Google Professional Cloud Security Engineer Question 401
Select 3Google Cloud PlatformYour organization needs to ensure that all virtual machines (VMs) and container images used in Google Cloud adhere to strict security standards, including operating system hardening and regular patching. You are tasked with automating this process for both VMs and container images. Which of the following actions should you take to meet this requirement?
- A
Use Google Cloud's OS Patch Management to schedule and automate patching for your VMs.
- B
Leverage Cloud Build to create a hardened container image pipeline that integrates vulnerability scanning.
- C
Manually log in to each VM and container to apply security patches regularly.
- D
Use a managed service like Google Kubernetes Engine (GKE) Autopilot to ensure container images are automatically hardened.
- E
Implement Google Cloud's VM Image import feature to create pre-hardened custom VM images.
Show answer and explanation
Correct answers: A, B, E
Explanation
To automate VM and container image creation, it is important to leverage tools provided by Google Cloud that facilitate security hardening and patch management. OS Patch Management automates VM patching, Cloud Build can be used to harden and scan container images, and custom pre-hardened VM images can be created using the VM Image import feature. Manual processes or assumptions about managed services like GKE Autopilot handling image hardening are not sufficient to meet these requirements.
- A. Correct.
Google Cloud's OS Patch Management allows you to automate patching for your VMs, ensuring they are up-to-date with the latest security updates. This is a recommended way to automate VM maintenance.
- B. Correct.
Cloud Build can be used to create CI/CD pipelines for container images, enabling hardening and integration with vulnerability scanning tools like Container Analysis.
- C. Incorrect.
Manually logging into each VM and container for patching is not scalable or reliable. Automation is the key to maintaining security at scale.
- D. Incorrect.
While GKE Autopilot manages many aspects of Kubernetes clusters, it does not automatically harden or patch container images. This must be done separately using tools like Cloud Build.
- E. Correct.
Using Google Cloud's VM Image import feature, you can create and manage custom, pre-hardened VM images. This ensures that all VMs launched from these images meet your security standards.