Discuss Google Associate Cloud Engineer Exam Topic 1 Question 107

You built an application on your development laptop that uses Google Cloud services. Your application uses Application Default Credentials for authentication and works fine on your development laptop. You want to migrate this application to a Compute Engine virtual machine (VM) and set up authentication using Google- recommended practices and minimal changes. What should you do?

AAssign appropriate access for Google services to the service account used by the Compute Engine VM.

BCreate a service account with appropriate access for Google services, and configure the application to use this account.

CStore credentials for service accounts with appropriate access for Google services in a config file, and deploy this config file with your application.

DStore credentials for your user account with appropriate access for Google services in a config file, and deploy this config file with your application.

Suggested Answer: B

In general, Google recommends that each instance that needs to call a Google API should run as a service account with the minimum permissions necessary for that instance to do its job. In practice, this means you should configure service accounts for your instances with the following process: Create a new service account rather than using the Compute Engine default service account. Grant IAM roles to that service account for only the resources that it needs. Configure the instance to run as that service account. Grant the instance the https://www.googleapis.com/auth/cloud-platform scope to allow full access to all Google Cloud APIs, so that the IAM permissions of the instance are completely determined by the IAM roles of the service account. Avoid granting more access than necessary and regularly check your service account permissions to make sure they are up-to-date. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#best_practices

Get Premium Associate Cloud Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Cristen 10 months ago

Wait, people actually use user account credentials in config files? Really?

Novella 10 months ago

I think A is better for simplicity.

Jill 11 months ago

Definitely not D, that's a security nightmare.

Donette 11 months ago

Storing credentials in a config file? That sounds risky!

Coral 11 months ago

Option B is the way to go!

Hoa 11 months ago

I definitely remember that storing credentials in a config file is not recommended, so options C and D seem wrong to me.

Salina 11 months ago

I feel like option B could be a good choice too, but I can't recall if we covered the specifics of configuring the application to use a new service account.

Haydee 12 months ago

I think option A makes sense since it mentions assigning access to the service account, which is what we practiced in the lab.

Glenn 12 months ago

I remember we discussed the importance of using service accounts for VM authentication, but I'm not sure if I should create a new one or just use the existing one.

Junita 1 year ago

I'm a bit confused by the wording here. Does "minimal changes" mean I shouldn't have to modify my application code much? If that's the case, I think option A might be the way to go, since it sounds like I can just assign the right permissions to the existing service account.

Stefanie 1 year ago

Okay, I've got this. The question is asking about best practices, so I'm going to go with option B and create a service account. That way, I can keep my personal credentials secure and still access the Google Cloud services I need.

Cecilia 1 year ago

Hmm, I'm a little unsure about this one. I know I need to set up authentication, but I'm not sure if I should use a service account or just store my own credentials. I'll have to think this through carefully.

Hyun 1 year ago

This seems pretty straightforward. I think the key is to use a service account instead of my personal credentials, so I'll go with option B.

Yolando 1 year ago

For a production environment, you definitely don't want to be using Application Default Credentials. That's just asking for trouble.

Vivan 1 year ago

↳ replying to Yolando

B) Create a service account with appropriate access for Google services, and configure the application to use this account.

Virgie 1 year ago

↳ replying to Yolando

A) Assign appropriate access for Google services to the service account used by the Compute Engine VM.

Vincenza 1 year ago

I'm not sure, but I think A could also be a valid option.

Elin 1 year ago

I agree with Tyra, B sounds like the right choice.

Leonida 1 year ago

Haha, storing user credentials in a config file? That's a disaster waiting to happen! Option D is definitely not the way to go.

Sherron 1 year ago

↳ replying to Leonida

C) Store credentials for service accounts with appropriate access for Google services in a config file, and deploy this config file with your application.

Shayne 1 year ago

↳ replying to Leonida

B) Create a service account with appropriate access for Google services, and configure the application to use this account.

Eulah 1 year ago

↳ replying to Leonida

A) Assign appropriate access for Google services to the service account used by the Compute Engine VM.

Lauran 1 year ago

I agree, B is the correct answer. Assigning appropriate access to a service account is the Google-recommended practice.

Marjory 1 year ago

↳ replying to Lauran

Definitely, it's important to follow best practices when setting up authentication on a Compute Engine VM.

Casey 1 year ago

↳ replying to Lauran

Make sure to configure the application to use the new service account for seamless migration.

Tracey 1 year ago

↳ replying to Lauran

Agreed, that's the recommended practice by Google for authentication.

Ronny 1 year ago

↳ replying to Lauran

I think B is the best option. Creating a service account with the right access is key.

Tyra 1 year ago

I think the answer is B.

Elliot 1 year ago

Option B seems like the way to go. Using a service account is more secure than storing user credentials.

Virgina 1 year ago

↳ replying to Elliot

Assigning appropriate access for Google services to the service account used by the Compute Engine VM is the way to go.

Gracia 1 year ago

↳ replying to Elliot

I think we should create a service account with appropriate access for Google services.

Mireya 1 year ago

↳ replying to Elliot

I agree, using a service account is definitely more secure.

Google Associate Cloud Engineer Exam - Topic 1 Question 107 Discussion