Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that…

Using Google Shielded VM addresses boot and kernel-level malware but does not include the hardware-based protection for data in use provided by Confidential VM, which prevents the host from reading the data.

Activating Virtual Machine Threat Detection (VMTD) in Security Command Center (SCC) Premium detects threats but does not proactively prevent boot-level compromise or provide hardware-based protection for data in use from the underlying host.

Google Shielded VM with secure boot and Virtual Trusted Platform Module (vTPM) protects against boot-level and kernel-level malware by verifying the integrity of the boot process and providing a secure identity. Confidential VM, by using hardware-based encryption, ensures that data in use (memory and CPU state) cannot be accessed by the underlying host system, thus meeting both requirements for comprehensive protection.

Using secure hardened images from Google Cloud Marketplace is a good security practice but does not provide the specific boot-level integrity protections of Shielded VM or the hardware-based data-in-use protection of Confidential VM.