Examkin

Soru

Zorluk: OrtaVulnerability Scanning, Container Security, and Threat Detection

An enterprise SaaS platform hosts microservices on Google Kubernetes Engine (GKE) and manages container images using Artifact Registry. The security team requires an architecture that automatically scans container images for vulnerabilities upon push, prevents unsigned or untrusted images from being deployed to GKE clusters, and detects runtime threats such as reverse shells or unauthorized binaries. Which TWO security measures should the cloud security architect implement? (Select TWO.)

  1. Enable Container Analysis in Artifact Registry to perform automated vulnerability scanning, and configure Binary Authorization on GKE to enforce container image signature policies.Cevap
  2. Enable Security Command Center (SCC) Premium to leverage Container Threat Detection and Event Threat Detection for real-time runtime threat monitoring.Cevap
  3. C
    Implement VPC Service Controls around the GKE master endpoints and Artifact Registry to automatically detect runtime container vulnerabilities and prevent data exfiltration.
  4. D
    Assign the Editor primitive role to the GKE node service account so that container workloads can continuously self-scan and apply vulnerability patches.

Cevap

The enterprise must enable Container Analysis for vulnerability scanning in Artifact Registry, configure Binary Authorization to enforce image signature verification before deployment to GKE, and enable Security Command Center Premium to utilize Container Threat Detection and Event Threat Detection for runtime threat detection.
Enabling Container Analysis alongside Binary Authorization secures the container pipeline by automatically identifying software vulnerabilities in Artifact Registry and ensuring that only digitally signed images are admitted to GKE clusters. Enabling Security Command Center Premium provides Container Threat Detection and Event Threat Detection to continuously monitor node behavior, suspicious processes, and audit logs for active runtime security threats.

Adım Adım Çözüm

1
Configure vulnerability scanning and deployment signature verification.
Container Analysis automatically scans container images pushed to Artifact Registry for known vulnerabilities, while Binary Authorization validates attestation signatures before GKE admits the deployment.
This secures the software supply chain and prevents vulnerable or unapproved code from running in production GKE environments.
2
Enable runtime container threat detection.
Security Command Center Premium activates Container Threat Detection (monitoring node and container execution behavior) and Event Threat Detection (analyzing audit streams).
This detects active threats, binary modifications, and suspicious process executions at runtime.

Anahtar Kavram

Multi-layered container security and threat detection using Container Analysis, Binary Authorization, and Security Command Center Premium.
Bu soruyu puanla

Konular

Vulnerability Scanning, Container Security, and Threat Detection

Bu konudan daha fazla soru