You need to deploy an application on Google Cloud that must run on a Debian Linux environment. The application requires extensive configuration in order to operate correctly. You want to ensure that you can install Debian distribution updates with minimal manual intervention whenever they become available. What should you do?
Creating a Debian-based Compute Engine instance, installing and configuring the application, and using OS patch management is the best approach. OS patch management automates the process of keeping the operating system up-to-date with the latest patches and updates, ensuring minimal manual intervention while maintaining the system's security and stability. This method allows the application to remain correctly configured and operational without the need for repetitive manual reconfiguration.
B. Create a Debian-based Compute Engine instance, install and configure the application, and use OS patch management to install available updates.
Answer is B
B is the correct answer, Use OS patch management to apply operating system patches across a set of Compute Engine VM instances (VMs). Long running VMs require periodic system updates to protect against defects and vulnerabilities. The OS patch management service has two main components: Patch compliance reporting, which provides insights on the patch status of your VM instances across Windows and Linux distributions. Along with the insights, you can also view recommendations for your VM instances. Patch deployment, which automates the operating system and software patch update process. A patch deployment schedules patch jobs. A patch job runs across VM instances and applies patches. https://cloud.google.com/compute/docs/os-patch-management
Can someone explain why the answer is not D ? Isn't the best practice to use containers ?
Because it mentions "restart container whenever update is available". Restarting doesn't just update the OS. You need to build docker image with new version
When you restart the container, will it not download the new image and reconfigure the application? I believe so, there is an option to configure the pods to download always the last image.
because restarting pod does not change the base image version of the application image. Hence D is a wrong answer
The ask in this question is "you want to ensure that you can install Debian distribution updates (which is OS updates specifically) with minimal manual intervention whenever they become available." That is accomplished by an OS patch management. https://cloud.google.com/compute/docs/os-patch-management
vote B about A using latest template for update patch, next time you have to make template again. ans B, make once setting for good basically with no intervention.
Key words : "with minimal manual intervention whenever they become available" With OS Patch Management the OS will have all the latest available updates at that point automatically which wouldn't be the case with A.
B is the answer. https://cloud.google.com/compute/docs/os-patch-management Use OS patch management to apply operating system patches across a set of Compute Engine VM instances (VMs).
B is the simplest option and with minimal intervention. Other answers may be technically possible but the question does not ask for anything else (e.g. containers, templates, etc.)
B is ok
A is correct, with template and startup script you can create multiple instance with minimal manual intervention; when the new debian release will be available, you need update only the template with new image of debian distribution.
Option A, "Create a Compute Engine instance template using the most recent Debian image. Create an instance from this template, and install and configure the application as part of the startup script. Repeat this process whenever a new Google-managed Debian image becomes available," is the correct choice. This approach allows you to automate the process of creating a new instance with the latest Debian image and configuring the application. By using an instance template and a startup script, you can ensure that the application is correctly configured each time a new instance is created. When a new Debian image becomes available, you can simply create a new instance template and repeat the process. Option B, using OS patch management, would allow you to install updates, but it wouldn't necessarily ensure that the application is correctly configured after an update.
The question requires MINIMAL manual intervention for patching Debian Linux. Therefore it makes most sense to create a Docker container using the Debian Marketplace Distro (as long as the FROM field in your Dockerfile points to `$distro:latest` from Cloud Marketplace) Ref: https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-let-google-do-the-patching-with-new-managed-base-images and https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-how-containers-enable-passive-patching-and-a-better-model-for-supply-chain-security
A is correct answer. I am not able to understand B option and ppl are simply adding patch management URL as reference. How this will relate with answer ? A is correct answer.
A only answers to 'minimal management overhead', but not to 'install patches as soon as possible'.
I will go with B , there is no need to application configuration each time
You want to ensure that you can install Debian distribution updates with minimal manual intervention whenever they become available... | if it is in the cloud then option A | if it is on the internet then option b... It is a trick question!
I vote for A
It is B, using Os path. It is interesting the OS policy also, to run commands inside the VMs.