Google Professional Cloud Security Engineer Question 402
Select 3Google Cloud PlatformYour organization uses Google Cloud to host multiple applications, and security is a top priority. You need to ensure that all virtual machines (VMs) deployed across the environment are consistently hardened, patched, and meet compliance requirements. Additionally, your containerized applications must use secure and up-to-date container images. Which of the following actions should you take to automate these processes efficiently?
- A
Use Google Cloud Build to create and validate hardened container images using a CI/CD pipeline before deployment.
- B
Implement OS patch management on Google Cloud by enabling the VM Manager patch compliance feature.
- C
Manually review and update VM images for each patch cycle to ensure compliance with security policies.
- D
Utilize Google Artifact Registry to store and manage only signed and scanned container images.
- E
Configure startup scripts for each VM instance to install necessary patches after deployment.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate the hardening, patch management, and compliance of virtual machines and container images, you should leverage tools like Google Cloud Build for CI/CD pipelines, VM Manager patch compliance for automated OS patching, and Google Artifact Registry for secure image storage and management. These tools streamline processes, reduce manual effort, and ensure consistent security practices across your infrastructure.
- A. Correct.
Using Google Cloud Build to create and validate hardened container images ensures that only secure and compliant container images are deployed. This follows best practices for automating container image hardening.
- B. Correct.
Enabling the VM Manager patch compliance feature allows you to automate OS patch management for virtual machines, ensuring consistent patching and compliance at scale.
- C. Incorrect.
Manually reviewing and updating VM images for each patch cycle is inefficient and prone to errors. This is not a recommended approach for automated or scalable security practices.
- D. Correct.
Using Google Artifact Registry to store signed and scanned container images ensures that only secure images are used in your applications, supporting compliance and security.
- E. Incorrect.
Configuring startup scripts for VM instances to install patches after deployment is not ideal for automation. It can delay application readiness and is less reliable than pre-patching VM images.