Examkin

Soru

Zorluk: ZorVulnerability Scanning, Container Security, and Threat Detection

A multinational financial services institution processes high-frequency transactions on Google Kubernetes Engine (GKE). To maintain strict regulatory compliance, the security team mandates a zero-trust container security framework. The system must meet three criteria: (1) prevent deployment of untrusted container images by enforcing cryptographic image verification signed by both CI/CD build pipelines and security reviewers, (2) continuously scan container images stored in Artifact Registry for known CVE vulnerabilities, and (3) detect runtime anomalies such as reverse shells and suspicious process executions without installing custom monitoring agents in the cluster. Which architecture and service configuration best fulfills all requirements?

  1. Configure Binary Authorization with a policy requiring attestations from both the build pipeline and security reviewer attestors, enable Artifact Registry Vulnerability Scanning for continuous vulnerability analysis, and activate Security Command Center Premium with Event Threat Detection and Container Threat Detection.Cevap
  2. B
    Grant the primitive Owner role to the GKE node service account so it can inspect image layers directly, enable Artifact Registry Vulnerability Scanning, and rely on standard Cloud Logging alerts for container runtime monitoring.
  3. C
    Grant developers the Service Account Admin role on the GKE service account to enable administrative attestation overrides, and configure Cloud Armor rules to inspect container images during pod deployment.
  4. D
    Deploy VPC Service Controls around the GKE cluster and Artifact Registry repository, relying solely on perimeter isolation to prevent unapproved container images from executing and to detect runtime compromises.

Cevap

Configure Binary Authorization with a policy requiring multi-attestor signatures (CI/CD build and security reviewers), Artifact Registry Vulnerability Scanning for continuous vulnerability checks, and Security Command Center Premium featuring Container Threat Detection and Event Threat Detection for agentless runtime threat discovery.
The solution requiring Binary Authorization, Artifact Registry Vulnerability Scanning, and Security Command Center Premium (Container Threat Detection) fulfills all three security goals. Binary Authorization enforces image signature validation from multiple attestors prior to deployment; Artifact Registry provides automated vulnerability auditing; SCC Premium Container Threat Detection monitors container runtime operations agentlessly.

Adım Adım Çözüm

1
Evaluate container deployment validation requirements
Binary Authorization integrates with GKE to enforce deployment policies that require cryptographic attestations from specified attestors (e.g., CI/CD build system and security review teams) prior to pod execution.
This guarantees that untrusted or unvalidated images cannot be deployed into the production cluster.
2
Evaluate image vulnerability scanning requirements
Artifact Registry Vulnerability Scanning (Container Analysis) automatically scans container images when pushed and continuously updates vulnerability reports when new CVEs are published.
This maintains visibility over known software vulnerabilities across container repositories.
3
Evaluate runtime threat detection requirements without agent overhead
Security Command Center (SCC) Premium includes Container Threat Detection, which analyzes hypervisor and audit logs to identify runtime threats (such as reverse shells or unauthorized binary execution) agentlessly.
This satisfies the requirement for real-time runtime monitoring without injecting third-party daemonsets or agents into cluster nodes.

Anahtar Kavram

Container Security Pipeline & Threat Detection in GCP
Bu soruyu puanla

Konular

Vulnerability Scanning, Container Security, and Threat Detection

Bu konudan daha fazla soru