An aerospace software engineering enterprise is establishing a multi-layered defense architecture on Google Cloud for its flight simulation microservices. The lead cloud security architect must assign dedicated GCP security products to specific vulnerability management, deploy-time governance, and threat detection requirements. Match each Google Cloud security product to its primary security capability within the application lifecycle.
- Binary AuthorizationEnforces signature-based deployment policies on Google Kubernetes Engine (GKE) clusters to prevent unverified container images from executing.
- Container AnalysisScans container images stored in Artifact Registry for software vulnerabilities (CVEs) and generates vulnerability metadata.
- Container Threat DetectionMonitors low-level container runtime memory and guest kernel syscalls inside GKE nodes to detect active exploits such as reverse shells.
- Event Threat DetectionAnalyzes log streams within Cloud Logging at the organization level using threat intelligence to detect suspicious IAM activity and data exfiltration.
Cevap
Binary Authorization matches with deploy-time signature enforcement; Container Analysis matches with Artifact Registry image vulnerability scanning; Container Threat Detection matches with real-time container runtime memory and kernel syscall monitoring; Event Threat Detection matches with log stream analysis for organization-level threat detection.
Each GCP security service provides a distinct layer of security across the container lifecycle: Container Analysis handles image vulnerability scanning during storage, Binary Authorization enforces cryptographically signed deployment policies, Container Threat Detection monitors runtime kernel and memory behavior on GKE nodes, and Event Threat Detection scans organization audit log streams for cloud-wide threat activity.
Adım Adım Çözüm
Anahtar Kavram
Defense-in-depth container security and threat detection integration in Google Cloud Platform.
Tahmini Süre:2m 0s