Google Professional Cloud Security Engineer Question 359
Select 3Google Cloud PlatformYou are deploying a machine learning model on Google Cloud AI Platform. The model processes sensitive data, such as personally identifiable information (PII). Which steps should you take to ensure the AI workload is secure and compliant with data protection standards?
- A
Enable Vertex AI's private endpoints for model serving to restrict access to internal networks.
- B
Encrypt data at rest using Cloud Key Management Service (Cloud KMS).
- C
Use Identity and Access Management (IAM) to grant the 'Editor' role to all team members for the AI project.
- D
Implement Data Loss Prevention (DLP) API to de-identify PII data before processing.
- E
Disable logging to prevent data exposure in logs.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing AI workloads involves multiple layers of protection, including restricting access to the model through private endpoints, encrypting sensitive data at rest, and ensuring that PII is de-identified before processing. These measures help protect sensitive data and maintain compliance with security and data protection standards. Avoid granting excessive permissions and ensure that logging is handled securely rather than outright disabled.
- A. Correct.
Enabling Vertex AI's private endpoints ensures that model serving is restricted to internal traffic, reducing exposure to unauthorized access.
- B. Correct.
Encrypting data at rest using Cloud KMS is a best practice to protect sensitive data from unauthorized access, ensuring compliance with security standards.
- C. Incorrect.
Granting the 'Editor' role to all team members violates the principle of least privilege and unnecessarily broadens access, increasing security risks.
- D. Correct.
Using the Data Loss Prevention (DLP) API to de-identify sensitive data like PII is critical to ensuring that no identifiable information is processed unnecessarily, enhancing data security and compliance.
- E. Incorrect.
Disabling logging is not recommended as it prevents the ability to audit and detect potential security incidents. Instead, sensitive data should be redacted from logs.