An enterprise runs critical multi-tier applications across a fleet of standalone Compute Engine virtual machines (VMs) located across multiple zones. The security and infrastructure teams need to implement an automated patch management strategy that meets the following operational and security requirements: Automatically apply high and critical security patches on a scheduled, recurring basis within a strict 2-hour maintenance window. Prevent downtime by patching instances progressively across zones rather than simultaneously across the entire fleet. Restrict the number of concurrently updating VMs within any single zone to no more than 20% of the zone's target VMs. Execute custom service shutdown and health verification tasks before and after patching on each VM using centrally maintained scripts. Which solution should the security engineer implement using Google Cloud native services?

Create a recurring Patch Deployment in VM Manager with a 2-hour duration, configure the rollout options to patch one zone at a time with a 20% disruption budget, and specify pre-patch and post-patch scripts located in a Cloud Storage bucket accessed by the VM service accounts.: What VM Manager Patch Deployment is VM Manager Patch Deployment is a Google Cloud native service within Compute Engine designed to automate and orchestrate operating system updates across fleets of Linux and Windows virtual machines. It allows administrators to define automated patch schedules, maintenance windows, targeting filters, update categories, and custom scripting lifecycle hooks. How it meets the requirements Automated recurring maintenance window: Defining a recurring schedule with a specified duration of 2 hours ensures that patch jobs execute automatically at set intervals and do not initiate new patching tasks outside the designated maintenance window. Progressive zonal rollout and disruption control: The rollout options feature in patch deployments enables multi-zone staging by selecting patch one zone at a time and enforcing a disruption budget (set to 20%). This limits the concurrent number of VMs undergoing updates in any active zone, preserving application capacity and eliminating fleet-wide downtime. Pre-patch and post-patch lifecycle scripts: VM Manager allows uploading and referencing pre-patch and post-patch scripts stored in a Cloud Storage bucket. The VM's attached service account authenticates to fetch the script, enabling pre-patch graceful service draining and post-patch application health verification. Key advantages Granular update classification: Supports selective installation of security, critical, or specific package updates across Debian, Ubuntu, RHEL, Rocky Linux, SLES, and Windows. Disruption budget governance: Ensures high availability by preventing all instances in a zone or service from rebooting at once. Centralized reporting: Fully integrates with Cloud Logging, Cloud Monitoring, and the VM Manager Patch Dashboard to provide compliance posture tracking. Why this is optimal Using native VM Manager Patch Deployments provides complete control over scheduled maintenance windows, progressive zonal rollouts, disruption thresholds, and script execution without requiring third-party configuration tools or custom orchestrators.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Vm Manager Patch Deployment Rollout Strategy

Section: Automating virtual machine and container image creation (e.g., hardening, maintenance, VM patch management).

An enterprise runs critical multi-tier applications across a fleet of standalone Compute Engine virtual machines (VMs) located across multiple zones. The security and infrastructure teams need to implement an automated patch management strategy that meets the following operational and security requirements:

Automatically apply high and critical security patches on a scheduled, recurring basis within a strict 2-hour maintenance window.
Prevent downtime by patching instances progressively across zones rather than simultaneously across the entire fleet.
Restrict the number of concurrently updating VMs within any single zone to no more than 20% of the zone's target VMs.
Execute custom service shutdown and health verification tasks before and after patching on each VM using centrally maintained scripts.

Which solution should the security engineer implement using Google Cloud native services?

Execute an immediate, on-demand Patch Job with an instance filter targeting all instances across the project (--instance-filter-all), specifying pre-patch and post-patch scripts stored locally in the root directory of each VM.

Configure Managed Instance Group (MIG) rolling updates with an opportunistic update policy, attaching an application-based autohealing health check to automatically reboot and patch the standalone instances.

Create a recurring Patch Deployment in VM Manager with a 2-hour duration, configure the rollout options to patch one zone at a time with a 20% disruption budget, and specify pre-patch and post-patch scripts located in a Cloud Storage bucket accessed by the VM service accounts.

Trigger Cloud Functions via Cloud Scheduler to run gcloud compute instances perform-maintenance concurrently across all zones, utilizing Cloud SQL maintenance windows to manage VM reboots.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Vm Manager Patch Deployment Rollout Strategy

Section: Automating virtual machine and container image creation (e.g., hardening, maintenance, VM patch management).

Automatically apply high and critical security patches on a scheduled, recurring basis within a strict 2-hour maintenance window.
Prevent downtime by patching instances progressively across zones rather than simultaneously across the entire fleet.
Restrict the number of concurrently updating VMs within any single zone to no more than 20% of the zone's target VMs.
Execute custom service shutdown and health verification tasks before and after patching on each VM using centrally maintained scripts.

Which solution should the security engineer implement using Google Cloud native services?

Trigger Cloud Functions via Cloud Scheduler to run gcloud compute instances perform-maintenance concurrently across all zones, utilizing Cloud SQL maintenance windows to manage VM reboots.

Explanations

What VM Manager Patch Deployment is

VM Manager Patch Deployment is a Google Cloud native service within Compute Engine designed to automate and orchestrate operating system updates across fleets of Linux and Windows virtual machines. It allows administrators to define automated patch schedules, maintenance windows, targeting filters, update categories, and custom scripting lifecycle hooks.

How it meets the requirements

Automated recurring maintenance window: Defining a recurring schedule with a specified duration of 2 hours ensures that patch jobs execute automatically at set intervals and do not initiate new patching tasks outside the designated maintenance window.
Progressive zonal rollout and disruption control: The rollout options feature in patch deployments enables multi-zone staging by selecting patch one zone at a time and enforcing a disruption budget (set to 20%). This limits the concurrent number of VMs undergoing updates in any active zone, preserving application capacity and eliminating fleet-wide downtime.
Pre-patch and post-patch lifecycle scripts: VM Manager allows uploading and referencing pre-patch and post-patch scripts stored in a Cloud Storage bucket. The VM's attached service account authenticates to fetch the script, enabling pre-patch graceful service draining and post-patch application health verification.

Key advantages

Granular update classification: Supports selective installation of security, critical, or specific package updates across Debian, Ubuntu, RHEL, Rocky Linux, SLES, and Windows.
Disruption budget governance: Ensures high availability by preventing all instances in a zone or service from rebooting at once.
Centralized reporting: Fully integrates with Cloud Logging, Cloud Monitoring, and the VM Manager Patch Dashboard to provide compliance posture tracking.

Why this is optimal

Using native VM Manager Patch Deployments provides complete control over scheduled maintenance windows, progressive zonal rollouts, disruption thresholds, and script execution without requiring third-party configuration tools or custom orchestrators.

View source documentation

Professional Cloud Security Engineer

Vm Manager Patch Deployment Rollout Strategy

Professional Cloud Security Engineer

Vm Manager Patch Deployment Rollout Strategy

What VM Manager Patch Deployment is

How it meets the requirements

Key advantages

Why this is optimal

Related questions