GCP Security · Domain 4
Managing Operations
About 19% of the exam
Compute hardening
- Secure boot
- only signed boot components load
- Virtual trusted module
- stores measurements and secrets
- Integrity monitoring
- alerts when boot state changes
- Confidential machine
- memory encrypted by the processor
- Trusted image projects
- only approved images may boot
- Identity based sign-in
- host accounts tied to identity
- No external address
- reachable only through internal paths
- Least privilege identity
- one service account per workload
Boot integrity, image provenance and identity based sign-in remove three of the most common footholds on a machine
Shielded and confidential machines
- Shielded machines protect the boot chain
- Confidential machines protect memory contents
- Attestation evidence can gate key release
- Dedicated node pools contain the overhead
- Integrity findings surface in the console
- Reserve them for sensitive processing
Access to instances
- Identity based sign-in replaces stored keys
- Tunneling reaches hosts without public addresses
- Roles decide who may sign in
- Session activity recorded in audit logs
- Metadata based keys should be disabled
- Break glass access separately monitored
Cluster controls
- Managed nodes hardened by the provider
- Workload identity replaces node credentials
- Native addressing lets firewall rules apply
- Default deny network policies per namespace
- Posture findings ranked by severity
- Policy controller audits current violations
Supply chain admission
- Attestors sign that a check passed
- Policy can require several attestations together
- Enforced mode blocks unsigned images
- Dry run mode reports would-be blocks
- Provenance records how it was built
- Assurance levels rise with build controls
Image and artifact security
Registry
- Vulnerability scanning on push
- Continuous scanning of stored images
- Pull permission separate from push
Build
- Provenance generated by the build service
- Signed attestations stored with the image
- Isolate build from deploy credentials
Deploy
- Admission checks before the pod starts
- Base images from an approved set
- Rebuild instead of patching in place
Audit logs
- Admin activity
- always on, configuration changes recorded
- Data access
- reads and writes, mostly optional
- System event
- actions the platform takes itself
- Policy denied
- requests refused by a constraint
- Default retention
- administrative activity kept for months
- Enabling data access
- configured per service in policy
- Granted field
- shows whether the call succeeded
- Warehouse exception
- data access recorded by default
Log routing
- Sinks route entries to destinations
- An aggregated sink at the organization node
- Destination bucket in a separate project
- Retention set on the destination
- Field level access hides sensitive values
- Log views scope who reads what
The security console
- Findings from many services in one place
- Posture checks against common benchmarks
- Custom modules written as expressions
- Mute rules quiet the known benign
- Continuous export to a message topic
- Attack exposure scoring ranks findings
Detection services
Log based
- Threat detection reads audit logs
- Dormant account use is flagged
- Access from anonymizing proxies flagged
Workload based
- Container detection watches running workloads
- Kernel signals work on minimal images
- Intrusion detection inspects mirrored traffic
Posture based
- Health analytics checks configuration
- Attack paths chain exposures together
- High value resources raise priority
Custom detection
- Rules written in a detection query language
- Single event and multi event rules
- Reference lists exclude known benign actors
- Retrospective hunts run over stored data
- Risk scores rank users and assets
- Playbooks automate the repeatable response
Response automation
- Finding created
- Exported to a topic
- Function or workflow
- Contain and ticket
- Verify and close
Export findings rather than watching a console, because automation needs an event while a console needs a person
Operations mistakes
Logging
- Data access logging never enabled
- Logs kept only in the project
- Retention shorter than the investigation
Detection
- Custom module scoped to nothing
- Noisy detector disabled outright
- Findings never leave the console
Workloads
- Legacy addressing blocks firewall targeting
- Attestation enforced only in test
- Node credentials borrowed by pods
Service names to know
- Findings in one console
- the security command center
- Configuration benchmark checks
- security health analytics
- Audit log based detections
- event threat detection
- Running container behavior
- container threat detection
- Mirrored traffic inspection
- the intrusion detection service
- Custom detection rules
- a detection rule language
- Signed image enforcement
- binary authorization
- Package vulnerability scanning
- artifact analysis
Know the order
- Harden the image
- Attest the artifact
- Admit by policy
- Log everything
- Detect and respond
Prove the artifact before it runs and record the activity after it does, because neither one covers the other
Reference strip: machines, clusters, supply chain, logging, detection
Machines
- Secure boot and measurements
- Confidential memory encryption
- Approved boot images only
- Identity based host sign-in
Clusters
- Managed hardened node pools
- Workload identity for pods
- Default deny network policies
- Posture findings by severity
Supply chain
- Scanning on push and storage
- Attestations from each gate
- Enforced admission at deploy
- Provenance kept with the artifact
Logging
- Administrative activity always recorded
- Data access enabled deliberately
- Aggregated sink out of project
- Field level access controls
Detection
- Log based threat detection
- Runtime container signals
- Posture and attack paths
- Export findings to automation
Quick exam traps
- Trap: Data access logs are enabled by default for every service
- Trap: A muted finding is deleted from the console
- Trap: Dry run mode on admission blocks unsigned images
- Trap: Container detection cannot see inside a minimal image
- Trap: Shielded and confidential machines protect against the same threat
- Trap: Organization logs are safe in the project that produced them
- Trap: Enabling a detector is the same as having a response
cybercertprep.com · original revision sheet written from the public body of knowledge