A financial services company hosts containerized microservices on Google Kubernetes Engine (GKE) and stores container images in Artifact Registry. The lead security architect must establish a multi-layered security strategy that prevents untrusted container images from being deployed to production clusters and detects anomalous runtime execution behaviors, such as unauthorized reverse shell attempts within running containers. Which TWO actions should the architect recommend to satisfy these requirements? (Select TWO.)
- Configure Binary Authorization policy on the GKE cluster to enforce image signature validation and attestation checks before deployment.Cevap
- Enable Container Threat Detection in Security Command Center to monitor container logs and runtime behavior for suspicious process activity.Cevap
- CAssign the primitive Owner role (roles/owner) to the deployment service account to allow automated remediation of container vulnerabilities.
- DDisable control plane authorized networks on the private GKE cluster to grant vulnerability scanners unrestricted access to master endpoints.
Cevap
The target security posture requires enforcing Binary Authorization policies on the GKE cluster to validate container image attestations prior to deployment, and enabling Container Threat Detection in Security Command Center to continuously monitor runtime behaviors for threats such as reverse shells.
Implementing Binary Authorization enforces signature-based attestations before pods are deployed to GKE. Combining this with Container Threat Detection in Security Command Center delivers continuous runtime detection for process anomalies and reverse shell attempts inside container workloads.
Adım Adım Çözüm
Anahtar Kavram
Multi-layered container security using Binary Authorization for deployment gating and Security Command Center Container Threat Detection for runtime monitoring.
Tahmini Süre:1m 30s