A manufacturing company uses Google Kubernetes Engine (GKE) for its production workloads. The security team needs to monitor for suspicious activities within the container runtime environment, such as execution of unauthorized binaries or attempts to modify container immutable files. Which Security Command Center capability should be enabled to detect these specific threats?
- AEvent Threat Detection
- BContainer Threat Detection
- CWeb Security Scanner
- DSecurity Health Analytics
Show answer & explanationAnswer & explanation
Correct answer: B. Container Threat Detection
Container Threat Detection (CTD) is specifically designed to detect runtime threats in containerized environments, including GKE workloads. It identifies suspicious activities like reverse shell execution, library hijacking, and unauthorized binary execution within containers. Web Security Scanner is for web apps, Event Threat Detection for logs, and Security Health Analytics for misconfigurations.
Why the other options are wrong
- A. Event Threat Detection analyzes Cloud Logging for threats, but Container Threat Detection is specialized for container runtime anomalies.
- C. Web Security Scanner scans web applications for vulnerabilities, not runtime container threats.
- D. Security Health Analytics identifies security misconfigurations and vulnerabilities in Google Cloud resources, not runtime container threats.
Container Threat Detection (CTD)
Container Threat Detection is a Security Command Center service that provides runtime threat detection for containerized workloads, including Google Kubernetes Engine (GKE). It identifies suspicious activities within containers like reverse shells, unauthorized binary execution, and modified immutable files.
- Specialized for container runtime threats.
- Detects activities like reverse shells, binary execution.
- Integrates with Security Command Center.
Memory trick: Containers need a watchful eye for threats.