Examkin

Question

Difficulty: MediumVulnerability Scanning, Container Security, and Threat Detection

A global retail enterprise hosts its online storefront services on Google Kubernetes Engine (GKE) and stores all container build artifacts in Artifact Registry. The security compliance policy dictates that all container images must be continuously scanned for newly discovered OS and language package vulnerabilities upon storage, and any runtime container anomalies or out-of-band process executions on GKE nodes must be detected automatically without installing third-party host agents. Which architectural solution fulfills these security requirements with minimal operational overhead?

  1. Enable vulnerability scanning in Artifact Registry for continuous image analysis, and activate Security Command Center Premium to utilize Container Threat Detection and Event Threat Detection.Answer
  2. B
    Grant the primitive Owner role to the Cloud Build service account and configure VPC Service Controls perimeter policies to inspect container image layers during upload.
  3. C
    Deploy a custom security monitoring agent daemonset across all GKE nodes and grant the daemonset service account the Service Account Admin role to inspect host process execution.
  4. D
    Configure control plane authorized networks for the private GKE cluster and rely on VPC Service Controls perimeter rules to detect anomalous runtime container activity.

Answer

Enable vulnerability scanning in Artifact Registry for continuous image analysis, and activate Security Command Center Premium to utilize Container Threat Detection and Event Threat Detection.
Enabling Artifact Registry vulnerability scanning ensures automated continuous vulnerability discovery for stored container images. Combining this with Security Command Center (SCC) Premium provides built-in, agentless runtime threat detection (including Container Threat Detection and Event Threat Detection) for GKE clusters without requiring custom host agents or managing extra infrastructure.

Step-by-Step Solution

1
Identify container image scanning requirements
Artifact Registry vulnerability scanning provides automated, continuous scanning of container images for operating system and language-pack vulnerabilities upon push.
This satisfies the requirement for container build artifact vulnerability management with zero custom infrastructure management.
2
Identify agentless runtime threat detection requirements for GKE
Security Command Center (SCC) Premium includes Container Threat Detection and Event Threat Detection.
Container Threat Detection monitors GKE container audit logs and node memory in an agentless manner to flag suspicious binaries, reverse shells, or anomalous processes.
3
Synthesize the fully managed Google Cloud native security design
Combining Artifact Registry vulnerability scanning with SCC Premium Container Threat Detection satisfies both continuous image scanning and agentless runtime threat detection.
This approach minimizes operational overhead while maintaining strict adherence to enterprise security compliance standards.

Key Concept

Managed Vulnerability Scanning and Agentless Threat Detection
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic