GCP Professional Cloud Security Engineer Practice Question

Your security team maintains a Git repository containing CIS benchmark hardening scripts for Debian-based workloads. They require that every new Compute Engine VM and every GKE node pool boot from an image that was built with those scripts. Other projects across the organization must be able to consume, but not modify, the images, and the newest patch level should be selected automatically at instance creation time. With minimal operational overhead, which architecture best satisfies these requirements?

Maintain Deployment Manager templates that embed the hardening scripts as startup scripts; give each consumer project deploymentmanager.editor to deploy the templates when creating resources.
Schedule weekly OS Config patch jobs in every project; at boot time VMs download the CIS scripts from Cloud Storage and run them through startup scripts.
Trigger Cloud Build on repository changes to run a Packer template that applies the hardening scripts, creates a custom image in a dedicated "golden-images" project, assigns the image to an image family, and grants consumer projects the compute.imageUser role on that project.
Build hardened container images with Cloud Build, store them in Artifact Registry, and use Container-Optimized OS nodes so that GKE pulls the images for node pools.

Report Issue

Answer Description

The most efficient approach is to automate image creation in a central "golden-images" project. A Cloud Build trigger that runs a Packer template can apply the CIS scripts and produce a hardened custom image. By adding the image to an image family, Compute Engine and GKE will always resolve the latest, most recently patched image when the family is referenced. Granting consumer projects the compute.imageUser role on the golden-images project gives them permission to use, but not change, the images. The other options either leave hardening to post-boot processes, do not deliver VM images, or require each project to maintain its own infrastructure, violating the minimal-overhead and central-control requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.