Examkin

Question

Difficulty: HardMonitoring and Logging

A financial services company is deploying a multi-tier web application across a fleet of Linux virtual machines on Compute Engine. To comply with operational SLAs and security auditing guidelines, the infrastructure team must collect system-level memory utilization, disk space metrics, and custom syslog files from the instances into Google Cloud Observability. The implementation must follow Google Cloud recommended practices for telemetry agent configuration and IAM access management. Which deployment strategy should the Cloud Engineer implement?

  1. Install the unified Google Cloud Ops Agent on each Compute Engine instance and grant the attached service account the Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter) predefined roles.Answer
  2. B
    Install the legacy Stackdriver Logging Agent and legacy Stackdriver Monitoring Agent on each Compute Engine instance and grant the attached service account the Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter) predefined roles.
  3. C
    Install the unified Google Cloud Ops Agent on each Compute Engine instance and grant the attached service account the primitive Editor (roles/editor) role to ensure full write permissions across telemetry services.
  4. D
    Install the unified Google Cloud Ops Agent on each Compute Engine instance, but enable the Cloud Logging and Cloud Monitoring APIs at the Google Cloud Organization resource level rather than within the workload project hosting the instances.

Answer

Install the unified Google Cloud Ops Agent on each Compute Engine instance and grant the attached service account the Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter) predefined roles.
The correct strategy is to deploy the unified Google Cloud Ops Agent to the Compute Engine VMs and configure the instance service account with the predefined roles roles/logging.logWriter and roles/monitoring.metricWriter. The Ops Agent supports collecting system metrics (such as memory utilization and disk space) and custom syslog files within a single agent framework, while using specific predefined roles enforces security best practices by limiting permissions strictly to writing telemetry data.

Step-by-Step Solution

1
Identify telemetry requirements for memory, disk, and custom syslog collection on Compute Engine VMs.
Determine that the unified Google Cloud Ops Agent is required because default Compute Engine hypervisor metrics do not capture OS-level memory or syslog files.
Google Cloud Ops Agent is the current recommended telemetry agent replacing legacy agents for Compute Engine.
2
Determine the minimal IAM permissions necessary for the VM service account to push logs and metrics to Cloud Observability.
Select predefined roles roles/logging.logWriter and roles/monitoring.metricWriter.
Predefined roles limit permission scope to writing telemetry data, adhering to the principle of least privilege without granting unnecessary primitive permissions.
3
Verify API enablement location requirement.
Ensure Cloud Logging API and Cloud Monitoring API are enabled in the workload project containing the Compute Engine instances.
APIs are enabled at the individual project scope level where resources operate.

Key Concept

Compute Engine Telemetry Collection with Google Cloud Ops Agent and Least-Privilege IAM
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Logging

More questions from this topic