Google Associate-Cloud-Engineer Exam Dumps

The most secure method and Google-recommended practice for local testing of service account permissions is Service Account Impersonation, as it avoids the security risk of managing physical key files.

Option A (Impersonation): This method allows your user credentials to temporarily act as the service account. It is keyless, meaning no service account key needs to be created, downloaded, or stored, which is the cornerstone of secure credential management on Google Cloud.

'Avoid creating service account keys. Service account keys pose a security risk. If a service account key is compromised, an attacker can use it to gain access to Google Cloud resources. Instead, use service account impersonation or workload identity federation.'

'This is useful for testing permissions... but you want to avoid creating and downloading a service account key.'

After you enable OS Login on one or more instances in your project, those VMs accept connections only from user accounts that have the necessary IAM roles in your project or organization. In this case, we are granting the group compute.osLogin which lets them log in as non-administrator account. And since we are directing them to use Cloud Shell to ssh, we dont need to add their SSH keys to the instance metadata.Ref:https://cloud.google.com/compute/docs/instances/managing-instance-access#configure_usersRef:https://cloud.google.com/compute/docs/instances/managing-instance-access#add_oslogin_keys

gcloud compute networks subnets expand-ip-range NAME gcloud compute networks subnets expand-ip-range - expand the IP range of a Compute Engine subnetworkhttps://cloud.google.com/sdk/gcloud/reference/compute/networks/subnets/expand-ip-range

gcloud deployment-manager deployments create creates deployments based on the configuration file. (Infrastructure as code). All the configuration related to the artifacts is in the configuration file. This command correctly creates a cluster based on the provided cluster.yaml configuration file.

Ref:https://cloud.google.com/sdk/gcloud/reference/deployment-manager/deployments/create