Examkin

Question

Difficulty: MediumManaging Compute Engine Resources

An infrastructure team needs to modify the service account assigned to a standalone production Compute Engine virtual machine to adhere to the principle of least privilege. The instance is currently running and associated with the default Compute Engine service account. Which sequence of actions should the Cloud Engineer take to attach a newly created custom service account to this existing virtual machine?

  1. Stop the virtual machine instance, execute the gcloud compute instances set-service-account command specifying the custom service account, and start the instance.Answer
  2. B
    Assign the Owner primitive role directly to the existing default Compute Engine service account so that permission updates take effect without stopping the running instance.
  3. C
    Reconfigure the Managed Instance Group autoscaling policy to dynamically swap the service account permissions across active instances while maintaining zero downtime.
  4. D
    Convert the virtual machine to a Spot VM instance type, which enables live service account credential rotation while the workload remains online.

Answer

Stop the virtual machine instance, execute the gcloud compute instances set-service-account command specifying the custom service account, and start the instance.
To update the identity of an existing Compute Engine VM instance, the instance must first be stopped. Once in the TERMINATED state, the gcloud compute instances set-service-account command updates the associated service account. Starting the VM applies the change.

Step-by-Step Solution

1
Stop the Compute Engine instance using gcloud compute instances stop.
The VM enters the TERMINATED state, freeing up system locks on instance metadata configuration.
Google Cloud requires VMs to be stopped before modifying attached service accounts or access scopes.
2
Run gcloud compute instances set-service-account INSTANCE_NAME --service-account=SA_EMAIL.
The custom service account is successfully attached to the instance metadata configuration.
This updates the identity and identity tokens provided to workloads running inside the VM instance.
3
Start the VM instance using gcloud compute instances start.
The instance boots up using the updated custom service account identity.
Restarting restores operational status with least-privilege IAM permissions enforced.

Key Concept

Modifying Compute Engine Service Accounts and Least Privilege Administration
Estimated Time:1m 30s
Rate this question

Topics

Managing Compute Engine Resources

More questions from this topic