Your organization is deploying a non-critical, fault-tolerant batch processing workload on Google Compute Engine and needs to grant operational management access to a team member. Which TWO actions should you take to satisfy cost optimization guidelines and enforce the principle of least privilege?
- Deploy the workload instances using Spot VMs to take advantage of significantly discounted compute pricing for fault-tolerant tasks.Answer
- Grant the team member the Compute Instance Admin (v1) predefined role (roles/compute.instanceAdmin.v1) to allow full operational management of VM instances.Answer
- CDeploy the primary stateful database backing the workload on Spot VMs to maximize cost reduction across all compute tiers.
- DAssign the team member the primitive Editor role at the project level so they have full access to manage Compute Engine resources.
- ECreate a new Google Cloud project whenever regional CPU limits are hit rather than submitting a quota increase request.
Answer
Deploy the batch workload on Spot VMs for cost savings, and assign the Compute Instance Admin (v1) predefined role to enforce least privilege access control.
Deploying fault-tolerant batch workloads on Spot VMs maximizes cost efficiency because these workloads can handle VM preemption gracefully. Assigning the predefined Compute Instance Admin (v1) role provides full administrative control over VM instances while maintaining security compliance under the principle of least privilege.
Step-by-Step Solution
Key Concept
Compute Engine Resource Management and IAM Role Scoping