Examkin

Question

Difficulty: MediumVulnerability Scanning, Container Security, and Threat Detection

A logistics software platform runs containerized microservices on Google Kubernetes Engine (GKE). The security architect must ensure that container images in Artifact Registry are continuously monitored for newly discovered vulnerabilities, only verified CI/CD container images can be deployed to production GKE clusters, and runtime container threats are detected without installing third-party agent sidecars on the worker nodes. Which combination of Google Cloud services and configurations meets these requirements?

  1. Enable Continuous Scanning in Artifact Registry, configure Binary Authorization policies on GKE to enforce build attestations, and enable Security Command Center Container Threat Detection.Answer
  2. B
    Enable vulnerability scanning in Artifact Registry, but grant the primitive Owner role to the GKE service account to automate vulnerability mitigation and bypass deployment checks.
  3. C
    Assign the Service Account Admin role to the deployment pipeline service account to allow it to directly manage deployment keys and override Binary Authorization policy checks.
  4. D
    Configure VPC Service Controls perimeters around GKE and Artifact Registry to restrict network access, relying on perimeter security to prevent unauthorized container deployments and data exfiltration without Binary Authorization or Container Threat Detection.

Answer

Enable Continuous Scanning in Artifact Registry, configure Binary Authorization policies on GKE to enforce build attestations, and enable Security Command Center Container Threat Detection.
Continuous Scanning in Artifact Registry automatically monitors stored images against newly disclosed vulnerabilities. Binary Authorization enforces policy checks requiring cryptographic attestations from the CI/CD pipeline before deploying to GKE. Security Command Center Container Threat Detection offers agentless runtime threat detection at the hypervisor level.

Step-by-Step Solution

1
Evaluate vulnerability scanning requirements for container images.
Artifact Registry Continuous Scanning satisfies automated, continuous vulnerability monitoring as CVE databases update.
Standard scanning only analyzes images at push time, whereas Continuous Scanning continuously evaluates stored container images against newly published vulnerabilities.
2
Evaluate deployment control requirements for image provenance.
Binary Authorization enforces attestations signed by trusted authorities during CI/CD before allowing image execution on GKE.
Binary Authorization natively integrates with GKE to prevent unsigned or unvalidated container images from being deployed.
3
Evaluate runtime threat detection requirements.
Security Command Center Container Threat Detection provides agentless monitoring of container runtime anomalies.
Container Threat Detection operates at the host node and hypervisor levels, detecting suspicious process executions and container escapes without agent sidecars.

Key Concept

Multi-layered container security combining automated vulnerability scanning, binary attestation enforcement, and agentless runtime threat detection.
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic