What's changed: Created Professional Cloud Security Engineer Chapter 4 (Domain 4 "Operations": CVE scanning in CI/CD (Artifact Analysis)/Binary Authorization (GKE/Cloud Run)/image hardening-VM patch management/CSPM-custom org policies-Security Health Analytics custom modules; network logs (Cloud NGFW/VPC flow logs/Packet Mirroring/Cloud IDS/Log Analytics), logging strategy, incident response, secure log access, external SIEM export, Cloud Audit Logs/data access logs, log sinks/aggregated sinks, Security Command Center).
4.1Automating infrastructure and application security
Understand automating CVE scanning in CI/CD, Binary Authorization to secure GKE/Cloud Run, automating VM/container image creation (hardening, maintenance, VM patch management), and managing policy/drift detection at scale (cloud security posture management [CSPM], custom org policies, custom modules for Security Health Analytics).
Manual security cannot keep up. Build inspection into the pipeline, deploy only trusted artifacts, and auto-detect configuration drift.
4.1.1Supply chain and image security
In CI/CD, automate CVE scanning (known vulnerabilities) and continuously scan images/packages with Artifact Analysis. At deploy, use Binary Authorization to admit only "signed/verified images" to GKE/Cloud Run, blocking untrusted artifacts (Artifact Analysis detects, Binary Authorization enforces). Harden the base by auto-building hardened VM/container images (golden images) and maintaining them with VM patch management (fleet-wide OS patching). Map "deploy only signed = Binary Authorization" and "detect vulnerabilities = Artifact Analysis (CVE scanning)."
4.1.2Posture management and drift detection
At scale you need cloud security posture management (CSPM) to continuously evaluate configuration safety. On Google Cloud, Security Command Center (SCC) Security Health Analytics detects misconfigurations, and you add bespoke checks with custom modules. To prevent drift toward undesired configs, enforce requirements as constraints with custom organization policies (Custom Org Policy). Map "auto-detect misconfig = Security Health Analytics" and "bespoke guardrails = custom org policies/custom modules."
Common: requirement → means. E.g., "deploy only signed/verified images to GKE/Cloud Run" = Binary Authorization; "continuously detect known vulns in images" = Artifact Analysis (CVE scanning); "apply OS patches fleet-wide" = VM patch management; "auto-detect misconfig" = Security Command Center Security Health Analytics; "add bespoke checks" = custom modules; "forbid undesired configs via constraints" = custom organization policies.
Watch the mix-ups: (1) Artifact Analysis (vuln detection) vs Binary Authorization (enforce signed-only) play different roles—combine them. (2) Security Health Analytics (detect misconfig) vs org policies (enforce constraints) is detection vs prevention. (3) Manual config changes cause drift—prevent with IaC + policy.
4.1.3Section summary
- CVE scanning in CI/CD (Artifact Analysis); deploy only signed via Binary Authorization
- Harden images + VM patch management to fortify the base
- CSPM = SCC Security Health Analytics (+ custom modules); prevent drift with custom org policies
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To prevent untrusted container images and admit only signed/verified images to GKE/Cloud Run, which is best?
Q2. To continuously detect known vulnerabilities (CVEs) in container images/packages in CI/CD, which is best?
Q3. To centrally auto-detect misconfigurations (public buckets, over-broad firewalls) across Google Cloud, which is best?
Q4. To apply/manage OS vulnerability patches across many VMs at scale, which is best?
Q5. To prevent drift from a bespoke standard (e.g., all Cloud SQL must be private IP only) by enforcing it as a constraint, which is best?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.