Operators see unexplained CPU spikes on Compute Engine VMs and suspect cryptocurrency mining malware. They want detection that works without installing an agent on each VM. Which Security Command Center capability should they use?
Show answer and explanation
Answer: D
Virtual Machine Threat Detection inspects the memory of running VM instances from outside the guest, without an installed agent. It identifies threats such as cryptomining software and certain kernel-level malware that run inside the VM. The other capabilities examine configuration state, audit log patterns or container runtime activity, so none of them inspects the memory of a Compute Engine VM for mining processes.
Why the other options are wrong
- A. Security Health Analytics reports misconfigurations such as public exposure or disabled settings. It describes how resources are set up, not what code is running in a VM's memory.
- B. Event Threat Detection analyzes log entries for suspicious activity such as unusual API calls. Mining software running inside a VM may leave no audit log entry at all.
- C. Container Threat Detection targets threats inside GKE containers. Compute Engine VMs that run mining software directly on the guest operating system are outside its scope.