A CISO wants the organization's approved baseline, covering selected organization policies, detectors, and custom rules, written as a versioned definition, deployed to folders, and monitored for drift with findings. Which Security Command Center capability fits?
Show answer and explanation
Answer: D
Security Posture in Security Command Center lets teams encode their standards as a posture definition that combines organization policy constraints, detectors, and custom constraints. The definition can be versioned, dry-run tested, and deployed to a folder or organization, where it continuously checks compliance and raises findings when configuration drifts. It turns a written baseline into something enforced and measured.
Why the other options are wrong
- A. Asset Inventory records resource and policy state over time, which helps with history and investigations. It does not define a baseline or raise compliance findings against one.
- B. Access Transparency logs record actions taken by Google personnel when they access customer data. They say nothing about how a customer's own configuration should look.
- C. Binary Authorization controls which container images may deploy, using attestation policies. It is a deployment gate for images, not a posture baseline across cloud resources.