Exam Associate Cloud Engineer topic 1 question 183 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 183
Topic #: 1

[All Associate Cloud Engineer Questions]

You need to manage a third-party application that will run on a Compute Engine instance. Other Compute Engine instances are already running with default configuration. Application installation files are hosted on Cloud Storage. You need to access these files from the new instance without allowing other virtual machines (VMs) to access these files. What should you do?

A. Create the instance with the default Compute Engine service account. Grant the service account permissions on Cloud Storage.
B. Create the instance with the default Compute Engine service account. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.
C. Create a new service account and assign this service account to the new instance. Grant the service account permissions on Cloud Storage.
D. Create a new service account and assign this service account to the new instance. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.

Show Suggested Answer

Suggested Answer: C 🗳️

by PAUGURU at April 26, 2022, 3:50 p.m.

Comments

Submit Cancel

VietmanOfficiel

Highly Voted 1 year, 9 months ago

Selected Answer: C

"without allowing other instances" , the other instances are created with default compute engine service account. So you must create a new independant service account

upvoted 9 times

...

scanner2

Most Recent 9 months, 1 week ago

Selected Answer: C

C is correct.

upvoted 3 times

...

gcpreviewer

1 year, 8 months ago

Selected Answer: C

C is the clear choice. Want to create a new service account instead of using the default and grant it permissions in cloud storage. Straightforward C.

upvoted 3 times

...

manjtrade2

1 year, 9 months ago

Selected Answer: C

C is right

upvoted 1 times

...

snkhatri

1 year, 9 months ago

Selected Answer: C

C seems right to me

upvoted 1 times

...

AzureDP900

2 years ago

C https://cloud.google.com/iam/docs/best-practices-for-using-and-managing-service-accounts If an application uses third-party or custom identities and needs to access a resource, such as a BigQuery dataset or a Cloud Storage bucket, it must perform a transition between principals. Because Google Cloud APIs don't recognize third-party or custom identities, the application can't propagate the end-user's identity to BigQuery or Cloud Storage. Instead, the application has to perform the access by using a different Google identity.

upvoted 2 times

...

KRIV_1

2 years ago

Although C is the correct answer notice that, as Google recommend, you first need to grant the service account the required permission before attach it to a resource.

upvoted 1 times

...