Question

A security engineer at a healthcare company runs a fleet of hundreds of Compute Engine VMs. During a vulnerability review, the team discovers that many instances are missing critical OS-level security patches. Leadership wants a Google Cloud-native, centralized way to (1) continuously report which VMs are missing patches and (2) schedule and deploy patches across the fleet on a recurring basis without building custom scripting on each host. Which approach should the engineer implement?

Accepted Answer

Enable the VM Manager suite (OS Config agent) and use OS patch management to generate patch compliance reports and create recurring patch deployment schedules.

Answer

Enable Security Command Center Premium and rely on Security Health Analytics to automatically install missing OS patches on the affected VMs.

Answer

Configure a Cloud Scheduler job that triggers a Cloud Function to SSH into each VM and run the native package manager update command.

Answer

Use Artifact Registry vulnerability scanning to detect the missing patches and apply them through Binary Authorization policies at boot time.