Ensuring the successful operation of a cloud solution · Topic 1 of 8

Managing Compute Engine

Connecting to Compute Engine VMs with SSH and IAP, listing running instances, creating and scheduling snapshots, managing images, and attaching GPUs and TPUs.

4 min

In a nutshell

gcloud compute ssh, with --tunnel-through-iap for private VMs.
gcloud compute instances list and describe.
Snapshots back up disks incrementally; snapshot schedules automate them with retention.

What it is

Day-to-day VM operations: connecting to instances, seeing what is running, protecting disks with snapshots (including snapshot schedules), creating reusable images, and attaching GPUs and TPUs.

How it works

Connecting to instances

# SSH with keys managed automatically (OS Login or metadata keys)
gcloud compute ssh web-1 --zone=us-central1-a

# SSH to a VM without an external IP, through Identity-Aware Proxy
gcloud compute ssh web-1 --zone=us-central1-a --tunnel-through-iap

Method	When
SSH from the console or gcloud	Linux VMs with external IP or IAP
IAP TCP forwarding	VMs without external IPs; needs a firewall rule allowing `35.235.240.0/20` and `roles/iap.tunnelResourceAccessor`
RDP	Windows VMs; set a password with `gcloud compute reset-windows-password`
Serial console	Troubleshoot a VM that does not boot or has no network

Viewing running instances

gcloud compute instances list
gcloud compute instances list --filter="status=RUNNING AND zone:us-central1-a"
gcloud compute instances describe web-1 --zone=us-central1-a

list shows name, zone, machine type, internal and external IPs and status across the project.

Snapshots

A snapshot is a point-in-time backup of a persistent disk. Snapshots are incremental after the first one and stored in a multi-region or regional location.

# take a snapshot now
gcloud compute snapshots create web-1-snap --source-disk=web-1 --source-disk-zone=us-central1-a
gcloud compute snapshots list
gcloud compute snapshots delete web-1-snap

# schedule daily snapshots kept for 14 days
gcloud compute resource-policies create snapshot-schedule daily-14 \
  --region=us-central1 --daily-schedule --start-time=02:00 --max-retention-days=14
gcloud compute disks add-resource-policies web-1 --zone=us-central1-a \
  --resource-policies=daily-14

Restore by creating a new disk from the snapshot (gcloud compute disks create ... --source-snapshot=...). Snapshots can restore into another zone or region, which helps disaster recovery.

Exam tip

"Back up disks every day automatically and delete old backups" is a snapshot schedule resource policy, not a cron job.

Images

An image packages a boot disk so you can create many identical VMs.

gcloud compute images create web-image-v2 --source-disk=web-1 --source-disk-zone=us-central1-a \
  --family=web-images
gcloud compute images list --filter="family=web-images"
gcloud compute images delete web-image-v1

Using an image family means templates can always pick the newest image in the family. Images can be shared with other projects through IAM.

	Snapshot	Image
Purpose	Back up and restore a disk's data	Create new VMs (boot disks)
Typical source	Any persistent disk	A boot disk prepared as a template
Incremental	Yes	No

Attaching GPUs and TPUs

Accelerator	How
GPUs on Compute Engine	Use an accelerator-optimized machine type (such as A2, A3, G2) or attach GPUs to supported N1 VMs with `--accelerator=type=...,count=...`; set `--maintenance-policy=TERMINATE`; install GPU drivers
GPUs on GKE	Create a node pool with GPUs; GKE can install drivers
TPUs	Create Cloud TPU VMs (`gcloud compute tpus tpu-vm create`) or GKE TPU node pools

GPUs and TPUs need quota in the region and are available only in some zones.

A worked scenario

An operations engineer needs nightly backups of a database VM's disk kept for two weeks. She creates a snapshot schedule and attaches it to the disk. Before an upgrade she takes a manual snapshot. She builds a new image from a patched VM into the web-images family so the instance template picks it up, and connects to private VMs with gcloud compute ssh --tunnel-through-iap.

How the exam asks about this

"SSH to a VM with no external IP." IAP TCP forwarding with --tunnel-through-iap.
"List all running VMs in a zone." gcloud compute instances list --filter.
"Daily automatic disk backups with retention." A snapshot schedule.
"Create many VMs with the same boot disk." A custom image, ideally in an image family.

What to remember for the exam

gcloud compute ssh, with --tunnel-through-iap for private VMs.
gcloud compute instances list and describe.
Snapshots back up disks incrementally; snapshot schedules automate them with retention.
Images create boot disks for new VMs; image families point to the latest image.
GPU VMs need TERMINATE on maintenance, drivers and regional quota; TPUs run as TPU VMs or GKE node pools.

Watch out

Deleting a VM can delete its boot disk by default (auto-delete). Take a snapshot first if you may need the data.

Common mistakes

Using images as backups. Snapshots are designed for backup and restore.

Writing cron jobs for snapshots. Snapshot schedules do it natively.

Opening port 22 to the internet. Use IAP with the IAP source range instead.

Check yourself

Which flag lets gcloud compute ssh reach a VM without an external IP?
--tunnel-through-iap.
How do you automate daily snapshots with a 14-day retention?
Create a snapshot schedule resource policy and attach it to the disk.
What is an image family used for?
To always reference the latest image in a group when creating VMs.

Topic 1 of 8 in Ensuring the successful operation of a cloud solution

Test yourself on Ensuring the successful operation of a cloud solution

The full Google Cloud Associate Cloud Engineer question bank has 661 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.