To gain better visibility into OS risks for all VMs using Google-managed images with minimal effort, what should you do?

• A. Enable VM Manager across projects and allow VM Manager to write findings to SCCE.
• B. Enable VM Threat Detection in SCCE and allow findings.
• C. Set up OSV-Scanner on all VMs and forward logs to SecOps.
• D. Create a custom SHA scanner checking sourceImage against a vulnerability database.

Answer: (A)

Centralizing OS vulnerability visibility across Google-managed images is best achieved by letting VM Manager feed its findings into Security Command Center. When you enable VM Manager across all projects, it inventories and tracks the OS state of VMs that run Google-provided images and can publish vulnerability findings to Security Command Center. This gives you a single, unified view of OS risks without needing to install extra agents or run separate scanners on every VM. The other options would either focus on threat detection rather than OS vulnerabilities, or require deploying additional scanning tooling across all VMs, which adds effort and reduces the “minimal effort” goal.