An organization is deploying Compute Engine virtual machines dedicated to executing fault-tolerant, stateless batch processing jobs. The instances must cost as little as possible and access BigQuery datasets securely using a dedicated custom service account. Which two actions or configuration flags should be specified when deploying these instances using the gcloud CLI? (Select TWO)
- Specify the --provisioning-model=SPOT flag to minimize compute costs for stateless, fault-tolerant workloads.Answer
- Specify the --service-account flag with your custom service account email and set --scopes=cloud-platform.Answer
- CSpecify the --iam-role=roles/editor flag directly in the gcloud compute instances create command to grant instance permissions.
- DAssign the broad primitive Editor role (roles/editor) to the default Compute Engine service account instead of configuring a custom service account.
Answer
To minimize compute expenses while adhering to security best practices, select the Spot provisioning model (--provisioning-model=SPOT) for fault-tolerant batch workloads, and attach a dedicated custom service account using the --service-account flag along with the standard --scopes=cloud-platform flag.
Specifying the Spot provisioning model optimizes costs for fault-tolerant, stateless batch workloads, while configuring a dedicated custom service account with the cloud-platform scope enables least-privilege IAM permissions without relying on default service accounts or broad primitive roles.
Step-by-Step Solution
Key Concept
Compute Engine gcloud deployment flags, Spot VM configuration, and service account authorization best practices.