Google Professional Cloud Security Engineer Question 400
Select 3Google Cloud PlatformYour organization wants to automate the process of creating hardened virtual machine (VM) images to ensure compliance with security standards. The solution must also ensure that VMs are continuously kept up to date with the latest security patches. Which combination of Google Cloud services and tools should you use to achieve this?
- A
Use Google Cloud Build to create custom VM images with pre-installed security updates, and schedule regular builds to update the images.
- B
Use Google Cloud Marketplace to deploy pre-hardened VM images and configure automatic patch management using OS Config.
- C
Use Google Kubernetes Engine (GKE) to automatically scan and patch VM images deployed as containers.
- D
Use OS Config to automate patch management on running VMs and integrate it with Google Cloud Build for custom image creation.
- E
Manually patch and harden VM images using SSH access and store them in Cloud Storage for reuse.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate VM and image creation, Google Cloud offers a combination of services like Cloud Build for custom image creation, OS Config for patch management, and pre-hardened images from the Google Cloud Marketplace. These tools together ensure a secure and automated approach to managing VM images and their ongoing maintenance, reducing manual effort and potential security risks.
- A. Correct.
Correct: Google Cloud Build can automate the creation of custom VM images, and scheduling regular builds ensures the images are updated with the latest security patches and configurations.
- B. Correct.
Correct: Google Cloud Marketplace provides pre-hardened VM images. Combining this with OS Config for automatic patching ensures continuous compliance with security standards.
- C. Incorrect.
Incorrect: While GKE is a container orchestration platform, it does not directly manage VM images or their patching processes. This option conflates VM patching with container management.
- D. Correct.
Correct: OS Config is a Google Cloud service specifically designed to automate patch management on running VMs. Integrating it with Cloud Build for custom image creation ensures a comprehensive automation solution.
- E. Incorrect.
Incorrect: Manually patching and hardening VMs is labor-intensive, error-prone, and does not align with automation principles required for scalable and secure environments.