Examkin

Question

Difficulty: MediumAdvising Development and Operation Teams

A logistics company is establishing deployment standards for a new application team that will manage automated GCP infrastructure releases using Cloud Build pipelines. During initial testing, the team encountered failure errors due to insufficient regional VM quotas when deploying large Compute Engine instance groups, and they are unsure of the minimal IAM permissions needed for the build pipeline service account to attach runtime identities to created resources. As a Cloud Architect advising this team, which TWO recommendations should you offer to satisfy operational reliability and least privilege principles?

  1. Submit regional Compute Engine quota increase requests in advance of launching large-scale automated deployments.Answer
  2. B
    Grant the project-level Editor role (roles/editor) to the Cloud Build deployment service account to ensure all automated resource management operations succeed.
  3. Grant the deployment service account the Service Account User role (roles/iam.serviceAccountUser) on specific runtime service accounts.Answer
  4. D
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the deployment service account so it can attach service accounts to new resources.
  5. E
    Depend on GCP automated real-time quota scaling during provisioning to dynamically raise limits as deployment request rates increase.

Answer

The Cloud Architect should advise submitting regional quota increase requests proactively prior to large automated deployments and assigning the Service Account User role (roles/iam.serviceAccountUser) on specific service accounts to adhere to least privilege.
To maintain high operational availability and security rigor, development and operations teams should proactively request regional quota adjustments prior to large automated rollouts and restrict CI/CD identities to the Service Account User role rather than full administrative or primitive roles.

Step-by-Step Solution

1
Evaluate deployment scaling and quota requirements.
Identified that GCP quotas are hard regional limits that do not expand dynamically during provisioning runs.
Requesting quota increases prior to deployment prevents pipeline execution failures caused by QuotaExceeded errors.
2
Analyze identity permission requirements for attaching service accounts to compute resources.
Determined that attaching an existing service account to a compute instance requires identity delegation, not full IAM service account administration.
Granting roles/iam.serviceAccountUser fulfills the operational requirement while strictly adhering to the principle of least privilege.

Key Concept

Advising deployment teams on proactive GCP quota management and least-privilege IAM configuration for automation pipelines.
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic