Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

A healthcare telemetry platform is deploying a bursty event-processing workload on Google Cloud using Compute Engine Managed Instance Groups (MIGs). The autoscaling policy scales compute nodes based on custom Cloud Monitoring queue depth metrics, rapidly expanding from 10 instances to over 400 N2 high-memory instances during peak ingestion windows. The deployment pipeline uses Terraform to automate infrastructure provisioning, and the worker instances must securely assume a custom identity to interact with Bigtable. During initial stress testing of a new region, scaling events stalled halfway through expansion, and Terraform updates failed. Which combination of administrative and provisioning actions must the architecture team implement to prevent these failures?

  1. Submit regional vCPU quota increase requests in advance for the target compute instance family, and grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the worker service account.Answer
  2. B
    Migrate the processing workload to a Google Kubernetes Engine (GKE) Autopilot cluster, as GKE managed clusters automatically override and bypass project-level regional compute quotas.
  3. C
    Store the Terraform state file in a local ephemeral container volume during deployment to reduce network latency and state locking timeouts during large autoscaling events.
  4. D
    Assign the Owner primitive IAM role (roles/owner) to the deployment pipeline service account to ensure it bypasses service account identity configuration checks.

Answer

Submit regional vCPU quota increase requests in advance for the target compute instance family, and grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the worker service account.
Provisioning large-scale Managed Instance Groups (MIGs) requires verifying and requesting regional compute quotas (such as N2 vCPUs) prior to deployment to handle maximum autoscaling bounds. Additionally, for automated Infrastructure as Code pipelines (like Terraform) to provision instances running under a custom worker identity, the pipeline's executing principal must be granted the `roles/iam.serviceAccountUser` role on that worker service account.

Step-by-Step Solution

1
Analyze capacity requirements for burst autoscaling.
Scaling up to 400 N2 high-memory instances requires confirming that regional vCPU quotas in the destination region accommodate the peak compute footprint.
Default GCP project quotas often cap regional vCPUs below large-scale burst requirements, causing provisioning calls to fail.
2
Evaluate service account delegation for automated compute provisioning.
The deployment pipeline service account requires the `roles/iam.serviceAccountUser` role on the dedicated worker service account.
This grant enables the pipeline to attach the specific runtime identity to newly created Compute Engine instance templates without granting overly permissive administrative rights.

Key Concept

Compute Resource Provisioning, Regional Quota Planning, and Identity Delegation
Estimated Time:2m 0s
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic