A Cloud Engineer must set up telemetry collection for a fleet of Linux-based Compute Engine virtual machines. The requirements state that custom application log files must be ingested into Cloud Logging, and system-level performance metrics (such as memory utilization and disk space usage) must be reported to Cloud Monitoring. Access permissions must strictly adhere to the principle of least privilege. Which TWO actions should the engineer take to achieve this configuration? (Select TWO.)
- Install and configure the unified Google Cloud Ops Agent on each Compute Engine instance.Answer
- Grant the Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter) predefined roles to the VM instance service account.Answer
- CInstall the legacy Stackdriver Monitoring Agent alongside the legacy Stackdriver Logging Agent on all Compute Engine instances.
- DGrant the primitive Editor (roles/editor) role to the default Compute Engine service account.
Answer
To collect system-level memory metrics alongside custom application logs while enforcing least privilege, the engineer must install the unified Google Cloud Ops Agent on the virtual machines and grant the service account attached to the instances the Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter) predefined roles.
Installing the Google Cloud Ops Agent is the Google-recommended approach for gathering both system metrics (like memory) and application log files from Compute Engine VMs. Combining this agent deployment with targeted predefined roles (roles/logging.logWriter and roles/monitoring.metricWriter) ensures the VM service account has only the permissions required to send observability data to Google Cloud.
Step-by-Step Solution
Key Concept
Google Cloud Ops Agent configuration and least-privilege IAM telemetry roles