I already mentioned org policies with examples, service perimeters. But i assume according to interviewer this doesn't fall inside security. Ideally we have cloud armor, threat detection, image scan, binary authorization. I assume the interviewer would hardly know about this.