Exam Associate Cloud Engineer All Questions

View all questions & answers for the Associate Cloud Engineer exam

Exam Associate Cloud Engineer topic 1 question 133 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 133
Topic #: 1

[All Associate Cloud Engineer Questions]

An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate-reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?

A. Move both projects under the same folder.
B. Grant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-storage.
C. Create a Shared VPC network between both projects. Grant the VM Service Account the role Storage Object Creator on corp-iot-insights.
D. Make corp-aggregate-reports-storage public and create a folder with a pseudo-randomized suffix name. Share the folder with the IoT team.

Show Suggested Answer

Suggested Answer: B 🗳️

by francisco_guerra at Aug. 10, 2020, 5:17 a.m.

Comments

Submit Cancel

ESP_SAP

Highly Voted 4 years, 5 months ago

Correct Answer is (B): Predefined roles The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Storage and lists the permissions that are contained in each role. Unless otherwise noted, these roles can be applied either to entire projects or specific buckets. Storage Object Creator (roles/storage.objectCreator) Allows users to create objects. Does not give permission to view, delete, or overwrite objects. https://cloud.google.com/storage/docs/access-control/iam-roles#standard-roles

upvoted 36 times

ESP_SAP

4 years, 5 months ago

Basically, you are giving the permissions to the VM Service Account to create a copy of the daily report on the bucket that the other team has access.

upvoted 6 times

...

francisco_guerra

Highly Voted 4 years, 6 months ago

i think is B

upvoted 14 times

francisco_guerra

4 years, 6 months ago

Object creator cant see object so i think is D

upvoted 1 times

lxgywil

3 years, 9 months ago

VM doesn't need to see the obects - just to create them. It's B: The VM is located in project "corp-iot-insights" - give its SA the Storage Object Creator role for bucket "corp-aggregate-reports-storage" that is located in project "corp-aggregate-reports", where your team operates.

upvoted 6 times

...

JoseCloudEng1994

Most Recent 7 months, 3 weeks ago

Selected Answer: B

Its a bit tricky with the projects. They only specify that the VM must be able to create objects on the bucket. No mention of the people on the aggregate-reports group being able to access it

upvoted 1 times

...

SAMBIT

1 year ago

Guys ..shared VPC is the key to connect projects. Enjoy

upvoted 1 times

PiperMe

11 months, 2 weeks ago

IAM provides granular control over object-level access, which is a better security practice than opening up entire network segments with Shared VPC. Granting the necessary Storage Object Creator permission directly to the source VM's service account is the most streamlined way to achieve the file transfer with the principle of least privilege. Hypothetically, if the VM also needed access to databases or other network resources in the corp-aggregate-reports project, then Shared VPC could be the appropriate solution.

upvoted 2 times

...

Captain1212

1 year, 5 months ago

Selected Answer: B

B is the correct as it gives the service account required access

upvoted 1 times

...

tatyavinchu

1 year, 5 months ago

Selected Answer: B

Correct Answer is B

upvoted 1 times

...

Naree

1 year, 7 months ago

Selected Answer: B

Just take below sentence from the question which is added just for confusion :) "Your team operates only in the project corp-aggregate-reports"

upvoted 2 times

...

StefiJohnson

2 years, 4 months ago

Correct Answer is (B)

upvoted 1 times

...

theBestStudent

2 years, 5 months ago

Selected Answer: B

If that is the default service Account of the Compute Instance, then we should do nothing. As the role is already included. Either way, we should do nothing as the role is already covered. Also we shouldn´t modify Compute instance Service account. But again, I will assume it is not the default.

upvoted 1 times

...

AzureDP900

2 years, 7 months ago

B is right

upvoted 1 times

...

deadlydeb

2 years, 7 months ago

Selected Answer: B

b it is

upvoted 1 times

...

Mixxer5

3 years ago

Selected Answer: B

It's B since bucket names are globally unique so it's enough to refer to them when you've proper role assigned

upvoted 3 times

...

arsh1916

3 years, 8 months ago

B, assign access is less step

upvoted 1 times

...

pradr

3 years, 10 months ago

From stackoverflow: Bucket names are globally unique, so your app will refer to an existing bucket in another project in the same way that it refers to buckets in its own project. Hence the shared VPC is not required to access the bucket. Just the IAM role.

upvoted 3 times

...