An enterprise runs a critical web application on Compute Engine instances distributed across multiple zones, consisting of both Debian Linux and Windows Server virtual machines (VMs). To maintain compliance and patch vulnerabilities, the security team requires an automated patching solution that satisfies these criteria: Automatically execute patch updates on a recurring schedule targeting only critical and security updates. Roll out updates zone-by-zone to minimize blast radius and avoid downtime. Ensure no more than 20% of instances in any given zone are disrupted at any time during the patching process. Automatically halt the rollout across remaining zones if the disruption threshold is exceeded due to failed patch operations. Run custom pre-patch backup scripts and post-patch application health verification scripts on each instance. Which solution should you implement to satisfy these requirements?

Configure a scheduled patch deployment in VM Manager with a zone-by-zone rollout mode, a 20% disruption budget, pre-patch and post-patch ExecStepConfig scripts, and OS-specific security classifications.: ### What VM Manager Patch Deployments Are **VM Manager Patch deployments** are part of the Google Cloud **Compute Engine VM Manager** suite. They allow administrators to automate and schedule operating system patch jobs across large, heterogeneous fleets of **Windows** and **Linux VMs**. Patch deployments enable fine-grained control over which packages to update, reboot configurations, execution scripts, and rollout velocity. ### How It Meets the Requirements - **Scheduled automated patching:** VM Manager patch deployments allow recurring schedules to be defined, applying updates automatically without manual invocation. - **Targeting security updates:** Patch configurations allow specific package filtering, such as `--apt-dist` or apt package rules for Debian, and `CRITICAL` and `SECURITY` update classifications for Windows (`windowsUpdate`). - **Zone-by-zone rollout with disruption budget:** Setting the rollout mode to `zone-by-zone` with a **disruption budget** of 20% limits concurrent patching and reboots to at most 20% of VMs in a zone at any given moment. - **Automated failure halting:** In a `zone-by-zone` rollout, if failed patching operations exceed the defined disruption budget in the active zone, the patch deployment automatically halts before proceeding to subsequent zones. - **Pre- and post-patch scripts:** Through `ExecStepConfig` (or pre-patch/post-patch script settings in the Cloud Console/CLI), custom scripts can be retrieved locally or from **Cloud Storage** buckets to take backups before patching and verify health post-reboot. ### Key Advantages and Capabilities - **Granular update filters:** Apply OS-native package updates (`apt`, `yum`, `zypper`, `Windows Update`) selectively. - **Flexible disruption control:** Control impact using either fixed instance counts or percentages. - **Automated lifecycle management:** Handles pre-scripts, package installation, reboots (`DEFAULT`, `ALWAYS`, `NEVER`), and post-scripts in an orchestrated workflow. - **Centralized reporting:** Integrates natively with the **Patch dashboard** to monitor compliance and update statuses. ### Why This Is Optimal This solution uses native Google Cloud patching automation specifically built for multi-OS VM fleets. It natively enforces rollout safety constraints like disruption budgets and zone-by-zone staging without needing custom orchestrator pipelines or third-party patch software.

StudyCerts

Vm Manager Automated Patch Management Rollout Strategy | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Vm Manager Automated Patch Management Rollout Strategy

Section: Infrastructure orchestration, resource configuration, and patch management

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise runs a critical web application on Compute Engine instances distributed across multiple zones, consisting of both Debian Linux and Windows Server virtual machines (VMs). To maintain compliance and patch vulnerabilities, the security team requires an automated patching solution that satisfies these criteria:

Automatically execute patch updates on a recurring schedule targeting only critical and security updates.
Roll out updates zone-by-zone to minimize blast radius and avoid downtime.
Ensure no more than 20% of instances in any given zone are disrupted at any time during the patching process.
Automatically halt the rollout across remaining zones if the disruption threshold is exceeded due to failed patch operations.
Run custom pre-patch backup scripts and post-patch application health verification scripts on each instance.

Which solution should you implement to satisfy these requirements?

Configure an OS Policy assignment in VM Manager set to ENFORCEMENT mode targeting all VMs, configuring a concurrent-zones rollout mode with a 20% disruption budget and custom validation scripts.

Configure Managed Instance Group (MIG) opportunistic rolling updates with a 20% maxUnavailable parameter, referencing a new instance template containing pre-patch and post-patch startup scripts.

Configure a scheduled patch deployment in VM Manager with a zone-by-zone rollout mode, a 20% disruption budget, pre-patch and post-patch ExecStepConfig scripts, and OS-specific security classifications.

Create a Cloud Scheduler job that invokes a Cloud Function to run the gcloud compute os-config patch-jobs execute command using concurrent-zones rollout with a fixed disruption budget of 20 VMs.

Professional Cloud Architect

Vm Manager Automated Patch Management Rollout Strategy

Related questions