Examkin

Question

Difficulty: MediumVulnerability Scanning, Container Security, and Threat Detection

An online gaming enterprise hosts multiplayer matchmaking services on Google Kubernetes Engine (GKE) and stores container images in Artifact Registry. The lead security architect must design a container security strategy to achieve two goals: automatically scan container images for operating system vulnerabilities immediately upon push to the registry, and continuously detect runtime container compromises (such as unexpected binary execution or reverse shells) without deploying or managing security monitoring agents on cluster nodes. Which architectural approach fulfills these security and operational requirements?

  1. Enable Container Analysis vulnerability scanning on Artifact Registry, enforce deployment controls with Binary Authorization, and enable Container Threat Detection in Security Command Center Premium.Answer
  2. B
    Configure VPC Service Controls around Artifact Registry, grant the primitive Owner role to cluster node service accounts, and rely on standard Cloud Logging export rules to identify runtime anomalies.
  3. C
    Grant the Service Account Admin role to GKE deployment pipelines to allow image scanning, and deploy custom daemonsets on GKE nodes to capture low-level system calls for threat monitoring.
  4. D
    Implement VPC Service Controls to restrict image downloads, restrict master access using Private Cluster authorized networks, and run manual vulnerability scripts during image builds.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry, enforce deployment controls with Binary Authorization, and enable Container Threat Detection in Security Command Center Premium.
The combination of Container Analysis (for automatic Artifact Registry image vulnerability scanning) and Security Command Center Premium Container Threat Detection (for agentless runtime threat monitoring via node hypervisor logs) delivers end-to-end security compliance with zero agent management overhead.

Step-by-Step Solution

1
Identify the automated vulnerability scanning solution for container registries on Google Cloud.
Container Analysis (integrated with Artifact Registry) automatically scans container images for known vulnerabilities upon upload.
Meets the requirement for automated OS vulnerability scanning without manual pipeline execution.
2
Identify the managed service for agentless GKE runtime threat detection.
Container Threat Detection, a component of Security Command Center Premium, monitors GKE container behavior directly via node hypervisor and system logs without requiring installed agents.
Fulfills the operational mandate of zero monitoring agent management overhead.
3
Select the option that combines Container Analysis, Binary Authorization, and Container Threat Detection.
The solution combining Container Analysis, Binary Authorization, and Security Command Center Container Threat Detection satisfies all requirements.
Provides end-to-end container security from build/storage time to runtime without operational overhead.

Key Concept

Container Security Pipeline & Agentless Threat Detection
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic