Examkin

Question

Difficulty: Very hardDeploying and Managing Compute Engine Virtual Machines

A DevOps team is automating the deployment of a Compute Engine instance named `analytics-worker` in zone `us-central1-a` using the Google Cloud CLI. The VM requires a local file `/opt/scripts/init.sh` to run as a startup script during boot. Additionally, the VM must have custom metadata configured with a key of `environment` set to `production`, attach a custom service account `[email protected]`, and be granted read-only access to Cloud Storage via API access scopes. Which `gcloud compute instances create` command correctly provisions this virtual machine according to all requirements?

  1. gcloud compute instances create analytics-worker --zone=us-central1-a --metadata-from-file=startup-script=/opt/scripts/init.sh --metadata=environment=production --service-account=sa-analytics@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/devstorage.read_onlyAnswer
  2. B
    gcloud compute instances create analytics-worker --zone=us-central1-a --metadata=startup-script-file=/opt/scripts/init.sh,environment=production --service-account=sa-analytics@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/devstorage.read_only
  3. C
    gcloud compute instances create analytics-worker --zone=us-central1-a --metadata-from-file=startup-script=/opt/scripts/init.sh --metadata=environment=production --service-account=sa-analytics@my-project.iam.gserviceaccount.com --scopes=roles/storage.objectViewer
  4. D
    gcloud compute instances create analytics-worker --zone=us-central1-a --metadata-from-file=startup-script=/opt/scripts/init.sh --metadata=environment=production --service-account=sa-analytics@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/devstorage.read_only --preemptible --provisioning-model=SPOT

Answer

The correct command is the one that uses `--metadata-from-file=startup-script=/opt/scripts/init.sh` alongside `--metadata=environment=production`, `--service-account=sa-analytics@my-project.iam.gserviceaccount.com`, and `--scopes=https://www.googleapis.com/auth/devstorage.read_only`.
The correct command properly distinguishes between string metadata and file-based metadata by employing `--metadata-from-file=startup-script=/opt/scripts/init.sh` and `--metadata=environment=production`. It also correctly specifies a valid OAuth scope URI (`https://www.googleapis.com/auth/devstorage.read_only`) alongside the custom service account email address.

Step-by-Step Solution

1
Identify the proper CLI flag for local script metadata attachment.
Local files supplied as startup scripts must be specified via `--metadata-from-file=startup-script=<path_to_file>` rather than standard string `--metadata`.
The standard `--metadata` flag treats values as explicit string literals, whereas `--metadata-from-file` reads the content of the file specified at the path.
2
Differentiate between OAuth API access scopes and IAM permissions.
The `--scopes` flag requires valid OAuth URLs or shorthand aliases (such as `storage-ro` or `https://www.googleapis.com/auth/devstorage.read_only`).
IAM roles (e.g., `roles/storage.objectViewer`) govern authorization on GCP resources, while legacy API access scopes define the maximum permissions allowed on the instance's service account credentials.
3
Verify service account attachment and availability parameters.
Specify `--service-account` with the full service account email and avoid conflicting provisioning model flags.
Mixing legacy `--preemptible` flags with modern `--provisioning-model=SPOT` flags causes CLI validation errors.

Key Concept

Deploying Compute Engine VMs with startup scripts, custom metadata, custom service accounts, and API scopes via gcloud CLI
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic