Examkin

Question

Difficulty: HardDeploying and Managing Compute Engine Virtual Machines

A cloud administrator needs to securely provision a Compute Engine virtual machine instance that uses a Customer-Managed Encryption Key (CMEK) for its boot disk and runs a startup script retrieved from a private Cloud Storage bucket. In what sequence should the administrator execute the administrative tasks to ensure successful VM provisioning and execution under least privilege?

  1. 1Grant the Compute Engine Service Agent role 'roles/cloudkms.cryptoKeyEncrypterDecrypter' on the targeted Cloud KMS key.
  2. 2Create a custom IAM service account and grant it 'roles/storage.objectViewer' on the Cloud Storage bucket containing the startup script.
  3. 3Upload the initialization script to the private Cloud Storage bucket.
  4. 4Run 'gcloud compute instances create' specifying '--kms-key', '--service-account', '--scopes=cloud-platform', and '--metadata=startup-script-url'.
  5. 5Inspect the serial port console output of the VM instance to verify successful execution of the startup script.

Answer

The correct deployment sequence is: 1) Grant the Compute Engine Service Agent the Cloud KMS Encrypter/Decrypter role. 2) Create a custom service account and assign Storage Object Viewer access to the bucket. 3) Upload the script to the private Cloud Storage bucket. 4) Run 'gcloud compute instances create' passing the CMEK key, custom service account, cloud-platform scope, and metadata URL. 5) Inspect serial port output to verify startup script completion.
The proper administrative workflow follows a logical dependency chain: Infrastructure access permissions must be granted to the service agent for CMEK disk creation first. Next, identity and access for the application payload must be established by creating a dedicated service account and granting storage read access. The payload (startup script) is then uploaded to Cloud Storage. Once prerequisites are in place, the VM instance is created with gcloud referencing the KMS key, service account, and metadata URL. Finally, serial console logs are reviewed to confirm startup script execution.

Step-by-Step Solution

1
Configure KMS access for Compute Engine
Compute Engine service agent gains cryptoKeyEncrypterDecrypter privileges on the specified Cloud KMS key.
Before Google Cloud can create disks encrypted with CMEK, the Google-managed Compute Engine Service Agent must have explicit permission to encrypt and decrypt using the specified KMS key.
2
Configure VM identity and storage permissions
Custom service account is created and granted roles/storage.objectViewer on the target bucket.
The VM instance needs identity credentials capable of downloading objects from the private Cloud Storage bucket.
3
Stage the startup script
Script file is uploaded and accessible at a gs:// URL.
The artifact must exist in Cloud Storage prior to VM creation so the metadata URL points to a valid file.
4
Provision the Compute Engine VM instance
VM instance is created with an encrypted CMEK boot disk and assigned identity.
The gcloud compute instances create command ties together the KMS key, service account, cloud-platform access scope, and startup-script-url metadata.
5
Validate deployment
Startup script logs are verified via serial console output.
Checking serial port 1 output allows administrators to confirm the startup script successfully downloaded and executed without errors.

Key Concept

Compute Engine CMEK disk encryption and secure startup script provisioning sequence
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic