Discuss Google Professional Cloud DevOps Engineer Exam Topic 3 Question 67

You have deployed a fleet Of Compute Engine instances in Google Cloud. You need to ensure that monitoring metrics and logs for the instances are visible in Cloud Logging and Cloud Monitoring by your company's operations and cyber security teams. You need to grant the required roles for the Compute Engine service account by using Identity and Access Management (IAM) while following the principle of least privilege. What should you do?

AGrant the logging.editor and monitoring.metricwriter roles to the Compute Engine service accounts.

BGrant the Logging. admin and monitoring . editor roles to the Compute Engine service accounts.

CGrant the logging. logwriter and monitoring. editor roles to the Compute Engine service accounts.

DGrant the logging. logWriter and monitoring. metricWriter roles to the Compute Engine service accounts.

Suggested Answer: A

The correct answer is D. Grant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service accounts.

According to the Google Cloud documentation, the Compute Engine service account is a Google-managed service account that is automatically created when you enable the Compute Engine API1. This service account is used by default to run your Compute Engine instances and access other Google Cloud services on your behalf1. To ensure that monitoring metrics and logs for the instances are visible in Cloud Logging and Cloud Monitoring, you need to grant the following IAM roles to the Compute Engine service account23:

The logging.logWriter role allows the service account to write log entries to Cloud Logging4.

The monitoring.metricWriter role allows the service account to write custom metrics to Cloud Monitoring5.

These roles grant the minimum permissions that are needed for logging and monitoring, following the principle of least privilege. The other roles are either unnecessary or too broad for this purpose. For example, the logging.editor role grants permissions to create and update logs, log sinks, and log exclusions, which are not required for writing log entries6. The logging.admin role grants permissions to delete logs, log sinks, and log exclusions, which are not required for writing log entries and may pose a security risk if misused. The monitoring.editor role grants permissions to create and update alerting policies, uptime checks, notification channels, dashboards, and groups, which are not required for writing custom metrics.

Service accounts, Service accounts. Setting up Stackdriver Logging for Compute Engine, Setting up Stackdriver Logging for Compute Engine. Setting up Stackdriver Monitoring for Compute Engine, Setting up Stackdriver Monitoring for Compute Engine. Predefined roles, Predefined roles. Predefined roles, Predefined roles. Predefined roles, Predefined roles. [Predefined roles], Predefined roles. [Predefined roles], Predefined roles.

Get Premium Professional Cloud DevOps Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

21 comments · newest first

Cecilia 11 months ago

I’m surprised that logging.editor is even an option here.

Dorothea 11 months ago

I thought logging.admin was necessary for full access?

Emile 11 months ago

Wait, are we sure about the roles in option B? Seems too broad.

Zita 11 months ago

Definitely agree with D! Makes the most sense.

Diego 12 months ago

I think option D is the best choice for least privilege.

Yasuko 12 months ago

I feel like option B might be too broad with "admin" roles, which doesn't align with least privilege. I think we should stick to more specific roles like in option D.

Martha 1 year ago

I practiced a similar question where we had to assign roles for monitoring, and I feel like "metricWriter" is definitely important, but I can't remember if it was in option A or D.

Merissa 1 year ago

I think option D sounds familiar because it mentions both logging and monitoring roles, but I can't recall if "logWriter" is the correct spelling.

Brandon 1 year ago

I remember we discussed the principle of least privilege, but I'm not sure which specific roles are the most appropriate for this scenario.

Arminda 1 year ago

This seems straightforward. The question is asking us to grant the appropriate roles to the Compute Engine service accounts, so I'll go with option D to cover the logging and monitoring requirements.

Dorothea 1 year ago

I'm a bit confused on the difference between the logging.editor and logging.logwriter roles. I'll need to double-check the documentation to make sure I understand the distinction.

Sue 1 year ago

Okay, I think I've got this. The key is to grant the minimum required permissions for the Compute Engine service accounts to access logging and monitoring.

Valentin 1 year ago

Hmm, this looks like a tricky IAM permissions question. I'll need to carefully review the available roles and think through the principle of least privilege.

Junita 1 year ago

Okay, let's break this down step-by-step. First, I know a buffer cache is used to improve performance by caching frequently accessed data. Then I need to look at each statement and determine which ones are true based on my understanding of how a buffer cache works.

Francis 1 year ago

I wonder if cross-storage device vertical tiering could help with performance; it sounds familiar but I'm not confident about applying it in this context.

Izetta 2 years ago

I agree. Option C is also higher access than needed. Let's go with D.

Kimbery 2 years ago

Option B offers admin-level access. Doesn't seem to align with least privilege.

Broderick 2 years ago

D mentions logWriter and metricWriter. Seems like it captures essential duties without excess permissions.

Izetta 2 years ago

I think option D sounds logical. Least privilege means minimal necessary roles.

Kimbery 2 years ago

Yeah, it's asking about specific roles in IAM. Not that easy.

Broderick 2 years ago

This question is quite detailed. Makes me nervous.

Google Professional Cloud DevOps Engineer Exam - Topic 3 Question 67 Discussion