Examkin

Question

Difficulty: Very hardDeploying and Managing Compute Engine Virtual Machines

A cloud engineer must securely deploy an internal application on a new Compute Engine virtual machine without a public IP address. The deployment requires a custom service account with minimal access to a Cloud Storage bucket, an automated boot installation via a startup script that retrieves dependencies from the internet, and post-deployment validation. How should the engineer sequence these administrative tasks to ensure successful provisioning?

  1. 1Create a custom IAM service account and grant it the Storage Object Viewer role on the target Cloud Storage bucket.
  2. 2Configure a Cloud NAT gateway on the Cloud Router within the target VPC network and subnet.
  3. 3Run `gcloud compute instances create` specifying the subnet, attaching the custom service account, setting `--no-address`, and passing the startup script flag.
  4. 4Connect to the VM using Identity-Aware Proxy (IAP) SSH tunneling to verify application initialization in `/var/log/syslog`.

Answer

The correct sequence requires creating the custom service account with IAM permissions first, establishing Cloud NAT for private outbound egress second, executing the `gcloud compute instances create` command with private IP flags third, and validating the startup script execution using Identity-Aware Proxy SSH tunneling fourth.
Proper deployment dependency ordering dictates that prerequisites must be established before provisioning. First, the IAM service account with Cloud Storage permissions must be created so it can be assigned to the instance. Second, Cloud NAT must be established on the VPC router so that a VM without a public IP can access external repositories during startup. Third, the instance is provisioned using `gcloud compute instances create` with `--service-account`, `--no-address`, and `--metadata-from-file startup-script=...`. Finally, post-deployment inspection requires connecting via Identity-Aware Proxy (IAP) SSH because the VM lacks an external IP address.

Step-by-Step Solution

1
Identity & Access Preparation
The custom service account is created and bound to the required Cloud Storage role.
The service account must exist in GCP IAM prior to referencing it in the Compute Engine deployment command.
2
Egress Network Architecture
Cloud NAT is provisioned on the VPC subnet router.
Instances provisioned without public IP addresses (`--no-address`) require Cloud NAT to fetch external software packages during startup script execution.
3
Instance Provisioning
The Compute Engine VM is created and begins booting.
The `gcloud compute instances create` command binds the network, IAM service account, metadata startup script, and private IP configuration together.
4
Post-Deployment Verification
The engineer connects via IAP SSH and confirms startup execution logs.
Without a public IP address, traditional SSH fails; IAP TCP forwarding provides secure administrative access to inspect boot logs.

Key Concept

Secure Private VM Deployment, Service Account Scoping, Cloud NAT Egress, and IAP Tunneling
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic