An enterprise runs critical multi-tier applications across a fleet of standalone Compute Engine virtual machines (VMs) located across multiple zones. The security and infrastructure teams need to implement an automated patch management strategy that meets the following operational and security requirements: Automatically apply high and critical security patches on a scheduled, recurring basis within a strict 2-hour maintenance window. Prevent downtime by patching instances progressively across zones rather than simultaneously across the entire fleet. Restrict the number of concurrently updating VMs within any single zone to no more than 20% of the zone's target VMs. Execute custom service shutdown and health verification tasks before and after patching on each VM using centrally maintained scripts. Which solution should the security engineer implement using Google Cloud native services?

Create a recurring Patch Deployment in VM Manager with a 2-hour duration, configure the rollout options to patch one zone at a time with a 20% disruption budget, and specify pre-patch and post-patch scripts located in a Cloud Storage bucket accessed by the VM service accounts.: ### What VM Manager Patch Deployment is **VM Manager Patch Deployment** is a Google Cloud native service within Compute Engine designed to automate and orchestrate operating system updates across fleets of Linux and Windows virtual machines. It allows administrators to define automated patch schedules, maintenance windows, targeting filters, update categories, and custom scripting lifecycle hooks. ### How it meets the requirements - **Automated recurring maintenance window**: Defining a recurring schedule with a specified **duration** of 2 hours ensures that patch jobs execute automatically at set intervals and do not initiate new patching tasks outside the designated maintenance window. - **Progressive zonal rollout and disruption control**: The **rollout options** feature in patch deployments enables multi-zone staging by selecting **patch one zone at a time** and enforcing a **disruption budget** (set to `20%`). This limits the concurrent number of VMs undergoing updates in any active zone, preserving application capacity and eliminating fleet-wide downtime. - **Pre-patch and post-patch lifecycle scripts**: VM Manager allows uploading and referencing **pre-patch and post-patch scripts** stored in a **Cloud Storage bucket**. The VM's attached service account authenticates to fetch the script, enabling pre-patch graceful service draining and post-patch application health verification. ### Key advantages - **Granular update classification**: Supports selective installation of security, critical, or specific package updates across Debian, Ubuntu, RHEL, Rocky Linux, SLES, and Windows. - **Disruption budget governance**: Ensures high availability by preventing all instances in a zone or service from rebooting at once. - **Centralized reporting**: Fully integrates with Cloud Logging, Cloud Monitoring, and the VM Manager Patch Dashboard to provide compliance posture tracking. ### Why this is optimal Using native **VM Manager Patch Deployments** provides complete control over scheduled maintenance windows, progressive zonal rollouts, disruption thresholds, and script execution without requiring third-party configuration tools or custom orchestrators.

Vm Manager Patch Deployment Rollout Strategy | Professional Cloud Security Engineer

Vm Manager Patch Deployment Rollout Strategy

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise runs critical multi-tier applications across a fleet of standalone Compute Engine virtual machines (VMs) located across multiple zones. The security and infrastructure teams need to implement an automated patch management strategy that meets the following operational and security requirements:

Automatically apply high and critical security patches on a scheduled, recurring basis within a strict 2-hour maintenance window.
Prevent downtime by patching instances progressively across zones rather than simultaneously across the entire fleet.
Restrict the number of concurrently updating VMs within any single zone to no more than 20% of the zone's target VMs.
Execute custom service shutdown and health verification tasks before and after patching on each VM using centrally maintained scripts.

Which solution should the security engineer implement using Google Cloud native services?

Create a recurring Patch Deployment in VM Manager with a 2-hour duration, configure the rollout options to patch one zone at a time with a 20% disruption budget, and specify pre-patch and post-patch scripts located in a Cloud Storage bucket accessed by the VM service accounts.

Configure Managed Instance Group (MIG) rolling updates with an opportunistic update policy, attaching an application-based autohealing health check to automatically reboot and patch the standalone instances.

Execute an immediate, on-demand Patch Job with an instance filter targeting all instances across the project (--instance-filter-all), specifying pre-patch and post-patch scripts stored locally in the root directory of each VM.

Trigger Cloud Functions via Cloud Scheduler to run gcloud compute instances perform-maintenance concurrently across all zones, utilizing Cloud SQL maintenance windows to manage VM reboots.

Professional Cloud Security Engineer

Vm Manager Patch Deployment Rollout Strategy

Related questions