GCP Professional Cloud Security Engineer Practice Question

Your security team mandates that all Compute Engine instances in several regional managed instance groups use a hardened custom image that is rebuilt weekly with the latest OS patches. You have a Cloud Build pipeline that produces a new image each week. You need to roll out each image safely, run canary tests first, and allow fast rollback while minimizing custom scripting. Which approach should you take?

Enable automatic patch rollout on the custom image family so that Compute Engine transparently replaces disk blocks on running VMs when a newer family image becomes available.
Publish each weekly image to a staging image family that is referenced by a canary managed instance group. After tests pass, promote the same image to a production image family referenced by the main instance template and start a managed rolling update, allowing rollback by re-promoting the previous image.
Run a weekly OS Config patch job that installs updates in place on every VM in the production managed instance group, eliminating the need to rebuild or roll out new images.
Push the weekly build as a privileged container to Artifact Registry and deploy a DaemonSet that mounts each node's root filesystem and overwrites binaries with the contents of the container after smoke tests.

Report Issue

Answer Description

Publishing each weekly build into a custom image family lets you take advantage of Google-managed mechanics instead of bespoke scripts. Cloud Build can set the new image as the latest in a staging family that is referenced by a canary managed instance group; only those test VMs pick up the build. When tests succeed you promote the image to a production family, update or refresh the production managed instance group, and let its rolling-update policy (maxSurge / maxUnavailable) gradually replace instances. Because you are referencing an immutable image by its family, reverting simply means re-promoting the previous image and starting another rolling update. OS Config patch jobs update running VMs but do not refresh your golden image and leave configuration drift (choice B). Compute Engine cannot live-patch running disks when a family is updated (choice C). Using privileged containers to overwrite host binaries (choice D) is unsupported and risky, adding more operational burden instead of reducing it.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.