A Cloud Solutions Architect is using natural language prompts in Gemini Cloud Assist to generate Terraform Infrastructure as Code (IaC) and deployment scripts for a secure internal workload on Compute Engine. The organizational security policy dictates the following technical requirements: Compute Engine VM instances must not have public/external IP addresses assigned to their network interfaces. Compute Engine VM instances must maintain outbound internet connectivity to download operating system updates and packages. The deployment must not use the default VPC network. Compute Engine VM instances must run using a custom least-privilege service account instead of the default Compute Engine service account. Which infrastructure architecture and configuration generated by Gemini Cloud Assist meets all organizational technical and security requirements while adhering to Google Cloud best practices?

Generate Terraform defining a custom VPC network and subnet, configure a Cloud Router with Cloud NAT, attach a dedicated service account to the VM instance template, and omit the `access_config` block from the VM network interface.: ### What the solution is This solution uses **Gemini Cloud Assist** to generate **Terraform Infrastructure as Code (IaC)** that establishes an enterprise-grade, secure private compute architecture adhering to the **Google Cloud Well-Architected Framework**. ### How it meets the requirements - **No external IP addresses**: In Google Cloud Terraform configurations, omitting the `access_config` block inside `network_interface` ensures that the VM instances are provisioned without an external (public) IP address. - **Outbound internet access**: Provisioning a **Cloud Router** combined with a **Cloud NAT** gateway allows private Compute Engine instances in the custom subnet to initiate egress connections to the internet (for package updates) without exposing them to inbound internet traffic. - **Avoid default VPC**: Declaring a dedicated custom **VPC network** and subnet ensures strict boundary isolation and prevents using the default network and its overly permissive pre-populated firewall rules. - **Least-privilege service account**: Specifying an explicit, custom **IAM service account** in the instance template prevents reliance on the default Compute Engine service account, which often contains overly broad permissions. ### Key advantages and capabilities - **Enhanced Security Posture**: Disabling external IPs prevents direct Layer 3/4 inbound attacks from the public internet. - **Managed Egress**: **Cloud NAT** scales automatically without requiring proxy VM management or complex routing tables. - **Deterministic IaC**: Defining the instance template in Terraform ensures reproducible deployments across environments. - **Granular Access Control**: Dedicated service accounts enable role assignment aligned strictly with the principle of least privilege. ### Why this is optimal This approach directly satisfies every security requirement while adopting standard **Google Cloud best practices** for network isolation, controlled egress, and identity governance.

StudyCerts

Gemini Iac Secure Compute Provisioning | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Gemini Iac Secure Compute Provisioning

Section: Gemini Cloud Assist

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A Cloud Solutions Architect is using natural language prompts in Gemini Cloud Assist to generate Terraform Infrastructure as Code (IaC) and deployment scripts for a secure internal workload on Compute Engine.

The organizational security policy dictates the following technical requirements:

Compute Engine VM instances must not have public/external IP addresses assigned to their network interfaces.
Compute Engine VM instances must maintain outbound internet connectivity to download operating system updates and packages.
The deployment must not use the default VPC network.
Compute Engine VM instances must run using a custom least-privilege service account instead of the default Compute Engine service account.

Which infrastructure architecture and configuration generated by Gemini Cloud Assist meets all organizational technical and security requirements while adhering to Google Cloud best practices?

Generate Terraform utilizing the terraform-google-project-factory module to create resources within the default VPC, configure private Google access only, and grant roles/compute.imageUser to allAuthenticatedUsers.

Generate Terraform defining a custom VPC network and subnet, configure a Cloud Router with Cloud NAT, attach a dedicated service account to the VM instance template, and omit the access_config block from the VM network interface.

Generate Terraform defining a custom VPC network and subnet, assign an access_config block configured with External NAT to the network interface, and assign the roles/compute.admin role to the default Compute Engine service account.

Generate a gcloud script that provisions instances within the project's default VPC network, attaches Cloud NAT to the default gateway, and configures an instance template with the default service account and cloud-platform access scope.

Professional Cloud Architect

Gemini Iac Secure Compute Provisioning

Related questions