Examkin

Question

Difficulty: HardDeploying and Managing Compute Engine Virtual Machines

A company is migrating an internal analytics service to Compute Engine. The service needs to run on a dedicated custom Virtual Machine instance named `analytics-worker` in the custom subnet `prod-analytics-subnet` within VPC `prod-vpc`. The VM must authenticate to Google Cloud services using a dedicated user-managed service account `[email protected]` with full access to Cloud Storage API scopes. Additionally, the instance must be provisioned without a public IP address to satisfy strict corporate security policies. Which `gcloud` command correctly provisions this Compute Engine Virtual Machine instance according to these requirements?

  1. gcloud compute instances create analytics-worker --zone=us-central1-a --subnet=prod-analytics-subnet --no-address --service-account=analytics-sa@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/devstorage.full_controlAnswer
  2. B
    gcloud compute instances create analytics-worker --zone=us-central1-a --network=prod-vpc --public-ip=false --roles=roles/storage.admin --service-account=analytics-sa@my-project.iam.gserviceaccount.com
  3. C
    gcloud compute instances create analytics-worker --zone=us-central1-a --subnet=prod-analytics-subnet --no-address --provisioning-model=SPOT --instance-termination-action=STOP --service-account=analytics-sa@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/devstorage.full_control
  4. D
    gcloud compute instances create analytics-worker --zone=us-central1-a --subnet=prod-analytics-subnet --no-address --scopes=roles/owner

Answer

The command using `--subnet=prod-analytics-subnet --no-address --service-account=analytics-sa@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/devstorage.full_control` correctly provisions the instance.
The correct option correctly uses `gcloud compute instances create` parameters: `--subnet` to specify the custom VPC subnet, `--no-address` to omit an external IP address, `--service-account` to attach the custom service account email, and `--scopes` to define the API access scope for Cloud Storage.

Step-by-Step Solution

1
Identify the network and public IP flags required for custom subnet and private instance deployment.
Use `--subnet=prod-analytics-subnet` to attach to a custom subnet and `--no-address` to suppress external public IP assignment.
Specifying `--no-address` ensures Compute Engine does not allocate an ephemeral external IP address to the primary network interface.
2
Identify the identity and authorization flags for custom service account attachment.
Use `--service-account=analytics-sa@my-project.iam.gserviceaccount.com` combined with `--scopes=https://www.googleapis.com/auth/devstorage.full_control`.
The `--service-account` flag binds the custom identity, and `--scopes` defines the authorized API access boundaries for that instance's service account tokens.
3
Evaluate invalid flags and incorrect workload configurations among candidate options.
Eliminate options using invalid flag syntax like `--public-ip=false`, `--roles`, or attempting to pass IAM primitive roles to `--scopes`.
`gcloud compute instances create` requires precise CLI flag syntax matching Google Cloud API schemas.

Key Concept

Deploying Compute Engine Virtual Machines with Custom Subnets, Private IPs, and Service Accounts via gcloud CLI
Estimated Time:2m 0s
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic