Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

An organization is building an automated continuous integration pipeline to provision a memory-intensive batch processing workload on Google Cloud. The architecture utilizes Compute Engine Managed Instance Groups (MIGs) with custom instance templates. A CI/CD service account executes Infrastructure as Code (IaC) scripts to instantiate the instances and attach a runtime service account that accesses Cloud Storage. Which TWO operational and security configurations must be implemented during compute provisioning? (Select TWO choices.)

  1. Request regional Compute Engine CPU and memory quota increases in advance prior to executing large-scale instance group provisioning.Answer
  2. Grant the CI/CD pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime service account attached to the Compute Engine instances.Answer
  3. C
    Grant the CI/CD pipeline service account the Service Account Admin role (roles/iam.serviceAccountAdmin) to manage service account attachments during VM provisioning.
  4. D
    Configure the Managed Instance Group autoscaling policy to scale instances strictly based on average CPU utilization metrics.
  5. E
    Store the Terraform state files locally within the ephemeral execution environment of the CI/CD runner to reduce provisioning latency.

Answer

The deployment requires requesting regional Compute Engine resource quotas in advance and granting the Service Account User role (roles/iam.serviceAccountUser) to the CI/CD deployment identity on the specific runtime service account.
Requesting regional compute quota increases in advance ensures that large-scale automated deployments execute without encountering compute capacity limits. Additionally, granting the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account allows the deployment pipeline to attach that identity to new Compute Engine instances while adhering to least privilege principles.

Step-by-Step Solution

1
Evaluate resource quota pre-requisites for compute provisioning
Identified that large-scale instance group deployments require checking and requesting regional quota increases beforehand to prevent API deployment failures.
GCP projects have default regional limits on compute resources such as CPUs and RAM which must be adjusted before launching large instance groups.
2
Determine minimum required IAM permissions for attaching service accounts to compute instances
Identified that the deployment principal needs roles/iam.serviceAccountUser on the target runtime service account.
This permission allows a principal to bind a service account to a Compute Engine instance without exposing administrative controls over IAM policy definitions.

Key Concept

Compute Resource Provisioning and IAM Privilege Scoping
Estimated Time:1m 30s
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic