Examkin

Question

Difficulty: MediumDeploying and Managing Compute Engine Virtual Machines

A cloud administration team needs to securely provision a Compute Engine virtual machine instance that automatically executes a startup script stored in a private Google Cloud Storage bucket. Place the operational steps in the correct order to successfully deploy and verify this virtual machine workload.

  1. 1Create a user-managed IAM service account dedicated to the Compute Engine workload.
  2. 2Upload the workload deployment script to a private Google Cloud Storage (GCS) bucket.
  3. 3Grant the dedicated service account the Storage Object Viewer IAM role on the target Cloud Storage bucket.
  4. 4Execute the `gcloud compute instances create` command, specifying `--service-account` and `--metadata=startup-script-url=gs://BUCKET_NAME/SCRIPT_NAME`.
  5. 5Inspect the instance serial port logs using `gcloud compute instances get-serial-port-output` to verify script execution.

Answer

The correct sequence starts by establishing the dedicated IAM service account, storing the startup script in Cloud Storage, binding the Storage Object Viewer role to the service account, provisioning the VM instance configured with the service account and startup-script-url metadata flag, and finally auditing serial port output for execution status.
Securing VM initialization requires setting up identity and access prerequisites before launching compute resources. Creating the service account, staging the script in Cloud Storage, and granting Storage Object Viewer permissions ensures that when `gcloud compute instances create` is run with `--metadata=startup-script-url`, the VM guest environment can successfully authenticate to GCS and download the script during startup. Serial port output inspection completes the workflow by verifying execution logs.

Step-by-Step Solution

1
Create the custom IAM service account.
Establishes a non-primitive identity for instance authentication following the least privilege principle.
Permissions cannot be bound until the service account identity exists.
2
Upload the initialization script to Cloud Storage.
Places the script executable in a secure GCS bucket.
Provides a centralized GCS URI path required by the Compute Engine metadata server.
3
Assign the Storage Object Viewer (roles/storage.objectViewer) role to the service account for the GCS bucket.
Grants read access to the script storage object.
If permissions are granted after VM instantiation, the startup script downloader daemon will fail with a 403 Access Denied error during boot.
4
Provision the VM using gcloud with the --service-account and --metadata=startup-script-url flags.
Launches the Compute Engine VM instance attached to the custom identity and boot metadata configuration.
Tells Compute Engine startup scripts agent to retrieve and run the script from GCS using the attached service account scope.
5
Review startup execution via gcloud compute instances get-serial-port-output.
Validates that the startup script completed successfully.
Serial console output captures stdout/stderr of Linux daemon boot scripts for troubleshooting.

Key Concept

Provisioning Compute Engine VMs with custom service accounts and GCS-hosted startup scripts
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic