How should the DevOps team accomplish this?

A patch for a vulnerability has been released, and a DevOps team needs to update their running containers in Google Kubernetes Engine (GKE).

How should the DevOps team accomplish this?
A . Use Puppet or Chef to push out the patch to the running container.
B . Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster.
C . Update the application code or apply a patch, build a new image, and redeploy it.
D . Configure containers to automatically upgrade when the base image is available in Container Registry.

Answer: C

Explanation:

https://cloud.google.com/containers/security

Containers are meant to be immutable, so you deploy a new image in order to make changes. You can simplify patch management by rebuilding your images regularly, so the patch is picked up the next time a container is deployed. Get the full picture of your environment with regular image security reviews.