Examkin

Question

Difficulty: HardVulnerability Scanning, Container Security, and Threat Detection

A multinational logistics company runs mission-critical workloads on Google Kubernetes Engine (GKE). The security team requires a centralized container posture enforcement mechanism that automatically prevents unauthorized image deployments in GKE clusters, scans build artifacts for known vulnerabilities in Artifact Registry, and detects runtime compromise attempts such as reverse shells or cryptocurrency mining at the node and hypervisor level via Security Command Center (SCC) Premium. Which combination of Google Cloud security controls satisfies these security requirements with minimal operational overhead?

  1. Configure Artifact Registry container vulnerability scanning, enforce image signature validation via Binary Authorization policies integrated with Cloud KMS and Cloud Build, and enable Security Command Center Premium Event Threat Detection and Container Threat Detection.Answer
  2. B
    Enforce VPC Service Controls around GKE master endpoints and Cloud Storage, assign the primitive Owner role to CI/CD service accounts to manage image attestations, and use standard VPC Firewall rules to detect runtime pod compromises.
  3. C
    Grant the Service Account Admin role to GKE node service accounts to inspect running container images, configure GKE Authorized Networks, and rely exclusively on IAM permissions to prevent data exfiltration and unverified container deployments.
  4. D
    Restrict access to private GKE cluster endpoints by omitting authorized networks, enable Container Analysis for build scans, and deploy custom eBPF monitoring scripts manually on each GKE worker node host.

Answer

Configure Artifact Registry container vulnerability scanning, enforce image signature validation via Binary Authorization policies integrated with Cloud KMS and Cloud Build, and enable Security Command Center Premium Event Threat Detection and Container Threat Detection.
The combination of Artifact Registry vulnerability scanning, Binary Authorization for deploy-time policy enforcement, and Security Command Center (SCC) Premium for runtime container and event threat detection provides comprehensive, native end-to-end security across the build, deploy, and runtime phases with minimal operational overhead.

Step-by-Step Solution

1
Analyze build-time and storage security requirements
Artifact Registry automated vulnerability scanning continually checks container images for CVEs upon push.
Ensures software dependencies are audited early in the CI/CD pipeline.
2
Identify deploy-time governance mechanism
Binary Authorization validates digital signatures (attestations) created during Cloud Build before allowing image deployment on GKE.
Prevents unauthorized or unverified images from running in production GKE clusters.
3
Select runtime threat detection capability
Security Command Center Premium (Container Threat Detection and Event Threat Detection) analyzes kernel logs and GCP audit logs.
Detects container breaches, reverse shells, and malicious behavior at runtime without needing heavy third-party agent management.

Key Concept

End-to-End GCP Container Security Architecture (Binary Authorization, Container Analysis, SCC Premium)
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic