For compliance reporting purposes, the internal audit department needs you to provide the list of virtual machines (VMs) that have critical operating system (OS) security updates available, but not…

Question

Options

• ARun a Security Command Center security scan on all VMs to extract a list of VMs with critical OS
• BRun a gcloud CLI command from the Command Line Interface (CLI) to extract the VM's OS
• CEnsure that the Cloud Logging agent is installed on all VMs, and extract the OS last update log
• DEnsure the OS Config agent is installed on all VMs and extract the patch status dashboard every

• A
  8% (2)
• B
  19% (5)
• C
  4% (1)
• D
  69% (18)

Explanation

The OS Config agent enables Google Cloud's VM Manager service, which includes a Patch Compliance dashboard. This dashboard shows the patch status of all enrolled VMs - including which critical OS patches are available but not yet applied - without requiring manual scripting or log analysis. It is the purpose-built GCP tool for this exact compliance use case and can be queried on demand every six months. Option A (Security Command Center) scans for vulnerabilities but is not specifically a patch inventory tool. Option B (gcloud CLI for OS patch data) would require custom scripting and is less efficient. Option C (Cloud Logging agent + log analysis) is indirect and not designed for patch status reporting.

No community discussion yet for this question.