Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

A global financial analytics firm plans to launch nightly batch processing jobs in Google Cloud to process high-frequency market telemetry data. The batch workload requires automated provisioning of 250 GPU-accelerated Compute Engine instances in a single region (us-central1) using Infrastructure as Code pipelines. During initial test runs, the pipeline execution fails during instance creation due to insufficient GPU resource limits, despite the project having an active billing account with high credit limits. Furthermore, organizational security policy strictly dictates that automated deployment pipelines must adhere to least privilege and cannot hold security administration roles. Which combination of architectural and operational steps should the Cloud Architect execute to resolve the deployment failures while maintaining security compliance?

  1. Submit a regional GPU quota increase request for us-central1 prior to provisioning, and grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) alongside compute provisioning permissions.Answer
  2. B
    Grant the deployment pipeline service account the Service Account Admin role (roles/iam.serviceAccountAdmin) so it can automatically bypass regional quota checks during automated instance creation.
  3. C
    Provision a multi-zone GKE cluster in Autopilot mode for the nightly batch processing workload to automatically bypass regional Compute Engine GPU quota constraints.
  4. D
    Configure the automated deployment script to perform manual gcloud resource modifications during provisioning failures to bypass quota evaluation.

Answer

Submit a regional GPU quota increase request for us-central1 prior to provisioning, and grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) alongside compute provisioning permissions.
Submitting a regional GPU quota request in us-central1 ahead of deployment ensures GCP allocates sufficient hardware capacity for the workload. In addition, granting the deployment pipeline identity the Service Account User role (roles/iam.serviceAccountUser) allows it to assign runtime service accounts to virtual instances without granting broad administrative security rights, fulfilling least-privilege requirements.

Step-by-Step Solution

1
Diagnose the root cause of compute provisioning failures during pipeline execution
Identify that compute resource instantiation is failing due to regional GPU quota limits, which operate independently of project billing thresholds.
Regional quota caps prevent unexpected resource consumption and require explicit administrative increase requests before scaling up compute capacity.
2
Determine minimal IAM permissions required for automated compute instance creation
Establish that the pipeline identity only needs permission to attach designated runtime service accounts to Compute Engine instances.
Attaching service accounts to virtual machines requires roles/iam.serviceAccountUser, preserving security boundaries without granting administrative control.
3
Align quota management and IAM scoping into the deployment strategy
Pre-request regional quotas in us-central1 and configure the pipeline service account with minimal IAM roles.
This guarantees reliable infrastructure provisioning while strictly enforcing organizational compliance requirements.

Key Concept

Compute Resource Quotas and Least-Privilege IAM Provisioning
Estimated Time:2m 0s
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic