Examkin

Soru

Zorluk: OrtaManaging Compute Engine Resources

An infrastructure team needs to modify the service account assigned to a standalone production Compute Engine virtual machine to adhere to the principle of least privilege. The instance is currently running and associated with the default Compute Engine service account. Which sequence of actions should the Cloud Engineer take to attach a newly created custom service account to this existing virtual machine?

  1. Stop the virtual machine instance, execute the gcloud compute instances set-service-account command specifying the custom service account, and start the instance.Cevap
  2. B
    Assign the Owner primitive role directly to the existing default Compute Engine service account so that permission updates take effect without stopping the running instance.
  3. C
    Reconfigure the Managed Instance Group autoscaling policy to dynamically swap the service account permissions across active instances while maintaining zero downtime.
  4. D
    Convert the virtual machine to a Spot VM instance type, which enables live service account credential rotation while the workload remains online.

Cevap

Stop the virtual machine instance, execute the gcloud compute instances set-service-account command specifying the custom service account, and start the instance.
To update the identity of an existing Compute Engine VM instance, the instance must first be stopped. Once in the TERMINATED state, the gcloud compute instances set-service-account command updates the associated service account. Starting the VM applies the change.

Adım Adım Çözüm

1
Stop the Compute Engine instance using gcloud compute instances stop.
The VM enters the TERMINATED state, freeing up system locks on instance metadata configuration.
Google Cloud requires VMs to be stopped before modifying attached service accounts or access scopes.
2
Run gcloud compute instances set-service-account INSTANCE_NAME --service-account=SA_EMAIL.
The custom service account is successfully attached to the instance metadata configuration.
This updates the identity and identity tokens provided to workloads running inside the VM instance.
3
Start the VM instance using gcloud compute instances start.
The instance boots up using the updated custom service account identity.
Restarting restores operational status with least-privilege IAM permissions enforced.

Anahtar Kavram

Modifying Compute Engine Service Accounts and Least Privilege Administration
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing Compute Engine Resources

Bu konudan daha fazla soru