Examkin

Soru

Zorluk: Çok zorVulnerability Scanning, Container Security, and Threat Detection

An enterprise financial institution is designing a zero-trust container pipeline and runtime protection architecture on Google Cloud for their mission-critical Google Kubernetes Engine (GKE) clusters. The security policy mandates three operational requirements:

1. Container images stored in Artifact Registry must be automatically analyzed for software vulnerabilities.
2. Only container images verified with cryptographic attestations created during the CI/CD pipeline can be deployed to GKE clusters.
3. Runtime security monitoring must analyze GKE node telemetry and audit streams to detect suspicious container executions, shell spawns, and anomaly events without requiring third-party agent deployments inside individual pods.

Which TWO architectural components must the Cloud Architect integrate to fulfill these security requirements? (Select TWO options.)

  1. Enable Container Analysis continuous scanning on Artifact Registry and configure GKE Binary Authorization to enforce deploy-time policy evaluation using Cloud KMS-signed attestations.Cevap
  2. Enable Security Command Center Premium to leverage Container Threat Detection and Event Threat Detection for agentless runtime monitoring of GKE nodes and GCP audit logs.Cevap
  3. C
    Grant the primitive Owner role (roles/owner) to the CI/CD service account so that it can bypass deploy-time vulnerability restrictions and execute raw container inspection commands across cluster worker nodes.
  4. D
    Configure IAM permissions on the Container Analysis API to restrict pod network egress and prevent data exfiltration to unauthorized external networks from GKE workloads.

Cevap

The architecture requires enabling Container Analysis continuous scanning paired with GKE Binary Authorization using Cloud KMS attestations, as well as enabling Security Command Center Premium for Container Threat Detection and Event Threat Detection.
Combining Container Analysis continuous scanning with GKE Binary Authorization guarantees that container images are scanned and cryptographically validated prior to execution. Concurrently, Security Command Center Premium provides native, agentless runtime threat detection across both GKE nodes (via Container Threat Detection) and GCP log streams (via Event Threat Detection).

Adım Adım Çözüm

1
Evaluate vulnerability scanning and deploy-time governance requirements.
Artifact Registry vulnerability scanning is natively managed by Container Analysis. To ensure only signed binaries are deployed, GKE Binary Authorization acts as an admission controller enforcing signed attestations backed by Cloud KMS key pairs.
This establishes a cryptographic chain of trust from build to deployment.
2
Evaluate agentless runtime threat detection requirements.
Security Command Center (SCC) Premium includes Container Threat Detection, which monitors GKE node kernel telemetry, and Event Threat Detection, which analyzes Cloud Audit Logs.
These capabilities operate natively at the GCP infrastructure layer without requiring third-party pod agents or custom daemonsets.
3
Analyze distractor configurations against security governance boundaries.
Granting primitive Owner roles introduces massive security vulnerabilities, and relying on Container Analysis IAM to block network egress misunderstands the distinction between API identity authorization and network perimeter/data exfiltration controls.
IAM permissions control control-plane access, whereas VPC Service Controls and firewalls regulate network data movement.

Anahtar Kavram

Multi-layered container security incorporating automated image vulnerability scanning, Binary Authorization attestations, and agentless runtime threat detection using Security Command Center Premium.
Bu soruyu puanla

Konular

Vulnerability Scanning, Container Security, and Threat Detection

Bu konudan daha fazla soru