Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements…

Question

Options

• AImplement an organization policy to enforce that boot disks can only be created from images that
• BImplement an organization policy constraint that enables the Shielded VM service on all projects
• CCreate a Cloud Function that is automatically triggered when a new virtual machine is created
• DAutomate a security scanner that verifies that no common vulnerabilities and exposures (CVEs)

• A
  76% (32)
• B
  12% (5)
• C
  7% (3)
• D
  5% (2)

Explanation

Google Cloud organization policy constraints can enforce that VM boot disks may only be created from images stored in a specific set of trusted projects (e.g., your centrally managed image repository). This policy applies across all projects in the organization, ensuring no project can spin up a VM from an untrusted or unapproved image - regardless of where the VM is created. Shielded VM (B) provides runtime integrity verification but does not control which source images are used. A Cloud Function trigger (C) is reactive and allows non-compliant VMs to exist briefly before remediation. Automated CVE scanning (D) can detect vulnerabilities but does not enforce trust at image selection time.

No community discussion yet for this question.