Examkin

Question

Difficulty: MediumVulnerability Scanning, Container Security, and Threat Detection

A healthcare software company is deploying a patient portal microservice on Google Kubernetes Engine (GKE) and storing build images in Artifact Registry. The security architecture team must implement automated security controls to satisfy two key governance requirements: (1) prevent the deployment of container images into the GKE cluster if they contain unresolved critical vulnerabilities, and (2) detect runtime security threats within running containers—such as reverse shells or unexpected binary executions—without installing custom third-party agent software on the underlying GKE node instances. Which Google Cloud solution meets these requirements?

  1. Enable Container Analysis vulnerability scanning with Binary Authorization policies to enforce image deployment rules, and activate Security Command Center Premium Container Threat Detection for agentless runtime monitoring.Answer
  2. B
    Grant the primitive Owner IAM role to the GKE node service account to enable continuous live vulnerability remediation in Artifact Registry, and deploy host-level monitoring daemons to trace container syscalls.
  3. C
    Configure VPC Service Controls around Artifact Registry to block egress image pulls that fail security scans, and create Cloud Logging exclusion filters to surface container runtime threats.
  4. D
    Configure GKE control plane authorized networks to restrict master endpoint access to compliant CI/CD runners, and rely on IAM permission boundary audits to flag runtime execution anomalies.

Answer

Enable Container Analysis vulnerability scanning with Binary Authorization policies to enforce image deployment rules, and activate Security Command Center Premium Container Threat Detection for agentless runtime monitoring.
The combination of Container Analysis and Binary Authorization ensures that images uploaded to Artifact Registry are automatically scanned for vulnerabilities and blocked at deployment time if policy constraints are violated. Meanwhile, Security Command Center (SCC) Premium Container Threat Detection monitors GKE workloads natively without requiring third-party agents, meeting the requirement for agentless runtime threat detection.

Step-by-Step Solution

1
Identify the mechanism for container vulnerability scanning and deployment gatekeeping.
Container Analysis automatically scans images stored in Artifact Registry, and Binary Authorization validates image metadata and vulnerability attestations before allowing deployment to GKE.
This guarantees that non-compliant images containing critical vulnerabilities are blocked prior to pod creation.
2
Identify the mechanism for agentless container runtime threat detection.
Security Command Center (SCC) Premium Container Threat Detection analyzes GKE container runtime events without requiring host-level agents.
It detects threats such as reverse shells, unauthorized binaries, and suspicious executions directly at the platform/kernel level.

Key Concept

Container Security Pipeline & Runtime Threat Detection
Estimated Time:1m 30s
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic