Professional Security Operations EngineerDemo

Question

You received a Container Threat Detection alert that an added binary was executed in a business-critical workload. You must investigate and respond to this incident. What should you do?

Choose two

A Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
B Review the finding, investigate the pod and related resources, and research the related attack and response methods.
C Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
D Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
E Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.

Explanation

Container Threat Detection findings should be reviewed and investigated at the affected pod and related-resource level, with relevant attack techniques and response methods researched to determine scope and appropriate remediation. A business-critical workload incident also requires the established response playbook, notification of the workload owner, and escalation to threat-hunting personnel for root-cause analysis. Google Cloud’s response guidance recommends evaluating investigation results before operationally disruptive remediation such as stopping or deleting a compromised container.

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ66

Community Discussion