CCNA Configuring Access and Security Questions

This command correctly opens inbound TCP port 80 to traffic from any IPv4 address (0.0.0.0/0) and applies the rule only to VM instances tagged with 'web-server', matching the requirement precisely. The combination of --source-ranges 0.0.0.0/0 for internet sources and --target-tags web-server to scope the rule to the intended backend VMs is the standard way to allow HTTP in GCP. No other flags are needed, and the protocol:port syntax 'tcp:80' is accurately specified.

This command explicitly creates a subnet in a custom mode VPC (assuming the VPC already exists) and enables Private Google Access, allowing instances in that subnet to reach Google APIs and services through their internal IP addresses without needing a NAT or external IP. In a custom mode VPC, you must create each subnet manually, and this command defines the region and IP range, making it a required step after the VPC is created. Without this flag, the subnet would lack the Private Google Access capability, which is often a prerequisite for workloads that should reach Google services without public IPs.

For Cloud SQL, customer-managed encryption keys (CMEK) must be supplied at the moment you create the instance. You specify the key with the --disk-encryption-key flag in the gcloud sql instances create command, and the Cloud SQL service account must be granted Cloud KMS CryptoKey Encrypter/Decrypter permissions so it can use the key to encrypt data at rest. If these permissions are missing, instance creation fails; the key cannot be retroactively attached to an existing instance because the encryption setting is immutable.

Attached service accounts supply credentials automatically through the metadata server, so granting the required IAM roles directly to that service account lets the instance access the bucket without any exported key files. This satisfies the no-key-management constraint.

Setting an organization policy constraint (iam.disableServiceAccountKeyCreation is not relevant; here it's a custom constraint or the predefined compute.disableNestedVirtualization? Actually for CMEK, the relevant org policy is a custom constraint or the new `constraints/compute.requireCmek` that enforces CMEK on new Compute Engine disks at creation time. This is the only preventive control among the options because it blocks the disk-creation API call unless a valid CMEK key is supplied, making noncompliant instances impossible to create. It operates at the organization or folder level and is enforced by the resource manager before the Compute Engine API accepts the request.

roles/secretmanager.admin is the correct choice because it grants the full set of Secret Manager permissions needed to create, update, and delete secrets, versions, and their IAM policies. It includes actions such as secretmanager.secrets.create, secretmanager.secrets.update, secretmanager.secrets.delete, and secretmanager.versions.add, allowing complete lifecycle management without granting unrelated service permissions.

This is correct because VPC networks include an implicit deny-all rule for inbound traffic, so the only rule needed is an explicit allow for HTTP traffic (TCP port 80) from all source IP addresses (0.0.0.0/0) to instances tagged with 'web-server'. Target tags let you apply the rule selectively, ensuring only web server VMs accept inbound HTTP while all other instances remain blocked by the implicit deny. No additional deny rule is required or advisable.

Create a service account, grant it the required IAM roles (for example, roles/storage.objectViewer for Cloud Storage read access), and attach it to the instance using the --service-account flag at instance creation time. The instance then automatically authenticates to Google Cloud APIs through the instance's metadata server, which provides OAuth 2.0 access tokens on behalf of the service account without storing any secret material on the disk. This is the standard, secure pattern for granting a Compute Engine instance access to other GCP resources, as it leverages the cloud-native identity and avoids managing static credentials.

IAM deny policies are evaluated with higher precedence than allow policies, so a deny rule on Folder A explicitly blocks any inherited editor grant from reaching resources below that folder. Project 1, being a child of Folder A, inherits both the organization-level editor role and the folder-level deny, but deny rules win. As a result, even though the user was granted editor at the organization, the user's effective permissions in Project 1 do not include editor; the deny policy specifically prevents that role from being granted.

Cloud SQL with CMEK uses the customer-managed key for every data-plane operation, including reads and writes to the database, logs, and system tables. When the key is disabled, the instance loses access to the key material, causing the database engine to fail all I/O requests immediately. Consequently, the instance becomes unavailable and cannot be started or used until the key is re-enabled in Cloud KMS; re-enabling the key automatically restores normal operation without manual intervention.

`gcloud projects get-iam-policy my-project --format json` is the correct command for viewing the current IAM policy of a project. It retrieves the full policy, including all role bindings, conditions, and the etag, and returns it in a structured JSON format. The `--format json` flag ensures the output is machine-readable, which is useful for auditing, scripting, or feeding into other tools like `jq`. This command performs no mutation and is the standard way to inspect IAM policy state.

For Cloud NAT to work, the VPC network must contain a default route (0.0.0.0/0) whose next hop is the default internet gateway. This route is what causes outbound packets from instances to be sent to the gateway, where Cloud NAT performs the source IP translation. Without this route, packets destined for the internet have no valid next hop and are dropped, so the instances cannot reach the internet at all—Cloud NAT alone does not create routing logic.

This correctly adds an IAM policy binding on my-project, which owns the Container Registry artifacts, and defines the member as the service account from other-project using the `serviceAccount:` prefix. Since `roles/storage.objectViewer` grants read access to Cloud Storage objects that back GCR, this allows sa@other-project.iam.gserviceaccount.com to pull images and list repositories in my-project without needing a key or user account. The binding is cross-project: the member belongs to other-project, but the resource is in my-project, which is exactly the required configuration.

Enabling Data Access audit logs for the Cloud Storage service is correct because these logs specifically record every successful and failed read, write, and metadata operation on objects and buckets. By default, Data Access audit logs are disabled, so they must be explicitly turned on for Cloud Storage for the auditor to capture access attempts. Once enabled, each entry includes the principal, source IP, operation (e.g. storage.objects.get), and timestamp—providing the detailed evidence needed for an audit trail.

Creating a dedicated service account, granting it only the required Cloud Storage IAM roles such as roles/storage.objectViewer, and attaching it to the instance with the --service-account flag at creation time follows the principle of least privilege. The VM's metadata server then provides short-lived access tokens to the application, avoiding the need to manage or download any service account keys. This is the recommended, secure pattern for a GCE workload to access Cloud Storage with minimal permissions.

This is the correct read-only command for retrieving a project's IAM policy. It outputs the complete policy document, including bindings, version, etag, and audit configs, and '--format json' formats that document as JSON for easy parsing. It is the standard tool for viewing current IAM state and is the basis for making offline changes with set-iam-policy.

A Cloud Router is the correct component because Cloud NAT requires a Cloud Router in the same region and VPC network to function. The Cloud Router holds the NAT gateway's configuration, manages the NAT IP addresses, and dynamically exchanges routes with the VPC network. Without a Cloud Router, Cloud NAT cannot be created or operate, making it the essential resource for allowing private Compute Engine instances to access the internet or other destinations while remaining private.

Granting authorized users the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the Cloud KMS key is correct because this IAM role grants permission to call the Cloud KMS Encrypt and Decrypt operations, which are required for objects to be uploaded with and read from a CMEK-encrypted bucket. Even if a user has bucket-level permissions, they cannot create or read objects encrypted with that key unless they have this role on the key itself. This ensures only the intended authorized principals can use the customer-managed key for cryptographic operations.

Secret Manager is the dedicated Google Cloud service for storing, managing, and accessing secrets such as API keys, passwords, and certificates. It provides built-in secret versioning with immutable payloads, IAM-based access control at the secret-version level, automatic replication for high availability, and full audit logging via Cloud Audit Logs. This makes it the managed and scalable solution that directly matches the requirement.

When creating an instance, you must specify the service account with `gcloud compute instances create --service-account <SA_EMAIL>`, which attaches that identity to the instance for its entire lifetime. Once attached, the instance metadata server returns OAuth credentials for that service account, so all API calls from the instance are made as that identity. This is the correct way to ensure the instance uses a custom, least-privileged service account, provided the account has been granted the necessary IAM roles.

roles/secretmanager.secretAccessor is the correct predefined role for accessing a secret payload because it includes the secretmanager.versions.access permission, which is the exact IAM permission required to retrieve the stored database password. This role is narrowly scoped; it grants no management capabilities like secret creation, deletion, or IAM policy changes. For a developer whose sole need is to fetch the secret value at runtime, this role provides the minimum access needed while supporting least privilege best practices.

The rule satisfies both constraints: `--source-ranges 0.0.0.0/0` permits internet traffic, and `--target-tags web-server` scopes enforcement to instances carrying that network tag. Google Cloud VPC firewall rules apply to tagged instances, so only the designated Compute Engine instances receive the inbound TCP port 80 allowance.

This is the correct prerequisite for enabling CMEK on a Cloud SQL instance. You must create a key ring and a crypto key in Cloud KMS, then grant the Cloud SQL service account (e.g., service-<project>@gcp-sa-cloudsql.iam.gserviceaccount.com) the cloudkms.cryptoKeyEncrypterDecrypter role. That IAM binding lets Cloud SQL call Cloud KMS to encrypt and decrypt the data encryption keys used to protect the instance.

Private Google Access is a subnet-level setting that already routes traffic from VM instances with only internal IP addresses to Google APIs and services over Google's internal network. When this is enabled on the subnet, DNS resolution for googleapis.com automatically maps to Google's internal IP ranges, so the existing VPC routing handles API calls without any extra networking components. Therefore, no additional configuration is required.

The retention policy on the Cloud Storage bucket prevents objects from being deleted or overwritten for a specified duration, and object versioning preserves every version of each object, so even if an object is deleted or replaced, an immutable prior version remains. This is critical for compliance because audit logs must be tamper-proof and available for a multi-year period. However, this step alone does not capture logs; it secures the destination bucket where the log sink delivers exported log entries.

This is the correct command. `gcloud projects get-iam-policy` invokes the Cloud Resource Manager `getIamPolicy` API for the specified project, and the `--format json` flag requests the output as a structured JSON object containing the policy's `etag`, `version`, and `bindings`. It is the standard way to view all project-level IAM bindings.

This is the correct command. It uses the 'gcloud projects get-iam-policy' subcommand to retrieve the IAM policy for the specified project ID ('my-project') and sets the output format to JSON via '--format json'. The command returns the Policy object containing bindings, roles, members, etag, and version, all serialized in the requested JSON structure.

Granting roles/compute.securityAdmin at the folder level is the most precise solution because this role includes the compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete permissions needed to manage firewall rules, but does not include broader permissions to manage instances, networks, or IAM. IAM policies at the folder level are inherited by all projects and resources within that folder, so this single binding covers every descendant project, including newly created ones. This follows least privilege by granting exactly the permissions needed for firewall rule management and nothing extra.

Secret Manager is the dedicated GCP service for securely storing secrets such as database passwords, API keys, and TLS certificates. It provides automatic encryption at rest and in transit, granular IAM-permission binding, versioning, and audit logging, enabling applications to retrieve secrets on demand via API without embedding them in code. As a fully managed and centralized secret store, it is purpose-built to safeguard database credentials in compliance with security best practices.

Admin Activity audit logs are enabled by default for every Google Cloud project and record all IAM policy changes, including modifications to roles, bindings, and service account keys. To see who changed permissions, you can go directly to the Logs Explorer and query protoPayload.methodName=SetIamPolicy without creating any sinks or enabling additional features. This is the only option that directly answers the question with zero configuration effort.

Attaching a service account to a Compute Engine instance automatically provides the instance with credentials via the metadata server. The application can use the default credentials to authenticate to Google Cloud APIs. By granting the service account appropriate IAM roles, such as Storage Object Viewer, the instance gains access without managing any key files.

This is the correct command because it explicitly instructs Compute Engine to provision a Google-managed certificate for the specified domains. The --domains flag triggers Google's automatic certificate management lifecycle: Google Cloud obtains the certificate and handles renewals approximately 30 days before expiration, though you must verify domain ownership first. After creation, the certificate resource still needs to be attached to a target HTTPS proxy and associated with a forwarding rule before it can serve traffic.

Default network rules permit internal traffic and deny most external ingress, so an explicit ingress rule is required. Specifying 0.0.0.0/0 as source, port 443, target tag 'web-server' and priority 1000 permits internet HTTPS traffic to precisely those tagged instances, satisfying the stated requirement.

This rule is correct because it explicitly restricts inbound HTTPS (TCP port 443) to source IPs within the RFC 1918 private range 192.168.0.0/16 and applies only to VM instances bearing the network tag 'web-server'. The combination of --source-ranges with a CIDR and --target-tags ensures the rule targets exactly the intended web servers and only allows traffic from the specified internal subnet, satisfying the requirement.

The `gcloud compute ssl-certificates create` command with the `--domains` flag provisions a Google-managed SSL certificate, which satisfies the stem’s requirement for a Google-managed certificate rather than a self-managed one. This command triggers Google’s Certificate Authority to automatically handle domain validation and renewal for `example.com`, eliminating the need for manual certificate uploads. It directly attaches to the HTTPS load balancer’s target proxy, meeting the load-balancer constraint.

This is the exact, valid CLI command for retrieving a project's IAM policy. The subcommand get-iam-policy reads the IAM policy bound to the specified project resource, and --format json renders it as a JSON array of bindings, including roles, members, and conditions. It is the correct tool for this task.

roles/iam.securityReviewer is the correct choice because it grants permission to view IAM policies (for example, 'getIamPolicy') across all resources without allowing any modifications. It also includes permissions to list and get roles, which is exactly what an external auditor needs to review access configuration. This role aligns with least privilege for a read-only audit.

Granting roles/iam.securityReviewer at the folder level is correct because IAM permissions propagate through the resource hierarchy. This predefined role includes resourcemanager.folders.getIamPolicy and resourcemanager.projects.getIamPolicy, allowing the user to read IAM policies on the folder and every project, folder, and resource beneath it. Because the audit scope is the entire folder hierarchy, one grant at the folder root covers all child projects without per-project assignments, satisfying the requirement efficiently and with least privilege.

VPC Network Peering directly connects two VPC networks over Google's private backbone, allowing instances in each network to communicate using internal RFC 1918 addresses without needing public IPs or a VPN. It is the recommended method for inter-VPC connectivity because it offers low latency, no bandwidth restrictions, and no single point of failure. Peering works across projects and organizations, and it automatically exchanges routes for all subnets in the peered networks, so it fully satisfies the requirement to connect multiple VPC networks.

Admin Activity audit logs are enabled by default and capture all API calls that modify the configuration or metadata of resources, including IAM policy updates. For an organization with multiple folders, these logs at the org level record IAM binding changes on any resource in the hierarchy, such as 'setIamPolicy' from projects or folders. They provide an audit trail of who changed what, when, from where, and for which resource, making them the correct log type for investigating IAM policy modifications.

gcloud projects add-iam-policy-binding PROJECT_ID --member=user:email@example.com --role=roles/viewer is the correct command because it performs an additive update to the project's IAM policy. It reads the current policy, appends the new binding (role + member) to the existing set, and writes the merged policy back atomically, leaving all other bindings untouched. This is the standard CLI operation for granting a specific role to a user at the project scope.

This is the correct command to retrieve the IAM policy for a specific project, and using `--format json` explicitly instructs the CLI to output the policy as a JSON object. The `--format` flag does not change the underlying policy data, but it provides a structured, machine-readable representation that is ideal for scripting with tools like `jq` or for programmatic inspection. Without this flag, the same data would be rendered in YAML by default, so this flag only ensures the output format is standard and predictable.

Using Log Explorer in the Google Cloud console lets you query and filter audit logs once they are enabled. By applying a filter for the Cloud Storage service and the 'data_access' log type, you can view object-level operations such as writes, deletes, and overwrites. This is the final step that makes the audit trail visible and actionable for compliance, but it requires Data Access logging to already be enabled in the IAM audit config.

Data Access audit logs are the correct Cloud Audit Logs category for recording data-plane read/write operations, including Cloud Storage object GETs, BigQuery query reads, and Pub/Sub message publishes/pulls. They are typically disabled by default for most services and must be explicitly enabled for each service in the Audit Logs configuration, after which they deliver the who/what/when trail needed to audit data access across the organization.

Customer-Managed Encryption Keys (CMEK) is correct because it lets you control and automate key rotation through Cloud KMS. You define a rotation period (e.g., 30 days) on a key, and Cloud KMS automatically generates a new key version on that schedule while continuing to decrypt data with older versions. This provides both automated rotation and full auditability of when each version is used, which aligns with a company's requirement to rotate encryption keys without manual intervention.

Creating a dedicated service account, granting it only the IAM roles the application needs, and passing it via the --service-account flag at instance creation time is the Google-recommended pattern. This attaches the identity to the instance without ever downloading a key, so the instance authenticates through the metadata server's short-lived OAuth tokens. It ensures least privilege and avoids the security risk of storing long-lived credentials on the VM.

The --domains flag is the correct mechanism to request a Google-managed certificate: gcloud will create an SslCertificate resource in MANAGED state, and Google's Certificate Authority will issue a certificate for the specified domain, handling the entire lifecycle including automatic renewal. No additional flags are required, because the presence of --domains unambiguously selects the managed provisioning mode. This command is the exact answer for creating a managed certificate via the gcloud CLI.

The subnet-level flag --enable-private-ip-google-access is the required element because it configures the VPC subnet to route traffic from instances without external IPs directly to Google's public API endpoints over the Google network. Without this flag, VMs that lack an external IP address cannot reach Google APIs and services, even if the subnet has a default route with an internet gateway. This flag is set per subnet, and enabling it on the relevant subnet is the fundamental prerequisite for Private Google Access.

roles/pubsub.publisher is the correct least-privilege choice because it contains only the pubsub.topics.publish permission, which is exactly what a producer needs to send messages to a Pub/Sub topic. It does not grant permission to create, delete, or modify topics, subscribe, or manage IAM, so a compromised token from this service account could not reconfigure messaging infrastructure.

This is the correct flag. According to the gcloud compute networks subnets update documentation, "--enable-private-ip-google-access" modifies the subnet's privateIpGoogleAccess field, allowing VM instances without external IP addresses to reach Google APIs using the subnet's default route. This is the only flag listed that maps directly to the REST API parameter.

roles/secretmanager.secretManager grants permissions to create, get, list, update, and delete secret resources, plus view metadata, but deliberately omits secretmanager.versions.access. This lets developers fully manage the secret lifecycle without ever being able to view the sensitive payload, making it the correct least-privilege choice for the stated requirement to create and manage secrets while preventing access to values.

roles/logging.viewer is the predefined role for read-only access to Cloud Logging data. It includes permissions such as logging.logEntries.list, logging.logEntries.get, and logging.logs.list, which are required to view audit logs in the Logs Explorer. This role cannot modify log sinks or delete logs, providing the least-privileged access to view audit logs.

Data Access audit logs for Cloud Storage capture object-level read (e.g., object.get) and write (e.g., object.create) API calls, including the principal, source IP, timestamp, and the specific resource accessed. Because Data Access audit logs are disabled by default, they must be explicitly enabled in the project's IAM audit config to satisfy security auditing requirements.

Admin Activity audit logs record all API calls that modify configuration or metadata of resources, including IAM policy changes. In Cloud Logging, they are enabled by default and retained for 400 days. Since setting an IAM policy (e.g., projects.setIamPolicy) is a configuration-modifying operation, it's captured here. That's why this is the correct choice.

A Cloud Router alone is only a BGP session manager; it does not perform address translation by itself. To enable NAT on a VPC, you must explicitly create a Cloud NAT gateway and attach it to the Cloud Router for a given region and subnetwork, which then maps private IPs to a pool of external IPs. Without that gateway, outbound packets from private instances are dropped when they try to reach the internet, regardless of routing.

Cloud NAT is designed to provide source network address translation for private instances that do not have external IP addresses. If an instance is assigned an external IP, even an ephemeral one, its outbound traffic will use that IP as the source address, completely bypassing Cloud NAT. Therefore, the observation that traffic is 'not being NATed' is exactly what would happen when instances have external IPs, not a sign of NAT misconfiguration.

Google-managed certificates automatically handle both provisioning and renewal, so you never have to manually track expiration dates or replace certificates. After you configure the certificate on an HTTPS target proxy, Google Cloud's certificate manager regularly checks the certificate's validity and renews it approximately 30 days before expiration, provided the domain's DNS record still points to the load balancer. This automation is the key advantage because it prevents outages caused by expired certificates.

gcloud projects add-iam-policy-binding is the precise command to grant an existing service account an IAM role on a project. It performs an additive update to the project's IAM policy, leaving all other bindings intact, which is exactly what is needed when automating service account creation and subsequent access provisioning. The command requires the service account's email as the member and the role name (e.g., roles/storage.objectViewer), and it applies the binding only at the project level, matching the scenario.

roles/secretmanager.secretAccessor is the correct and minimal predefined role for service accounts that need to retrieve secret payloads. It includes the `secretmanager.versions.access` permission, which allows the caller to access the encryption-decrypted secret value from a specified version, and `secretmanager.versions.get` for metadata of that version. It does not permit creating, deleting, or modifying secrets, nor changing IAM policies, making it the exact role for a workload that reads a secret at runtime without administrative side effects.

Secret Manager is the correct choice because it is Google Cloud's purpose-built service for storing sensitive data such as database passwords, API keys, and certificates. It provides fine-grained IAM policies, automatic versioning, audit logging of secret access, and integration with services like Cloud Functions and GKE. Additionally, it supports secret rotation and allows you to enforce retention policies, making it the secure and native solution for managing a database password.

In Google Cloud VPC firewall rules, priority values determine evaluation order; lower numbers are evaluated first. The deny rule has a priority of 500, whereas the allow rule has 1000, so the deny rule is matched first. Because GCP applies the first matching rule and then stops, the traffic is denied before the allow rule is ever considered.

This is the correct approach: Data Access audit logs for Cloud Storage are enabled by adding a Cloud Storage audit config at the project, folder, or organization level using the IAM 'Audit Logs' tab or by setting an auditConfig in the IAM policy. You can specify the service storage.googleapis.com and include the desired permission types—ADMIN_READ, DATA_READ, DATA_WRITE—or use ALL. After the audit config is applied, Cloud Logging begins recording data access events on the matching buckets automatically, with no further per-bucket steps needed.

Enabling the --enable-private-ip-google-access flag on the subnet is the core requirement because it tells Google Cloud to allow instances in that subnet to reach Google APIs using only their internal IP addresses. After this flag is set, the VPC's routing table automatically includes a route for Google's API ranges that sends traffic over the internal Google network instead of the public internet. This flag must be present on every subnet where you want Private Google Access to work; enabling it on the VPC or a single instance is not possible.

This command correctly retrieves the IAM policy for the specified GCP project, including all role bindings for members at the project level. The --format json flag ensures the output is machine-readable JSON, which is useful for automation or programmatic inspection. It is the standard gcloud command for viewing project-level IAM policies.

This is the correct operational behavior. After rotating the key version in Cloud KMS, you must restart the Cloud SQL instance using the console, gcloud command, or API so that it recognizes the new key version as the encryption key for upcoming writes. The restart is required because the instance caches the old key version in memory, and the new version is only picked up during instance startup. This allows existing data to still be decrypted with the prior version while new encrypted data uses the updated version.

The `roles/secretmanager.admin` role includes the `secretmanager.secrets.create` permission required for adding a new secret via the Cloud Console, gcloud CLI, or Secret Manager API. It also grants full management of versions, IAM policies, and deletion, so it is the predefined role that reliably supports all CI/CD operations that need to provision and rotate secrets.

Private Google Access on the subnet is the correct configuration to enable VMs without external IPs to reach Google APIs and services. When enabled, the subnet's VMs can send traffic to Google's public API IPs, which are then routed internally through the VPC's default route and into Google's network without ever needing an external IP. This is a subnet-level Boolean flag that must be turned on for each subnet where you want the capability; it applies to the entire subnet and works with the standard default route. Enabling this is the direct, documented mechanism that satisfies the security engineer's requirement.

Access scopes define the maximum set of APIs an instance can call, while IAM roles determine the actual permissions. By setting scopes to only the required APIs and granting minimal IAM roles, the instance is restricted to exactly the needed APIs. This enforces defense in depth and meets the requirement of limiting access to a specific set.

Rule B has a priority of 500, which is numerically lower than Rule A's priority of 1000, so GCP evaluates Rule B first. Because Rule B's action is to deny and the traffic matches its conditions, that denial is the final decision. Rule A is not evaluated, so the traffic is denied as expected.

The Viewer role provides read-only access to all resources within a project, excluding sensitive data and IAM policies. It allows auditors to view resources without the ability to modify them. This role is appropriate for granting broad read access while preventing changes, and it does not include permissions to alter IAM policies.

Cloud NAT lets instances without external IP addresses initiate outbound connections to the internet for updates and patches, while remaining unreachable from inbound internet traffic. This satisfies the requirement for private instances to obtain updates without exposing them publicly.

Cloud NAT, configured through a Cloud Router, provides managed outbound internet connectivity to private Compute Engine instances without assigning them external IP addresses. It uses the Cloud Router to dynamically exchange routing information with the VPC network, allowing instances with internal IPs to initiate connections to the internet while remaining unreachable from outside. This is the recommended, highly available, and serverless solution because Cloud NAT automatically scales to handle thousands of instances and does not require manual patching or failover configuration.

Granting the roles/secretmanager.secretAccessor role to the Compute Engine default service account is the correct approach because it gives the instance's identity the minimum permission needed to access secret versions. The instance authenticates through the metadata server, so no long-lived keys are stored on the instance. This makes it the most secure and operationally simple method, and it aligns with Google's recommended practice of using IAM roles on service accounts rather than embedding credentials.

This command correctly creates a Google-managed SSL certificate for the domain 'example.com'. The --domains flag tells the Cloud API to request a managed certificate, which Google will automatically obtain and renew without requiring you to upload a private key. Note that for a global external load balancer, you should also include --global, but the essential syntax for a managed certificate is exactly this.

Attaching the service account via the --service-account flag at instance creation is the correct approach because it binds the identity to the VM and makes credentials available through the metadata server. Code running on the instance can fetch OAuth 2.0 tokens from the metadata endpoint (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token) and act on behalf of the service account. This avoids managing key files and ensures that IAM permissions are automatically applied to the instance.