GCP Professional Cloud Security Engineer Practice Question

Your security team maintains a hardened Ubuntu image that Cloud Build rebuilds weekly and pushes to Artifact Registry with a timestamp tag. Hundreds of stateless front-end VMs run in several zonal managed instance groups (MIGs) that currently reference the previous image version. Compliance requires every VM to run the latest image within 24 hours of its publication, with zero downtime and no human intervention. Which solution best meets these requirements?

Point each managed instance group's instance template to the image's family and set the group's updatePolicy type to OPPORTUNISTIC so that instances automatically refresh when a new family image appears.
Create a Cloud Scheduler job that replaces each VM's boot disk with a snapshot of the new image during low-traffic hours.
Add steps to the Cloud Build pipeline that, after the new image is pushed, create an updated instance template and invoke a managed instance group rolling update with maxSurge set to 25 % and maxUnavailable set to 0.
Configure OS Config patch jobs to run weekly and apply all available security patches in place, forcing a reboot of each VM after patching.

Report Issue

Answer Description

A Cloud Build pipeline can be extended to automate both creation of a new instance template that points at the freshly built image and a rolling update for each managed instance group. When a rolling update is started with a proactive strategy (for example, maxSurge 25 % and maxUnavailable 0), the MIG adds new instances based on the new template before deleting the old ones, providing continuous capacity and no service interruption. In-place OS patch jobs meet patching needs but do not replace VMs with the new golden image. Setting an instance template to an image family does not trigger automatic refresh of existing VMs; a new template or an explicit update is still required. Overwriting boot disks with snapshots is not supported and would cause downtime.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.