Examkin

Soru

Zorluk: ZorVulnerability Scanning, Container Security, and Threat Detection

A biomedical research institute is migrating its containerized genomic data processing workloads to Google Kubernetes Engine (GKE). The chief information security officer requires an architectural design that satisfies two strict security mandates: first, only container images that have been cryptographically verified and signed by the internal CI/CD build pipeline may be deployed to cluster nodes; second, any potential runtime container escapes or malicious hypervisor-level syscall anomalies must be detected out-of-band without adding sidecar agents to application pods. Which combination of Google Cloud services and configurations fulfills these requirements?

  1. Enforce Binary Authorization policies backed by Cloud KMS attestors for deployment validation, and enable Security Command Center Premium utilizing Container Threat Detection and Event Threat Detection.Cevap
  2. B
    Configure VPC Service Controls perimeters around Artifact Registry and Cloud Storage to block unverified deployments and inspect runtime container kernel calls.
  3. C
    Grant the primitive IAM Owner role to the GKE cluster node service account to enable automated container image signature checking and continuous runtime threat prevention.
  4. D
    Disable control plane authorized networks on the private GKE cluster so Security Command Center can inspect container image layers and block unverified deployments.

Cevap

Enforce Binary Authorization policies backed by Cloud KMS attestors for deployment validation, and enable Security Command Center Premium utilizing Container Threat Detection and Event Threat Detection.
The solution requiring Binary Authorization policies backed by Cloud KMS attestors along with Security Command Center Premium (Container Threat Detection and Event Threat Detection) correctly satisfies both requirements. Binary Authorization ensures that only container images cryptographically signed during the CI/CD build process are allowed to run on GKE nodes. Security Command Center Premium's Container Threat Detection performs out-of-band kernel tracing on GKE nodes to identify container escapes, reverse shells, and malicious execution without requiring sidecar proxies.

Adım Adım Çözüm

1
Analyze deployment verification requirements
Identified the need for cryptographic image signing and policy enforcement prior to deployment.
Binary Authorization integrates with GKE and Cloud KMS attestors to block any container image that lacks a valid signature from the authorized CI/CD pipeline.
2
Analyze runtime threat detection requirements
Identified the need for agentless, kernel/audit log runtime monitoring.
Security Command Center Premium includes Container Threat Detection, which monitors node kernel instrumentation to detect container escapes and suspicious binaries out-of-band without needing sidecar containers.
3
Combine services to formulate the complete architecture
The architecture pairs Binary Authorization for pre-deployment gating with SCC Premium for runtime threat detection.
This combined solution satisfies both mandate criteria efficiently and securely.

Anahtar Kavram

Container Attestation and Runtime Threat Detection
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Vulnerability Scanning, Container Security, and Threat Detection

Bu konudan daha fazla soru