Discuss Google Associate Cloud Engineer Exam Topic 4 Question 95

You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?

AInstruct the external consultant to use the gcloud compute ssh command line tool by using Identity-Aware Proxy to access the instance.

BInstruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.

CInstruct the external consultant to generate an SSH key pair, and request the public key from the consultant.
Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.

DInstruct the external consultant to generate an SSH key pair, and request the private key from the consultant.
Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.

Suggested Answer: C

The best option is to instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Then, add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key. This way, you can grant the consultant access to the instance without requiring a Google account or exposing the instance's public IP address.This option also follows the best practice of using user-managed SSH keys instead of service account keys for SSH access1.

Option A is not feasible because the external consultant does not have a Google account, and therefore cannot use Identity-Aware Proxy (IAP) to access the instance.IAP requires the user to authenticate with a Google account and have the appropriate IAM permissions to access the instance2. Option B is not secure because it exposes the instance's public IP address, which can increase the risk of unauthorized access or attacks. Option D is not correct because it reverses the roles of the public and private keys. The public key should be added to the instance, and the private key should be kept by the consultant.Sharing the private key with anyone else can compromise the security of the SSH connection3.

1: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

2: https://cloud.google.com/iap/docs/using-tcp-forwarding

3: https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances

Get Premium Associate Cloud Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

An 11 months ago

I think C is the best choice, but I'm surprised it's not more common knowledge!

Michell 11 months ago

Definitely not D, that’s a huge security no-no.

Tamesha 11 months ago

Wait, why would you ever ask for a private key? That's risky!

Olen 11 months ago

I disagree, using the public IP (Option B) is simpler.

Alline 12 months ago

Option C is the way to go! SSH keys are secure.

Earleen 12 months ago

Option D seems wrong to me; I remember we shouldn't share private keys. It has to be option C, right? But I hope I’m not mixing things up!

Fannie 1 year ago

I feel like option B could work since the consultant is on a VPN, but I’m not sure if using the public IP is the best practice without a Google account.

Rolland 1 year ago

I remember discussing Identity-Aware Proxy in relation to secure access, so option A might be a good choice too, but I’m not confident about the gcloud command specifics.

Penney 1 year ago

I think option C sounds familiar, like something we practiced in class about SSH key management. But I'm not entirely sure if that's the only way to do it.

Nikita 1 year ago

I'm a bit confused by the options here. Using the public IP address doesn't seem secure, and I'm not familiar with Identity-Aware Proxy. I think I'll go with option C to be on the safe side.

Dominque 1 year ago

Option C sounds like the way to go. It's a common approach for granting external access to a Linux instance without requiring a Google account. I'll make sure to carefully follow the steps to add the consultant's public key.

Roxanne 1 year ago

Hmm, I'm a bit unsure about this one. I'm not sure if using the public IP address is the best approach since the consultant doesn't have a Google account. Maybe I should look into the Identity-Aware Proxy option.

Whitley 1 year ago

This seems straightforward. I'd go with option C - having the consultant generate an SSH key pair and providing the public key to access the instance.

Clorinda 1 year ago

I definitely know a server template isn't required, but I can't remember if we need both the CSV upload and the device template specifically.

Marleen 2 years ago

Haha, imagine the consultant trying to use the gcloud tool without a Google account? That's just asking for trouble. C is the clear winner here.

Nakisha 2 years ago

↳ replying to Marleen

Using SSH key pair with option C is the best choice for the consultant to access the Linux-based instance securely.

Huey 2 years ago

↳ replying to Marleen

Agreed, C is the most secure option for adding the consultant's SSH key to the instance.

Bettina 2 years ago

↳ replying to Marleen

Yeah, definitely don't want the consultant to struggle with gcloud without a Google account. C is the way to go.

Tamekia 2 years ago

Hmm, I'm not sure about giving the consultant direct access to the instance's public IP. Option B feels a bit risky to me. C is the safer bet.

Macy 2 years ago

↳ replying to Tamekia

It's important to prioritize security when granting access to external consultants.

Arlette 2 years ago

↳ replying to Tamekia

Using SSH key pairs with option C is definitely a safer approach.

Felicidad 2 years ago

↳ replying to Tamekia

I agree, giving direct access through the public IP does seem risky.

Alpha 2 years ago

I agree with Pearline. Option C is the best choice here. The consultant doesn't need a Google account, and the SSH key pair is a simple solution.

Eugene 2 years ago

↳ replying to Alpha

Definitely. It's a straightforward solution for granting access to the Linux-based instance.

My 2 years ago

↳ replying to Alpha

Agreed. It's the most efficient way to grant access to the consultant.

Lauran 2 years ago

↳ replying to Alpha

I think so too. It's the most secure option as well.

Olive 2 years ago

↳ replying to Alpha

Option C is definitely the way to go. It's simple and doesn't require a Google account.

Venita 2 years ago

That's a good point, Jaleesa. Convenience is important too. It really depends on the specific needs of the consultant.

Jaleesa 2 years ago

I disagree, I believe option A is more convenient. Using Identity-Aware Proxy with gcloud compute ssh is easier for the consultant.

Pearline 2 years ago

Option C is the way to go. The consultant can generate an SSH key pair, and you can add the public key to the instance. Secure and straightforward.

Kimberlie 2 years ago

↳ replying to Pearline

Exactly, it's a simple and secure solution for the consultant to access the instance.

Nancey 2 years ago

↳ replying to Pearline

Then you can add the public key to the instance yourself.

Jeanice 2 years ago

↳ replying to Pearline

I agree, having the consultant generate an SSH key pair is the way to go.

Theron 2 years ago

↳ replying to Pearline

Option C is the best choice. It's secure and easy.

Venita 2 years ago

I think option C is the best choice. It's secure and allows the consultant to access the instance with their private key.

Google Associate Cloud Engineer Exam - Topic 4 Question 95 Discussion