An enterprise runs a critical web application on Compute Engine instances distributed across multiple zones, consisting of both Debian Linux and Windows Server virtual machines (VMs). To maintain compliance and patch vulnerabilities, the security team requires an automated patching solution that satisfies these criteria: Automatically execute patch updates on a recurring schedule targeting only critical and security updates. Roll out updates zone-by-zone to minimize blast radius and avoid downtime. Ensure no more than 20% of instances in any given zone are disrupted at any time during the patching process. Automatically halt the rollout across remaining zones if the disruption threshold is exceeded due to failed patch operations. Run custom pre-patch backup scripts and post-patch application health verification scripts on each instance. Which solution should you implement to satisfy these requirements?

Configure a scheduled patch deployment in VM Manager with a zone-by-zone rollout mode, a 20% disruption budget, pre-patch and post-patch ExecStepConfig scripts, and OS-specific security classifications.: What VM Manager Patch Deployments Are VM Manager Patch deployments are part of the Google Cloud Compute Engine VM Manager suite. They allow administrators to automate and schedule operating system patch jobs across large, heterogeneous fleets of Windows and Linux VMs. Patch deployments enable fine-grained control over which packages to update, reboot configurations, execution scripts, and rollout velocity. How It Meets the Requirements Scheduled automated patching: VM Manager patch deployments allow recurring schedules to be defined, applying updates automatically without manual invocation. Targeting security updates: Patch configurations allow specific package filtering, such as --apt-dist or apt package rules for Debian, and CRITICAL and SECURITY update classifications for Windows (windowsUpdate). Zone-by-zone rollout with disruption budget: Setting the rollout mode to zone-by-zone with a disruption budget of 20% limits concurrent patching and reboots to at most 20% of VMs in a zone at any given moment. Automated failure halting: In a zone-by-zone rollout, if failed patching operations exceed the defined disruption budget in the active zone, the patch deployment automatically halts before proceeding to subsequent zones. Pre- and post-patch scripts: Through ExecStepConfig (or pre-patch/post-patch script settings in the Cloud Console/CLI), custom scripts can be retrieved locally or from Cloud Storage buckets to take backups before patching and verify health post-reboot. Key Advantages and Capabilities Granular update filters: Apply OS-native package updates (apt, yum, zypper, Windows Update) selectively. Flexible disruption control: Control impact using either fixed instance counts or percentages. Automated lifecycle management: Handles pre-scripts, package installation, reboots (DEFAULT, ALWAYS, NEVER), and post-scripts in an orchestrated workflow. Centralized reporting: Integrates natively with the Patch dashboard to monitor compliance and update statuses. Why This Is Optimal This solution uses native Google Cloud patching automation specifically built for multi-OS VM fleets. It natively enforces rollout safety constraints like disruption budgets and zone-by-zone staging without needing custom orchestrator pipelines or third-party patch software.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Vm Manager Automated Patch Management Rollout Strategy

Section: Infrastructure orchestration, resource configuration, and patch management

An enterprise runs a critical web application on Compute Engine instances distributed across multiple zones, consisting of both Debian Linux and Windows Server virtual machines (VMs). To maintain compliance and patch vulnerabilities, the security team requires an automated patching solution that satisfies these criteria:

Automatically execute patch updates on a recurring schedule targeting only critical and security updates.
Roll out updates zone-by-zone to minimize blast radius and avoid downtime.
Ensure no more than 20% of instances in any given zone are disrupted at any time during the patching process.
Automatically halt the rollout across remaining zones if the disruption threshold is exceeded due to failed patch operations.
Run custom pre-patch backup scripts and post-patch application health verification scripts on each instance.

Which solution should you implement to satisfy these requirements?

Configure a scheduled patch deployment in VM Manager with a zone-by-zone rollout mode, a 20% disruption budget, pre-patch and post-patch ExecStepConfig scripts, and OS-specific security classifications.

Configure Managed Instance Group (MIG) opportunistic rolling updates with a 20% maxUnavailable parameter, referencing a new instance template containing pre-patch and post-patch startup scripts.

Configure an OS Policy assignment in VM Manager set to ENFORCEMENT mode targeting all VMs, configuring a concurrent-zones rollout mode with a 20% disruption budget and custom validation scripts.

Create a Cloud Scheduler job that invokes a Cloud Function to run the gcloud compute os-config patch-jobs execute command using concurrent-zones rollout with a fixed disruption budget of 20 VMs.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Vm Manager Automated Patch Management Rollout Strategy

Section: Infrastructure orchestration, resource configuration, and patch management

Automatically execute patch updates on a recurring schedule targeting only critical and security updates.
Roll out updates zone-by-zone to minimize blast radius and avoid downtime.
Ensure no more than 20% of instances in any given zone are disrupted at any time during the patching process.
Automatically halt the rollout across remaining zones if the disruption threshold is exceeded due to failed patch operations.
Run custom pre-patch backup scripts and post-patch application health verification scripts on each instance.

Which solution should you implement to satisfy these requirements?

Configure Managed Instance Group (MIG) opportunistic rolling updates with a 20% maxUnavailable parameter, referencing a new instance template containing pre-patch and post-patch startup scripts.

Configure an OS Policy assignment in VM Manager set to ENFORCEMENT mode targeting all VMs, configuring a concurrent-zones rollout mode with a 20% disruption budget and custom validation scripts.

Create a Cloud Scheduler job that invokes a Cloud Function to run the gcloud compute os-config patch-jobs execute command using concurrent-zones rollout with a fixed disruption budget of 20 VMs.

Explanations

What VM Manager Patch Deployments Are

VM Manager Patch deployments are part of the Google Cloud Compute Engine VM Manager suite. They allow administrators to automate and schedule operating system patch jobs across large, heterogeneous fleets of Windows and Linux VMs. Patch deployments enable fine-grained control over which packages to update, reboot configurations, execution scripts, and rollout velocity.

How It Meets the Requirements

Scheduled automated patching: VM Manager patch deployments allow recurring schedules to be defined, applying updates automatically without manual invocation.
Targeting security updates: Patch configurations allow specific package filtering, such as --apt-dist or apt package rules for Debian, and CRITICAL and SECURITY update classifications for Windows (windowsUpdate).
Zone-by-zone rollout with disruption budget: Setting the rollout mode to zone-by-zone with a disruption budget of 20% limits concurrent patching and reboots to at most 20% of VMs in a zone at any given moment.
Automated failure halting: In a zone-by-zone rollout, if failed patching operations exceed the defined disruption budget in the active zone, the patch deployment automatically halts before proceeding to subsequent zones.
Pre- and post-patch scripts: Through ExecStepConfig (or pre-patch/post-patch script settings in the Cloud Console/CLI), custom scripts can be retrieved locally or from Cloud Storage buckets to take backups before patching and verify health post-reboot.

Key Advantages and Capabilities

Granular update filters: Apply OS-native package updates (apt, yum, zypper, Windows Update) selectively.
Flexible disruption control: Control impact using either fixed instance counts or percentages.
Automated lifecycle management: Handles pre-scripts, package installation, reboots (DEFAULT, ALWAYS, NEVER), and post-scripts in an orchestrated workflow.
Centralized reporting: Integrates natively with the Patch dashboard to monitor compliance and update statuses.

Why This Is Optimal

This solution uses native Google Cloud patching automation specifically built for multi-OS VM fleets. It natively enforces rollout safety constraints like disruption budgets and zone-by-zone staging without needing custom orchestrator pipelines or third-party patch software.

View source documentation

Professional Cloud Architect

Vm Manager Automated Patch Management Rollout Strategy

Professional Cloud Architect

Vm Manager Automated Patch Management Rollout Strategy

What VM Manager Patch Deployments Are

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions