Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your security team mandates that every Compute Engine VM start from a CIS-hardened custom image that is automatically rebuilt when either (1) Google posts a new debian-11 base image or (2) approved hardening scripts change in Cloud Source Repositories. The pipeline must apply the scripts, install the latest patches, halt on any high-severity CVEs, and keep only the three newest compliant images. Which design delivers this with the least manual effort?

  • Create two Cloud Build triggers: a Cloud Source Repositories trigger for the hardening branch and a Cloud Scheduler-initiated Pub/Sub trigger that runs daily. Both invoke a Cloud Build YAML file that runs Packer to build a shielded image from the latest debian-11 family, applies the hardening scripts, updates all packages, executes an in-pipeline vulnerability scanner that fails the build on any high or critical CVE, publishes the image to a custom family, and then deletes images in that family beyond the three newest.

  • Deploy VMs with Deployment Manager that reference the publicly available debian-11-csi-hardened image family, attach Cloud Armor policies, and enable Shielded VM integrity monitoring to detect vulnerabilities. Allow teams to select any version within that family.

  • When Google releases a new debian-11 image, manually create a local VM, run the hardening scripts, export the disk to Cloud Storage, and import it as a custom image. Mark the image as deprecated after three newer images exist.

  • Enable OS patch management in VM Manager to run a weekly patch job and store the hardening scripts in a Cloud Storage bucket. Have each VM execute the scripts from startup-script metadata and rely on rolling updates in managed instance groups to phase in patched VMs.

GCP Professional Cloud Security Engineer
Managing operations
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot