Exam Professional Cloud Security Engineer topic 1 question 182 discussion

The best option would be D. Ensure the OS Config agent is installed on all VMs and extract the patch status dashboard every six months**. The OS Config agent is a service that provides a fast and flexible way to manage operating system configurations across an entire fleet of virtual machines. It can provide information about the patch state of a VM, including which patches are installed, which patches are available, and the severity of the patches. This would allow you to quickly identify VMs that have critical OS security updates available but not installed.

D is correct. https://cloud.google.com/compute/docs/vm-manager

D is correct

D is correct. C can be correct but not effective as D

D: https://cloud.google.com/compute/docs/os-patch-management#:~:text=A%20patch%20deployment%20is%20initiated,target%20VMs%20to%20start%20patching. Cannot be A, as VM Manager patch compliance feature is in preview for in SCC. https://cloud.google.com/security-command-center/docs/concepts-vulnerabilities-findings

I think is D since you can't "run" Security Command Center "security" scan's without vm manager enabled. "If you enable VM Manager with the Security Command Center Premium tier, VM Manager writes its vulnerability reports to Security Command Center by default"

C- Cloud Logging Agent

A Security command center is integrated with vm manager