Examkin

Question

Difficulty: HardVulnerability Scanning, Container Security, and Threat Detection

A financial services enterprise is designing a comprehensive container security and threat management architecture on Google Cloud for their Google Kubernetes Engine (GKE) microservices. The lead cloud security architect must select and configure specific Google Cloud security services to meet security enforcement, threat monitoring, and vulnerability scanning requirements across the supply chain and runtime environments. Match each Google Cloud security service on the left with its corresponding architectural requirement on the right.

  • Binary AuthorizationPrevent deployment of container images to GKE clusters unless cryptographically signed by authorized CI/CD build attestors.
  • Artifact Analysis Container ScanningAutomatically scan container images for known OS and language package vulnerabilities upon push to Artifact Registry and continuously re-scan as new CVEs are published.
  • Security Command Center Event Threat DetectionAnalyze stream logs near real-time across the organization to detect suspicious activities such as brute-force attempts or unexpected IAM credential generation.
  • GKE Security Posture DashboardEvaluate GKE workload configurations against security best practices and inspect running container OS vulnerabilities directly within cluster management views.

Answer

Binary Authorization maps to enforcing cryptographic image attestation at deployment time; Artifact Analysis Container Scanning maps to automated image scanning and continuous CVE monitoring in Artifact Registry; Security Command Center Event Threat Detection maps to real-time stream log analysis for threat detection; GKE Security Posture Dashboard maps to auditing workload configuration and container OS vulnerabilities in cluster management views.
Each selected security tool fulfills a specific role in a defense-in-depth container security strategy: Binary Authorization enforces policy checks at GKE deployment time; Artifact Analysis handles vulnerability scanning in Artifact Registry; Event Threat Detection performs log stream threat analysis; and the GKE Security Posture Dashboard delivers runtime workload configuration auditing and vulnerability assessment.

Step-by-Step Solution

1
Evaluate the requirement for preventing unauthorized image deployment to GKE.
Binary Authorization integrates with GKE admission controllers to enforce signature-based attestation checks before container deployment.
Ensures only trusted, signed images built by approved CI/CD pipelines can execute in the cluster.
2
Determine the service for registry-level image vulnerability scanning.
Artifact Analysis automatically scans images stored in Artifact Registry and maintains an updated CVE status through continuous scanning.
Provides early detection of package vulnerabilities prior to container deployment.
3
Identify the organization-wide threat detection service utilizing log streams.
Security Command Center Event Threat Detection parses log streams in near real-time to identify threat signatures.
Detects suspicious security events across Google Cloud resources without needing container-level agent installation.
4
Match the cluster-native workload security posture and configuration scanner.
GKE Security Posture Dashboard surfaces configuration risks and runtime vulnerability assessments natively within GKE.
Gives cluster administrators direct visibility into Kubernetes workload vulnerabilities and compliance drift.

Key Concept

Mapping Google Cloud container security, vulnerability scanning, and threat detection services to supply chain and runtime security requirements.
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic