Examkin

Soru

Zorluk: OrtaVulnerability Scanning, Container Security, and Threat Detection

A biomedical research company hosts containerized analytics workloads on Google Kubernetes Engine (GKE) and stores container images in Artifact Registry. The security team requires a solution that automatically blocks unverified container images containing known high-severity vulnerabilities from being deployed into production GKE clusters, while continuously detecting unauthorized process executions or kernel anomalies at runtime. Which architectural strategy should you recommend?

  1. Configure Artifact Registry vulnerability scanning alongside Binary Authorization policies to enforce image attestations before deployment, and enable Security Command Center Container Threat Detection for runtime kernel monitoring.Cevap
  2. B
    Assign the Owner role to the GKE node service account so that node agents can automatically scan images in Artifact Registry and block unauthorized runtime process execution.
  3. C
    Grant the Service Account Admin role to the deployment pipeline service account to allow it to validate image vulnerabilities and manage GKE cluster admission controllers.
  4. D
    Implement VPC Service Controls perimeters around Artifact Registry and rely on IAM permissions to prevent deployment of vulnerable images and flag runtime process anomalies.

Cevap

Configure Artifact Registry vulnerability scanning alongside Binary Authorization policies to enforce image attestations before deployment, and enable Security Command Center Container Threat Detection for runtime kernel monitoring.
Combining Artifact Registry vulnerability scanning with Binary Authorization ensures that container images are scanned and verified via attestations before deployment to GKE. Enabling Security Command Center Container Threat Detection provides out-of-band monitoring of low-level kernel activities to identify runtime container threats without performance overhead.

Adım Adım Çözüm

1
Identify pre-deployment container security requirements
Combine Artifact Registry vulnerability scanning (to detect image CVEs) with Binary Authorization attestations to ensure unverified images cannot be deployed to GKE.
Binary Authorization acts as an admission controller on GKE clusters to block non-attested images.
2
Identify runtime container threat detection requirements
Enable Security Command Center Premium Container Threat Detection.
Container Threat Detection continuously monitors container runtime behavior and eBPF kernel traces to identify unauthorized process executions and security violations.

Anahtar Kavram

Multi-layered container security using Binary Authorization for deployment control and Security Command Center Container Threat Detection for runtime protection.
Bu soruyu puanla

Konular

Vulnerability Scanning, Container Security, and Threat Detection

Bu konudan daha fazla soru