Examkin

Question

Difficulty: MediumDeploying and Managing Compute Engine Virtual Machines

Your team needs to deploy a dedicated Compute Engine virtual machine instance named prod-api-worker in zone us-east1-b to execute critical database schema migration tasks. To follow security best practices, the VM must run using a non-default, user-managed service account named [email protected] and grant full Google Cloud platform access scopes so IAM roles govern permissions. Which gcloud command should you run to deploy the VM instance according to these requirements?

  1. gcloud compute instances create prod-api-worker --zone=us-east1-b [email protected] --scopes=https://www.googleapis.com/auth/cloud-platformAnswer
  2. B
    gcloud compute instances create prod-api-worker --zone=us-east1-b [email protected] --scopes=https://www.googleapis.com/auth/cloud-platform
  3. C
    gcloud compute instances create prod-api-worker --zone=us-east1-b [email protected] --scopes=https://www.googleapis.com/auth/cloud-platform --preemptible
  4. D
    gcloud compute instances create prod-api-worker --zone=us-east1-b --role=roles/editor --scopes=https://www.googleapis.com/auth/cloud-platform

Answer

Execute gcloud compute instances create specifying [email protected] and --scopes=https://www.googleapis.com/auth/cloud-platform.
The correct option uses gcloud compute instances create with [email protected] to attach the user-managed service account identity and --scopes=https://www.googleapis.com/auth/cloud-platform to allow IAM policies to manage resource access.

Step-by-Step Solution

1
Identify the required gcloud compute instances create flags for service account identity.
The correct flag to specify identity is --service-account with the full service account email.
Attaching custom service accounts ensures the instance operates under least-privilege IAM permissions instead of the default Compute Engine service account.
2
Determine the appropriate access scope flag.
Use --scopes=https://www.googleapis.com/auth/cloud-platform to delegate effective permission checks to IAM.
Google Cloud best practice recommends enabling the cloud-platform scope when using custom service accounts so IAM policies dictate API permissions.
3
Evaluate workload suitability for availability policies.
Omit flags like --preemptible or --provisioning-model=SPOT for stateful migration tasks.
Database migration jobs are critical operations that should not be unexpectedly terminated.

Key Concept

Attaching User-Managed Service Accounts to Compute Engine Instances via gcloud CLI
Estimated Time:1m 30s
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic