks for runtime threat analysis.
  3. C
    Build and maintain a custom Kubernetes mutating admission webhook to inspect container image signatures, and secure the GKE control plane by removing all control plane authorized network ranges without establishing private endpoints.
  4. D
    Configure a VPC Service Controls security perimeter around Artifact Registry and use custom IAM roles to restrict push access, relying entirely on network perimeter isolation to block unauthorized container image deployments to GKE.

Answer

The correct architecture integrates Artifact Registry vulnerability scanning via Container Analysis, enforces Binary Authorization with Cloud KMS attestations for GKE admission control, and leverages Security Command Center Premium for agentless Container Threat Detection and Event Threat Detection.
The solution combining Container Analysis, Binary Authorization, and Security Command Center (SCC) Premium provides a complete, cloud-native supply chain and runtime security model. Artifact Registry uses Container Analysis for automated vulnerability scanning. Binary Authorization enforces image signature policy checks backed by Cloud KMS at GKE deployment admission. SCC Premium delivers agentless runtime threat detection across GKE nodes and audit logs through Container Threat Detection and Event Threat Detection.

Step-by-Step Solution

1
Evaluate continuous vulnerability scanning for Artifact Registry.
Container Analysis automatically scans images stored in Artifact Registry and monitors for new CVE disclosures continuously.
Meets requirement 1 without requiring manual trigger scripts.
2
Establish supply chain security and deployment blocking controls.
Binary Authorization integrates natively with the GKE API server as an admission controller to evaluate signed attestations against policy prior to pod creation.
Meets requirements 2 and 3 by blocking unsigned or tampered images automatically.
3
Select runtime threat detection tools.
Security Command Center Premium includes built-in agentless detection (Container Threat Detection and Event Threat Detection) for analyzing node memory, container binaries, and GKE audit logs.
Meets requirement 4 without adding third-party daemonsets or VM agent overhead.

Key Concept

GCP Container Security Architecture (Binary Authorization, Container Analysis, and SCC Premium Threat Detection)
Estimated Time:3m 0s
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic