Enabling Runtime Container Threat Detection in Google Cloud SCC

PCSE By islever Editorial Last updated

Designing and configuring perimeter security. Configuring logging, monitoring, and detection.

Short answer

D Enable Container Threat Detection in Security Command Center Premium tier for the projects within the production folder to achieve runtime threat detection and centralized visibility.

Question

Your company has recently enabled Security Command Center at the organization level. You need to implement runtime threat detection for applications running in containers within projects residing in the production folder. Specifically, you need to be notified if additional libraries are loaded or malicious scripts are executed within these running containers. You need to configure Security Command Center to meet this requirement while ensuring findings are visible within Security Command Center. What should you do?
  1. Create log-based metrics and alerts in Cloud Logging and Cloud Monitoring for suspicious container activity within the production folder.
  2. Configure Security Health Analytics within Security Command Center to monitor container runtime vulnerabilities in the production folder.
  3. Ensure that the containers in the production folder are running on hosts that are using Container-Optimized OS.
  4. Enable Container Threat Detection in Security Command Center Premium tier for the projects within the production folder. Correct Answer

Key Takeaways

The core concept tested is distinguishing between static vulnerability scanning (Security Health Analytics) and dynamic runtime behavioral analysis (Container Threat Detection) within Google Cloud's security suite.

This question explores how to implement runtime threat detection for Google Cloud containers using Security Command Center. The correct solution involves enabling Container Threat Detection in the Premium tier to monitor for malicious activities like library loading and script execution.

Common mistake: Candidates often choose Option B (Security Health Analytics) because it is also part of SCC. However, SHA only checks for static misconfigurations and known CVEs, failing to detect real-time runtime behaviors such as malicious script execution or anomalous process activity.

Expert Analysis

The scenario requires runtime threat detection specifically for applications running in containers, focusing on behaviors like loading additional libraries or executing malicious scripts. The goal is to have these findings visible within Security Command Center (SCC).

Container Threat Detection (CTD) is the dedicated service within SCC designed exactly for this purpose. It provides behavioral analysis and anomaly detection at the container runtime level. When enabled, it monitors system calls, network traffic, and process executions inside containers to identify threats such as malware execution, unauthorized library loads, and other suspicious activities. CTD findings are natively integrated into the SCC console, satisfying the visibility requirement.

Let's evaluate why the other options are incorrect:

  • Option A suggests using Cloud Logging and Monitoring metrics. While you can build custom alerts based on logs, this is a manual, fragmented approach. It does not leverage the built-in, specialized runtime protection capabilities of SCC Premium. Furthermore, detecting 'malicious scripts' often requires deep behavioral analysis that basic log metrics cannot reliably provide without significant custom configuration, which contradicts the efficiency implied by using SCC features.
  • Option B refers to Security Health Analytics (SHA). SHA focuses on static configuration checks and known vulnerabilities (e.g., CIS benchmarks, overprivileged IAM, public buckets). It does not perform real-time behavioral analysis of running processes or detect runtime anomalies like malicious script execution. Comments confirm SHA detects configuration issues, not runtime threats.
  • Option C involves using Container-Optimized OS (COS). While COS is a hardened image choice, simply running on COS does not enable active runtime threat detection or generate security findings in SCC. It is a baseline security posture measure, not an active monitoring solution.

Therefore, enabling Container Threat Detection in the Premium tier of Security Command Center is the correct, native, and comprehensive solution for runtime container security.

Official Reference

https://cloud.google.com/security-command-center/docs/concept-container-threat-detection-overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks for 'runtime' analysis or 'behavioral' detection in cloud environments, immediately rule out static scanning tools. For Google Cloud, associate 'runtime container security' exclusively with Container Threat Detection (CTD) in SCC Premium. Reserve Security Health Analytics (SHA) for questions about compliance checks, CIS benchmarks, or static misconfiguration audits.

Frequently Asked Questions

What is the difference between Security Health Analytics and Container Threat Detection?

Security Health Analytics (SHA) performs static checks against best practices and known vulnerabilities (like CIS benchmarks). Container Threat Detection (CTD) performs dynamic, real-time behavioral analysis of running containers to detect active threats like malware or anomalous processes.

Does using Container-Optimized OS (COS) automatically enable threat detection?

No. COS provides a hardened, minimal operating system for containers, reducing the attack surface. However, it does not include active runtime monitoring or generate security findings in SCC. You must explicitly enable CTD for that capability.

More PCSE FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. fossil123 👍 1 Answered D
    ✅ Option D is correct because Container Threat Detection (CTD) is the specific Security Command Center (SCC) built-in service designed for runtime security. It specifically monitors for the activities mentioned:
  2. b6f53d8 👍 1 Answered D
    b is wrong because SHA detect: public bucket overprivileged IAM firewall CIS coniguration

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide