QuestionQ243

Managing operations

Your organization depends heavily on virtual machines (VMs) in Compute Engine. Because the team and resource demands are growing, VM sprawl is becoming a problem. Maintaining consistent security hardening and prompt package updates is increasingly difficult. You need to centralize VM image management and automate enforcement of security baselines across the virtual machine lifecycle. What should you do?

  • A Use VM Manager to automatically distribute and apply patches to YMs across your projects. Integrate VM Manager with hardened, organization-standard VM images stored in a central repository.
  • B Configure the sole-tenancy feature in Compute Engine for all projects. Set up custom organization policies in Policy Controller to restrict the operating systems and image sources that teams are allowed to use.
  • C Create a Cloud Build trigger to build a pipeline that generates hardened VM images. Run vulnerability scans in the pipeline, and store images with passing scans in a registry. Use instance templates pointing to this registry.
  • D Activate Security Command Center Enterprise. Use VM discovery and posture management features to monitor hardening state and trigger automatic responses upon detection of issues.
Explanation

VM Manager provides centralized, scheduled patch deployment for Compute Engine VM fleets. Its OS policies define desired operating-system resources and are periodically checked and enforced on targeted VMs, maintaining configuration consistency and reporting compliance. Organization-standard hardened images in a central image project provide a consistent starting point for newly created VMs, while VM Manager maintains the baseline and updates after deployment.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!