Examkin

Question

Difficulty: HardDeploying and Managing Compute Engine Virtual Machines

A cloud engineer is deploying a Compute Engine Virtual Machine instance named `analytics-worker` in the `us-east1-b` zone using the Google Cloud CLI (`gcloud`). The deployment must fulfill all of the following operational constraints:
- Attach an existing secondary persistent disk named `analytics-data` in read-only mode.
- Execute an initialization script stored in a Google Cloud Storage bucket (`gs://corp-analytics-binaries/init.sh`) upon startup.
- Identity and service access must be bound to the custom service account `[email protected]`.
- Prevent the allocation of an external (public) IP address to the VM.

Which `gcloud` command correctly provisions the instance according to these requirements?

  1. gcloud compute instances create analytics-worker --zone=us-east1-b --service-account=worker-sa@analytics-prod.iam.gserviceaccount.com --no-address --metadata=startup-script-url=gs://corp-analytics-binaries/init.sh --disk=name=analytics-data,mode=roAnswer
  2. B
    gcloud compute instances create analytics-worker --zone=us-east1-b [email protected] --no-address --metadata-from-file=startup-script=gs://corp-analytics-binaries/init.sh --disk=name=analytics-data,mode=ro
  3. C
    gcloud compute instances create analytics-worker --zone=us-east1-b --service-account=worker-sa@analytics-prod.iam.gserviceaccount.com --public-ip=disabled --metadata=startup-script-url=gs://corp-analytics-binaries/init.sh --disk=name=analytics-data,mode=ro
  4. D
    gcloud compute instances create analytics-worker --zone=us-east1-b --role=roles/editor --no-address --metadata=startup-script-url=gs://corp-analytics-binaries/init.sh --disk=name=analytics-data,mode=ro

Answer

The command starting with `gcloud compute instances create analytics-worker` that specifies `--service-account=worker-sa@analytics-prod.iam.gserviceaccount.com`, `--no-address`, `--metadata=startup-script-url=gs://corp-analytics-binaries/init.sh`, and `--disk=name=analytics-data,mode=ro` correctly fulfills all requirements.
The correct option correctly uses `--service-account` to specify the identity, `--no-address` to omit external IP allocation, `--metadata=startup-script-url=...` to reference the Cloud Storage initialization script, and `--disk=name=analytics-data,mode=ro` to attach the existing persistent disk in read-only mode.

Step-by-Step Solution

1
Identify the proper service account flag for Compute Engine VM identity.
The `--service-account` flag must be set to the email address of the service account (`[email protected]`). The `--scopes` flag defines API access scopes, not service account assignment.
Compute Engine requires explicit service account binding for workload identity.
2
Determine the parameter required to suppress external IP assignment.
Use `--no-address` to launch an instance with only a private network interface.
By default, `gcloud compute instances create` assigns an ephemeral external IP address unless `--no-address` is supplied.
3
Select the correct metadata key for remote GCS startup scripts.
Set `--metadata=startup-script-url=gs://corp-analytics-binaries/init.sh`.
The key `startup-script-url` is used for scripts hosted in Cloud Storage, whereas `startup-script` or `--metadata-from-file` is intended for local script files.
4
Specify disk attachment flags for existing secondary disks.
Pass `--disk=name=analytics-data,mode=ro` to attach the existing persistent disk in read-only mode.
The `mode=ro` option enforces read-only mounting of existing block devices.

Key Concept

Provisioning Compute Engine instances via gcloud CLI with custom service accounts, private networking, GCS startup scripts, and attached persistent disks.
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic