Examkin

Question

Difficulty: HardVulnerability Scanning, Container Security, and Threat Detection

An autonomous vehicle telemetry enterprise runs containerized ingestion workloads on Google Kubernetes Engine (GKE) and stores build artifacts in Artifact Registry. The cloud security team requires an end-to-end security control strategy to satisfy three goals: automatically detect vulnerabilities in container images pushed to the registry, prevent non-compliant or unverified images from executing in production clusters, and detect runtime threats such as reverse shells or unauthorized processes inside active pods. Which TWO security controls should the architect implement to satisfy these requirements? (Select TWO.)

  1. Enable Artifact Registry vulnerability scanning and configure Binary Authorization on GKE to enforce attestation-based deployment policies.Answer
  2. Enable Security Command Center Premium with Container Threat Detection to monitor container runtime activity and pod behavior for threats.Answer
  3. C
    Configure VPC Service Controls around GKE clusters to isolate registry access and automatically inspect container binaries during image pulling.
  4. D
    Assign the primitive Owner role to the GKE node service account so Container Analysis can repair vulnerable layers in running pods.

Answer

The architect should enable Artifact Registry vulnerability scanning alongside Binary Authorization on GKE to secure the container supply chain, and enable Security Command Center Premium with Container Threat Detection for runtime anomaly monitoring.
Securing containerized workloads requires securing both the build/deploy supply chain and the runtime environment. Enabling Artifact Registry vulnerability scanning detects software flaws when container images are stored. Binary Authorization ensures that only images signed by trusted authorities and verified by scanners are allowed to run on GKE. For runtime protection, Security Command Center Premium's Container Threat Detection monitors pod execution and kernel events out-of-band to catch malicious runtime activity without introducing performance overhead.

Step-by-Step Solution

1
Analyze build and deployment security requirements for container images
Identified Artifact Registry Vulnerability Scanning to detect image vulnerabilities upon push, and Binary Authorization to enforce deploy-time attestations on GKE.
Binary Authorization validates container signatures against security policies before pod creation, while scanning ensures software flaws are surfaced automatically upon image storage.
2
Analyze container runtime threat detection requirements
Identified Security Command Center Premium Container Threat Detection.
Container Threat Detection directly monitors node kernel telemetry and pod runtime activity to discover suspicious execution events like reverse shells or unexpected processes.
3
Evaluate incorrect network and identity configurations
Rejected VPC Service Controls for image scanning and primitive IAM role assignments for node service accounts.
VPC Service Controls focus on network data boundary exfiltration prevention, and primitive Owner grants breach least-privilege security standards.

Key Concept

Multi-layered GCP container security using Artifact Registry vulnerability scanning, Binary Authorization attestation policy, and Security Command Center Container Threat Detection.
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic