Google Professional Cloud Security Engineer Question 403
Select 3Google Cloud PlatformYour organization runs a series of critical applications on Google Cloud’s Compute Engine virtual machines (VMs). To ensure compliance with security regulations, all VMs must be hardened, patched regularly, and have container images scanned for vulnerabilities before deployment. You want to automate these processes to reduce manual effort and ensure consistency. Which combination of Google Cloud services and tools should you use to achieve this?
- A
Use OS Config to automate patch management for virtual machines.
- B
Use Container Analysis to scan container images for vulnerabilities.
- C
Manually log into each VM to apply security patches.
- D
Use Cloud Build to integrate vulnerability scanning into the CI/CD pipeline.
- E
Use Cloud Functions to schedule manual patching tasks.
Show answer and explanation
Correct answers: A, B, D
Explanation
Automating VM and container image creation is critical for maintaining security at scale. OS Config allows you to automate patch management for VMs, reducing manual effort and ensuring compliance. Container Analysis provides vulnerability scanning for container images, ensuring they are hardened before deployment. Cloud Build integrates well with Container Analysis and can automate security checks during the CI/CD process. Together, these tools provide a comprehensive and automated approach to VM and container image security.
- A. Correct.
OS Config is a Google Cloud service designed specifically for automating patch management, ensuring that VMs remain up-to-date with the latest security patches without requiring manual intervention.
- B. Correct.
Container Analysis is a service in Google Cloud that automatically scans container images for vulnerabilities and provides detailed information about potential security issues, making it an essential tool for ensuring hardened container images.
- C. Incorrect.
Manually logging into each VM to apply patches is inefficient, error-prone, and contrary to the goal of automation. Additionally, it does not scale well for large environments.
- D. Correct.
Cloud Build is Google's CI/CD service that can be used to automate vulnerability scanning of container images during the build process, ensuring compliance before deployment.
- E. Incorrect.
Using Cloud Functions to schedule manual patching tasks is not an effective solution as it still involves manual effort and does not leverage Google Cloud's automated patching tools.