Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise runs a critical web application on Compute Engine instances distributed across multiple zones, consisting of both Debian Linux and Windows Server virtual machines (VMs). To maintain compliance and patch vulnerabilities, the security team requires an automated patching solution that satisfies these criteria:
Which solution should you implement to satisfy these requirements?
Configure an OS Policy assignment in VM Manager set to ENFORCEMENT mode targeting all VMs, configuring a concurrent-zones rollout mode with a 20% disruption budget and custom validation scripts.
Configure a scheduled patch deployment in VM Manager with a zone-by-zone rollout mode, a 20% disruption budget, pre-patch and post-patch ExecStepConfig scripts, and OS-specific security classifications.
Create a Cloud Scheduler job that invokes a Cloud Function to run the gcloud compute os-config patch-jobs execute command using concurrent-zones rollout with a fixed disruption budget of 20 VMs.
Configure Managed Instance Group (MIG) opportunistic rolling updates with a 20% maxUnavailable parameter, referencing a new instance template containing pre-patch and post-patch startup scripts.
Configure an OS Policy assignment in VM Manager set to ENFORCEMENT mode targeting all VMs, configuring a concurrent-zones rollout mode with a 20% disruption budget and custom validation scripts.
Configure a scheduled patch deployment in VM Manager with a zone-by-zone rollout mode, a 20% disruption budget, pre-patch and post-patch ExecStepConfig scripts, and OS-specific security classifications.
VM Manager Patch deployments are part of the Google Cloud Compute Engine VM Manager suite. They allow administrators to automate and schedule operating system patch jobs across large, heterogeneous fleets of Windows and Linux VMs. Patch deployments enable fine-grained control over which packages to update, reboot configurations, execution scripts, and rollout velocity.
StudyCerts
StudyCerts--apt-dist or apt package rules for Debian, and CRITICAL and SECURITY update classifications for Windows (windowsUpdate).zone-by-zone with a disruption budget of 20% limits concurrent patching and reboots to at most 20% of VMs in a zone at any given moment.zone-by-zone rollout, if failed patching operations exceed the defined disruption budget in the active zone, the patch deployment automatically halts before proceeding to subsequent zones.ExecStepConfig (or pre-patch/post-patch script settings in the Cloud Console/CLI), custom scripts can be retrieved locally or from Cloud Storage buckets to take backups before patching and verify health post-reboot.apt, yum, zypper, Windows Update) selectively.DEFAULT, ALWAYS, NEVER), and post-scripts in an orchestrated workflow.This solution uses native Google Cloud patching automation specifically built for multi-OS VM fleets. It natively enforces rollout safety constraints like disruption budgets and zone-by-zone staging without needing custom orchestrator pipelines or third-party patch software.
Create a Cloud Scheduler job that invokes a Cloud Function to run the gcloud compute os-config patch-jobs execute command using concurrent-zones rollout with a fixed disruption budget of 20 VMs.
Configure Managed Instance Group (MIG) opportunistic rolling updates with a 20% maxUnavailable parameter, referencing a new instance template containing pre-patch and post-patch startup scripts.