nerdexam
Google

PROFESSIONAL-CLOUD-DEVOPS-ENGINEER · Question #93

You have deployed a fleet of Compute Engine instances in Google Cloud. You need to ensure that monitoring metrics and logs for the instances are visible in Cloud Logging and Cloud Monitoring by your…

The correct answer is A. Grant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service. To ensure Compute Engine instances can write logs and monitoring metrics to Google Cloud services with least privilege, grant their service accounts the logging.logWriter and monitoring.metricWriter roles.

Submitted by saadiq_pk· Apr 18, 2026Implementing service monitoring strategies

Question

You have deployed a fleet of Compute Engine instances in Google Cloud. You need to ensure that monitoring metrics and logs for the instances are visible in Cloud Logging and Cloud Monitoring by your company's operations and cyber security teams. You need to grant the required roles for the Compute Engine service account by using Identity and Access Management (IAM) while following the principle of least privilege. What should you do?

Options

  • AGrant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service
  • BGrant the logging.admin and monitoring.editor roles to the Compute Engine service accounts.
  • CGrant the logging.editor and monitoring.metricWriter roles to the Compute Engine service
  • DGrant the logging.logWriter and monitoring.editor roles to the Compute Engine service accounts.

How the community answered

(29 responses)
  • A
    72% (21)
  • B
    3% (1)
  • C
    7% (2)
  • D
    17% (5)

Why each option

To ensure Compute Engine instances can write logs and monitoring metrics to Google Cloud services with least privilege, grant their service accounts the `logging.logWriter` and `monitoring.metricWriter` roles.

AGrant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine serviceCorrect

The `logging.logWriter` role grants the necessary permissions for a service account to write log entries to Cloud Logging, while the `monitoring.metricWriter` role grants permissions to write monitoring data to Cloud Monitoring. These roles adhere to the principle of least privilege as they provide only the required write access without broader administrative or editing capabilities.

BGrant the logging.admin and monitoring.editor roles to the Compute Engine service accounts.

`logging.admin` grants full control over logging resources and `monitoring.editor` grants broad editing permissions for monitoring resources; both are far too permissive for a service account that only needs to write logs and metrics, violating least privilege.

CGrant the logging.editor and monitoring.metricWriter roles to the Compute Engine service

`logging.editor` grants permissions to modify logging resources, which is too broad for simply writing logs. While `monitoring.metricWriter` is correct, pairing it with `logging.editor` violates least privilege.

DGrant the logging.logWriter and monitoring.editor roles to the Compute Engine service accounts.

`logging.logWriter` is correct for writing logs. However, `monitoring.editor` grants permissions to modify monitoring resources, which is too broad; the service account only needs to write metrics, not edit dashboards or alerts, violating least privilege.

Concept tested: IAM roles for Cloud Logging/Monitoring write access

Source: https://cloud.google.com/logging/docs/access-control https://cloud.google.com/monitoring/access-control

Topics

#IAM Roles#Cloud Logging#Cloud Monitoring#Least Privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice