Centralize VM Image Management with VM Manager

Answer Correct answer: A — Use VM Manager to automatically distribute and apply patches to VMs across your projects, integrated with hardened organization-standard VM images stored in a central repository.

Your organization relies heavily on virtual machines (VMs) in Compute Engine. Due to team growth and resource demands, VM sprawl is becoming problematic. Maintaining consistent security hardening and timely package updates poses an increasing challenge. You need to centralize VM image management and automate the enforcement of security baselines throughout the virtual machine lifecycle. What should you do?

Use VM Manager to automatically distribute and apply patches to YMs across your projects. Integrate VM Manager with hardened, organization-standard VM images stored in a central repository. Correct Answer
Configure the sole-tenancy feature in Compute Engine for all projects. Set up custom organization policies in Policy Controller to restrict the operating systems and image sources that teams are allowed to use.
Create a Cloud Build trigger to build a pipeline that generates hardened VM images. Run vulnerability scans in the pipeline, and store images with passing scans in a registry. Use instance templates pointing to this registry.
Activate Security Command Center Enterprise. Use VM discovery and posture management features to monitor hardening state and trigger automatic responses upon detection of issues.

google cloud vm manager compute engine patch management pcse exam practice questions vm sprawl solutions

Community Votes

60%

40%

60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the distinction between runtime management (patching/config) and build-time image creation, identifying VM Manager as the tool for lifecycle enforcement rather than just static image building.

VM Manager is the designated service for centralizing patch management and configuration enforcement across Compute Engine VMs. Community consensus confirms that integrating it with a central image repository addresses both sprawl and security baseline automation.

Candidates often select Option C because it describes a robust CI/CD pipeline for hardened images, but this fails to address the ongoing requirement for timely package updates and runtime patching during the VM's lifecycle.

Community Discussion (7 comments)

Pime13 👍 1 Selected: C

This approach ensures that: Centralized Image Management: Hardened VM images are created and stored in a central registry. Automated Security Enforcement: Vulnerability scans are run in the pipeline, ensuring that only secure images are used. Consistency: Instance templates pointing to the registry ensure that all VMs are created from the approved, secure images. Option A suggests using VM Manager to automatically distribute and apply patches to VMs across your projects and integrating VM Manager with hardened, organization-standard VM images stored in a central repository. While this approach addresses patch management and centralizes image storage, it doesn't fully automate the enforcement of security baselines throughout the VM lifecycle.

BPzen 👍 1 Selected: C

Explanation: VM sprawl and security hardening challenges necessitate a robust solution for centralized VM image management and automation of security baselines. Implementing a pipeline to create, validate, and distribute hardened images ensures consistency, security, and compliance throughout the VM lifecycle. While VM Manager is excellent for patch management, it does not centralize or automate the creation of hardened VM images. This solution does not address the root cause of inconsistent VM configurations caused by VM sprawl.

KLei 👍 1 Selected: A

VM Manager allows you to automate the management of your virtual machines, including patch management.

koo_kai 👍 1 Selected: A

It's A

1e22522 👍 4 Selected: A

It's A 100%

SQLbox 👍 3

A is the correct answer ,VM Manager allows you to centrally manage and automate patching, configuration management, and compliance enforcement for VMs. By integrating with hardened VM images stored in a central repository, you ensure that VMs are consistently created with security baselines and regularly updated. • This solution provides automation and central control, which addresses both the challenges of VM sprawl and the need for consistent security.

yokoyan 👍 2 Selected: C

I think it's C.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option A correctly identifies Google Cloud VM Manager as the solution for centralized operational management. VM Manager provides agent-based capabilities to automatically distribute OS patches, manage configurations, and enforce compliance policies across fleets of VMs. By combining this with a central repository of hardened base images, you establish a consistent starting point and maintain it over time through automated updates.

Why the Other Options Are Wrong

Option C focuses solely on the build phase via Cloud Build; while it creates secure images, it lacks the runtime agent required for continuous patching and drift remediation mentioned in the prompt. Option B relies on Policy Controller to restrict image sources, which is a governance control but does not automate the actual hardening or patching processes. Option D uses Security Command Center for monitoring and posture management, which detects issues but does not inherently perform the centralized management or automated patching actions described.

Community Comment Notes

Comments [1] and [5] strongly support Option A, emphasizing that VM Manager handles both patching and configuration management. Comments [2], [3], and [6] argue for Option C, focusing on the 'image management' aspect, but they overlook the critical requirement for 'timely package updates' which requires a runtime agent like VM Manager.

Official Reference

https://cloud.google.com/compute/docs/instances/managing-instance-updates

Exam Strategy

When questions mention 'centralized management,' 'patching,' or 'configuration enforcement' for running VMs, prioritize VM Manager over build-time tools like Cloud Build or static policies.

Frequently Asked Questions

Why isn't Cloud Build sufficient for VM image management?

Cloud Build only handles the image creation phase. It cannot patch or update already deployed VMs, which is required for ongoing security baselines.

Does VM Manager replace the need for hardened base images?

No. VM Manager manages the lifecycle (patches/config) of existing VMs. You still need hardened base images to ensure a secure starting state before deployment.

Related Analysis

← Back to PCSE Study Guide