Examkin

Soru

Zorluk: ZorVulnerability Scanning, Container Security, and Threat Detection

A digital entertainment platform hosts high-throughput microservices in Google Kubernetes Engine (GKE) and stores build artifacts in Artifact Registry. The security operations team requires a Google Cloud-native security architecture that automatically inspects container images for known software vulnerabilities upon repository upload, and continuously monitors runtime container behavior and cloud audit logs for compromised workloads or reverse shells without requiring third-party agent installations. Which TWO security capabilities should the cloud architect recommend? (Select TWO)

  1. Enable Container Analysis vulnerability scanning in Artifact Registry to automatically scan container images for known CVEs when pushed.Cevap
  2. Enable Security Command Center Threat Detection services, specifically Container Threat Detection and Event Threat Detection, for agentless runtime and log monitoring.Cevap
  3. C
    Assign the IAM Owner primitive role to the container build service account so vulnerability scanning services can automatically remediate cluster node OS packages.
  4. D
    Configure VPC Service Controls perimeters as the primary mechanism to unpack and analyze container image layers for application vulnerabilities during deployment.

Cevap

The cloud architect should enable Container Analysis vulnerability scanning in Artifact Registry to continuously inspect container images for known CVEs, and enable Security Command Center Container Threat Detection and Event Threat Detection to provide agentless runtime threat monitoring.
Enabling Container Analysis vulnerability scanning ensures that container images stored in Artifact Registry are automatically scanned for known vulnerabilities upon upload. Furthermore, enabling Security Command Center services (Container Threat Detection and Event Threat Detection) provides native, agentless runtime security monitoring across container environments and cloud logs without needing guest agents installed in each pod.

Adım Adım Çözüm

1
Evaluate container vulnerability scanning requirements for artifacts stored in Artifact Registry.
Container Analysis provides native, automated vulnerability scanning for container images stored in Artifact Registry upon upload.
It detects known CVEs in OS packages and language-specific dependencies without external tooling.
2
Evaluate runtime threat detection requirements for GKE microservices and cloud logs without installing agents.
Security Command Center Container Threat Detection inspects GKE node hypervisor logs agentlessly, while Event Threat Detection monitors Cloud Logging in real time.
This detects threats like reverse shells, suspicious binaries, and compromised credentials without performance overhead on pods.
3
Filter out non-compliant distractors related to IAM and network perimeters.
Primitive IAM roles break least privilege, and VPC Service Controls enforce perimeter security rather than image layer vulnerability analysis.
Security controls must match their specific architectural domain.

Anahtar Kavram

Vulnerability Scanning, Container Security, and Threat Detection
Bu soruyu puanla

Konular

Vulnerability Scanning, Container Security, and Threat Detection

Bu konudan daha fazla soru