Examkin

Question

Difficulty: Very hardVulnerability Scanning, Container Security, and Threat Detection

A healthcare software provider is deploying a multi-tenant clinical application on Google Kubernetes Engine (GKE) across multiple Google Cloud projects. The compliance framework requires a security architecture that detects container-level runtime anomalies (such as unexpected binary executions or reverse shells) without injecting third-party agent containers into application pods, while strictly preventing unsigned or vulnerable container images from deploying to the GKE clusters. How should the cloud security architect design this solution using native Google Cloud services?

  1. Enable Security Command Center Premium to leverage built-in Container Threat Detection for agentless hypervisor-level runtime monitoring, configure continuous scanning in Artifact Registry via Container Analysis, and enforce a Binary Authorization policy requiring Cloud KMS-backed attestations prior to deployment.Answer
  2. B
    Grant the primitive Owner role to the GKE cluster service account across all projects to dynamically install third-party kernel probes across node pools for threat monitoring and bypass image validation checks during emergency deployments.
  3. C
    Establish a VPC Service Controls perimeter encompassing the Artifact Registry and GKE clusters, relying on perimeter egress controls to automatically block unsigned container images and detect malicious runtime container processes.
  4. D
    Restrict access to the GKE control plane by configuring control plane authorized networks, relying on private cluster endpoint restrictions to intercept unvetted image deployments and analyze container process trees.

Answer

Enable Security Command Center Premium for agentless Container Threat Detection, use Container Analysis for vulnerability scanning in Artifact Registry, and enforce deployment gates with Binary Authorization and Cloud KMS attestations.
The solution combining Security Command Center Premium (Container Threat Detection), Container Analysis, and Binary Authorization natively satisfies all three enterprise security requirements. Container Threat Detection performs agentless monitoring of container runtime behavior at the hypervisor/kernel level; Container Analysis scans images in Artifact Registry for vulnerabilities; and Binary Authorization enforces deployment gates using Cloud KMS attestations.

Step-by-Step Solution

1
Address agentless container runtime monitoring requirements.
Security Command Center (SCC) Premium Container Threat Detection inspects node kernel logs and container behaviors natively without injecting sidecars or third-party agents into application workloads.
Meets the constraint for zero-agent runtime anomaly detection.
2
Implement vulnerability scanning for stored container images.
Container Analysis performs automated vulnerability scanning on images stored in Artifact Registry.
Ensures software dependencies and OS packages are continuously evaluated for known CVEs.
3
Enforce container deployment compliance controls.
Binary Authorization integrates with CI/CD and GKE to block deployment of images that lack a valid cryptographic attestation signed via Cloud KMS.
Guarantees that only trusted, verified images reaching compliance criteria can run on the cluster.

Key Concept

Multi-Layered Native GCP Container Security Architecture (Binary Authorization, Container Analysis, and SCC Container Threat Detection)
Rate this question

Topics

Vulnerability Scanning, Container Security, and Threat Detection

More questions from this topic