A Cloud Engineer must configure system telemetry for a fleet of Compute Engine virtual machines (VMs) to ingest custom application logs and capture system-level metrics, such as RAM/memory utilization, which are not collected by default compute hypervisor metrics. The implementation must follow Google Cloud security best practices regarding agent selection and least-privilege access control for telemetry collection. Which TWO actions should the Cloud Engineer perform?
- Install and configure the unified Google Cloud Ops Agent on each Compute Engine VM instance.Cevap
- Grant the service account attached to the VM instances the predefined Monitoring Metric Writer (`roles/monitoring.metricWriter`) and Logs Writer (`roles/logging.logWriter`) IAM roles.Cevap
- CInstall the legacy Stackdriver Monitoring Agent and Stackdriver Logging Agent as separate daemon packages on each Compute Engine instance.
- DGrant the service account attached to the VM instances the primitive Editor (`roles/editor`) role at the Google Cloud project level.
Cevap
The correct actions are installing the unified Google Cloud Ops Agent on each VM instance and granting the VM's service account the predefined Monitoring Metric Writer and Logs Writer IAM roles.
To collect extended VM metrics (like RAM/memory utilization) and application logs, the unified Google Cloud Ops Agent must be installed on the instances. To permit telemetry submission under least privilege, the attached service account requires the predefined `roles/monitoring.metricWriter` and `roles/logging.logWriter` roles.
Adım Adım Çözüm
Anahtar Kavram
Unified Ops Agent deployment and least-privilege telemetry IAM role assignment