Bird
Raised Fist0
GCPcloud~10 mins

SSH access and metadata in GCP - Interactive Code Practice

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Practice - 5 Tasks
Answer the questions below
1fill in blank
easy

Complete the code to add an SSH key to the instance metadata.

GCP
gcloud compute instances add-metadata my-instance --metadata ssh-keys=[1]
Drag options to blanks, or click blank then click option'
A"user:ssh-rsa AAAAB3Nza... user@example.com"
B"zone=us-central1-a"
C"machine-type=n1-standard-1"
D"image-family=debian-11"
Attempts:
3 left
💡 Hint
Common Mistakes
Using zone or machine-type as metadata keys.
Not including the username before the SSH key.
2fill in blank
medium

Complete the code to enable OS Login on a Compute Engine instance.

GCP
gcloud compute instances add-metadata my-instance --metadata enable-oslogin=[1]
Drag options to blanks, or click blank then click option'
AFALSE
BTRUE
Cenabled
Dyes
Attempts:
3 left
💡 Hint
Common Mistakes
Using 'yes' or 'enabled' instead of 'TRUE'.
Setting the value to 'FALSE' which disables OS Login.
3fill in blank
hard

Fix the error in the command to remove SSH keys from instance metadata.

GCP
gcloud compute instances remove-metadata my-instance --keys=[1]
Drag options to blanks, or click blank then click option'
Aclear-keys
Bremove-ssh-keys
Cdelete-keys
Dssh-keys
Attempts:
3 left
💡 Hint
Common Mistakes
Using incorrect metadata key names like 'remove-ssh-keys'.
Trying to use commands that do not exist.
4fill in blank
hard

Fill both blanks to create a metadata entry that disables project-wide SSH keys on an instance.

GCP
gcloud compute instances add-metadata my-instance --metadata [1]=[2]
Drag options to blanks, or click blank then click option'
Ablock-project-ssh-keys
Benable-oslogin
CTRUE
DFALSE
Attempts:
3 left
💡 Hint
Common Mistakes
Using enable-oslogin instead of block-project-ssh-keys.
Setting the value to FALSE which does not block keys.
5fill in blank
hard

Fill all three blanks to add a custom SSH key metadata entry with a username and key.

GCP
gcloud compute instances add-metadata my-instance --metadata [1]=[2]:[3]
Drag options to blanks, or click blank then click option'
Assh-keys
Balice
C"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7... alice@example.com"
Denable-oslogin
Attempts:
3 left
💡 Hint
Common Mistakes
Using enable-oslogin as the metadata key.
Not including the username before the SSH key.

Practice

(1/5)
1. What is the main purpose of SSH access in Google Cloud Platform (GCP)?
easy
A. To securely connect to virtual machine instances
B. To store large files in the cloud
C. To monitor network traffic
D. To create new virtual machines automatically

Solution

  1. Step 1: Understand SSH access

    SSH (Secure Shell) is a protocol used to securely connect to remote machines, such as virtual machines in GCP.

  2. Step 2: Identify SSH use in GCP

    In GCP, SSH access allows users to securely log into VM instances to manage and operate them.

  3. Final Answer:

    To securely connect to virtual machine instances -> Option A

  4. Quick Check:

    SSH access = secure VM connection [OK]
Hint: SSH is for secure remote login to VMs [OK]
Common Mistakes:
  • Confusing SSH with storage or monitoring services
  • Thinking SSH creates VMs instead of connecting to them
2. Which of the following is the correct way to add an SSH key to a VM instance's metadata in GCP?
easy
A. Add the SSH key to the project billing settings
B. Add the SSH key to the instance's firewall rules
C. Add the SSH key to the VM's disk storage
D. Add the SSH key to the instance's metadata under the 'ssh-keys' key

Solution

  1. Step 1: Understand where SSH keys are stored

    SSH keys are stored in metadata, which is a place to keep configuration info for VMs.

  2. Step 2: Identify correct metadata key

    The correct metadata key for SSH keys is 'ssh-keys' at the instance or project level.

  3. Final Answer:

    Add the SSH key to the instance's metadata under the 'ssh-keys' key -> Option D

  4. Quick Check:

    SSH keys stored in 'ssh-keys' metadata [OK]
Hint: SSH keys go in 'ssh-keys' metadata key [OK]
Common Mistakes:
  • Adding SSH keys to firewall rules instead of metadata
  • Trying to store SSH keys in disk storage or billing settings
3. Given the following metadata setup for a VM instance in GCP:
{"ssh-keys": "user:ssh-rsa AAAAB3Nza... user@example.com"}

What will happen when you try to SSH into this VM as 'user'?
medium
A. SSH connection will succeed using the provided public key
B. SSH connection will be denied due to missing keys
C. SSH will prompt for a password instead of using keys
D. The VM will restart automatically

Solution

  1. Step 1: Analyze the metadata content

    The metadata contains a valid SSH public key for user 'user' under 'ssh-keys'.

  2. Step 2: Understand SSH key usage

    When connecting as 'user', the VM checks the 'ssh-keys' metadata and allows access if the matching private key is used.

  3. Final Answer:

    SSH connection will succeed using the provided public key -> Option A

  4. Quick Check:

    Valid SSH key in metadata = successful SSH login [OK]
Hint: Valid SSH key in metadata allows login [OK]
Common Mistakes:
  • Assuming password prompt appears despite key presence
  • Thinking VM restarts due to SSH metadata
4. You added an SSH key to your project-wide metadata but still cannot SSH into a VM instance. What is the most likely cause?
medium
A. The firewall allows SSH traffic
B. The VM instance is turned off
C. The instance has block-project-ssh-keys set to true, blocking project keys
D. The SSH key format is incorrect in the metadata

Solution

  1. Step 1: Understand project-wide SSH keys

    Project-wide SSH keys apply to all instances unless blocked by instance settings.

  2. Step 2: Check instance metadata blocking

    If the instance metadata has 'block-project-ssh-keys' set to true, it ignores project-wide keys.

  3. Final Answer:

    The instance has block-project-ssh-keys set to true, blocking project keys -> Option C

  4. Quick Check:

    block-project-ssh-keys=true blocks project keys [OK]
Hint: Check 'block-project-ssh-keys' flag on instance [OK]
Common Mistakes:
  • Assuming firewall allows SSH means keys work
  • Ignoring instance-level metadata blocking project keys
5. You want to ensure that only specific users can SSH into a VM instance in GCP, even though project-wide SSH keys exist. Which approach is best?
hard
A. Add all users' SSH keys to project metadata and leave instance metadata empty
B. Set 'block-project-ssh-keys' to true on the instance and add allowed users' keys to instance metadata
C. Remove all SSH keys from project metadata and rely on firewall rules
D. Disable SSH access entirely on the VM instance

Solution

  1. Step 1: Understand project-wide vs instance metadata

    Project-wide SSH keys apply to all instances unless blocked by instance settings.

  2. Step 2: Control access per instance

    Setting 'block-project-ssh-keys' to true on the instance disables project keys, allowing only instance metadata keys.

  3. Step 3: Add allowed users' keys to instance metadata

    By adding only allowed users' keys to instance metadata, you restrict SSH access to them.

  4. Final Answer:

    Set 'block-project-ssh-keys' to true on the instance and add allowed users' keys to instance metadata -> Option B

  5. Quick Check:

    Block project keys + instance keys = controlled SSH access [OK]
Hint: Block project keys, use instance keys for control [OK]
Common Mistakes:
  • Relying only on firewall rules for SSH user control
  • Removing project keys without adding instance keys
  • Disabling SSH entirely when access is needed