Examkin

Question

Difficulty: MediumProgrammatic GCP Interaction via SDK, CLI, and APIs

A software engineer is developing a Python microservice running on Compute Engine instances that programmatically uploads reports to Cloud Storage and publishes events to Cloud Pub/Sub. Enterprise security policy strictly prohibits storing downloadable service account JSON keys on virtual machine disks. Additionally, the microservice must handle high-volume API requests without failing due to transient API quota limits. Which TWO design patterns should the developer implement to satisfy security policy and handle API interactions resiliently? (Select TWO)

  1. Configure the microservice SDK client to utilize Application Default Credentials (ADC) to retrieve identity tokens directly from the Compute Engine metadata server.Answer
  2. B
    Generate a service account JSON key during VM startup script execution and store it in local ephemeral storage referenced by the GOOGLE_APPLICATION_CREDENTIALS environment variable.
  3. Implement exponential backoff retry algorithms with randomized jitter when receiving HTTP 429 rate limit responses from GCP APIs.Answer
  4. D
    Assign the primitive Owner IAM role to the service account attached to the Compute Engine instance to prevent permission denial errors across target resources.

Answer

The developer should configure the microservice SDK to use Application Default Credentials (ADC) fetching identity from the metadata server, and implement exponential backoff with randomized jitter for API retry handling.
The correct approach combines credential-less authentication via Application Default Credentials (ADC) leveraging the VM metadata server, and resilient client-side API error handling using exponential backoff with randomized jitter for rate limits.

Step-by-Step Solution

1
Evaluate authentication requirements against security constraints.
Using ADC allows Google Cloud Client Libraries to implicitly retrieve short-lived OAuth 2.0 access tokens from the Compute Engine metadata server without requiring JSON service account key files.
This satisfies the requirement forbidding stored credentials on virtual machine disks.
2
Address high-volume API rate limiting and resilience requirements.
Implementing truncated exponential backoff combined with randomized jitter spreads retries over time when HTTP 429 (Too Many Requests) or transient errors occur.
This prevents retry storms and ensures resilient programmatic interaction with Google Cloud APIs.

Key Concept

Programmatic Authentication and Resilient API Design
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic