Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise organization requires all development teams across multiple Google Cloud projects to provision Compute Engine virtual machines exclusively from standardized, security-hardened base images. These images must embed organizational security policies, required logging agents, and baseline development tooling from inception.
You need to establish an automated, centralized image architecture and governance strategy that meets the following requirements:
What should you do?
Create and maintain hardened custom images organized into an image family within a dedicated central project. Enforce an organization policy with the Trusted Image Projects constraint to restrict VM creation across development projects to that central project, and grant developers the Compute Image User role (roles/compute.imageUser) on the central project.
Export custom images from a build project to Cloud Storage buckets as compressed tar.gz archives, give developers Storage Object Viewer permissions, and have each team import the raw image file into their respective project.
Provision standard public OS images across all development projects and attach a startup script in instance templates to download, install, and configure the required security agents and baseline tooling during VM initialization.
Bake hardened custom images in a central project and make them publicly accessible by adding allAuthenticatedUsers with the Compute Image User role (roles/compute.imageUser), while distributing image release IDs to development teams for their provisioning scripts.
Create and maintain hardened custom images organized into an image family within a dedicated central project. Enforce an organization policy with the Trusted Image Projects constraint to restrict VM creation across development projects to that central project, and grant developers the Compute Image User role (roles/compute.imageUser) on the central project.
This solution implements a centralized golden image factory architecture using Compute Engine custom images, image families, Identity and Access Management (IAM) least-privilege roles, and Organization Policy Service constraints.
StudyCerts
StudyCertsfamily/. Compute Engine automatically provisions instances using the most recent, non-deprecated image in that family.constraints/compute.trustedImageProjects) at the organization or folder level blocks developers from launching boot disks from unauthorized public OS repositories or unvetted projects.roles/compute.imageUser gives development teams the exact permission (compute.images.useReadOnly) needed to instantiate disks without granting administrative rights over the images.gcloud compute images deprecate, allowing rollbacks while automatically pointing new VM creations to the newest release.This approach combines native Google Cloud resource governance mechanisms (Organization Policies and IAM) with Compute Engine Image Families, completely eliminating configuration drift and manual script updates while enforcing strict baseline security.
Export custom images from a build project to Cloud Storage buckets as compressed tar.gz archives, give developers Storage Object Viewer permissions, and have each team import the raw image file into their respective project.
Provision standard public OS images across all development projects and attach a startup script in instance templates to download, install, and configure the required security agents and baseline tooling during VM initialization.
Bake hardened custom images in a central project and make them publicly accessible by adding allAuthenticatedUsers with the Compute Image User role (roles/compute.imageUser), while distributing image release IDs to development teams for their provisioning scripts.