GCP Professional Cloud Security Engineer Practice Question

Your security operations team must be notified whenever someone attempts to deploy a container image to any Google Kubernetes Engine (GKE) cluster in your organization and Binary Authorization blocks the deployment because the image lacks a required attestation. You have already enabled Binary Authorization in enforce mode on all clusters and have aggregated all Cloud Audit Logs into a central security project. Which log filter will reliably identify every such policy-violation event so you can create an alert or export to your SIEM?

resource.type="k8s_cluster" AND logName:"/logs/cloudaudit.googleapis.com%2Fdata_access" AND protoPayload.serviceName="binaryauthorization.googleapis.com"
severity="HIGH" AND jsonPayload.detectionCategory="Malware" AND resource.type="security_center_event"
resource.type="k8s_cluster" AND logName:"/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.serviceName="binaryauthorization.googleapis.com" AND protoPayload.methodName="google.cloud.binaryauthorization.v1.ValidationHelperV1.ValidateAttestationOccurrence" AND protoPayload.status.code=7
resource.type="k8s_cluster" AND logName:"/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.serviceName="container.googleapis.com" AND protoPayload.status.code=7

Report Issue

Answer Description

When Binary Authorization denies a container deployment, GKE's control plane calls the Binary Authorization API, which returns a DENIED decision. This is recorded as an Admin Activity entry in Cloud Audit Logs with the service name binaryauthorization.googleapis.com and the method google.cloud.binaryauthorization.v1.ValidationHelperV1.ValidateAttestationOccurrence. The log entry also contains a PERMISSION_DENIED status. Therefore, filtering on the Binary Authorization service's Admin Activity logs and the ValidateAttestationOccurrence method (option 2) uniquely captures every enforcement-time denial.

The other options are incorrect:

Audit logs from container.googleapis.com (the Kubernetes Engine API) do not contain the Binary Authorization decision; they only show that a deployment was attempted.
Data Access logs for binaryauthorization.googleapis.com are not generated by default and do not record policy evaluation results.
Event Threat Detection findings are separate Security Command Center detections; Binary Authorization denials are not surfaced there automatically. They are logged only in Cloud Audit Logs under the Binary Authorization service.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.