Exam Professional Cloud DevOps Engineer topic 1 question 153 discussion

answer is C. For B, they specified that a user manager service account is attached to the instance, so the default one will not gonna be used.

The issue described suggests that the service account associated with the Compute Engine instance may not have the necessary permissions to write logs to Cloud Logging. To resolve this issue following Google-recommended practices, you should choose option C: Add the Logs Writer role to the service account. By adding the Logs Writer role to the service account, you grant the necessary permissions to write logs to Cloud Logging. This role provides the required access for the agents running on the instance to send log entries to Cloud Logging. Make sure to follow the principle of least privilege and only grant the minimum permissions required for your application to function. Therefore, the recommended solution is to add the Logs Writer role to the user-managed service account attached to the Compute Engine instance.

Vote C

Same reason as KHOUKHA.

B is correct : https://cloud.google.com/logging/docs/agent/logging/troubleshooting#verify_default_service_account_permission

I think answer C is correct in granting the existing service account the least privilege to write logs.