Google Professional Cloud Security Engineer Question 362
Select 3Google Cloud PlatformYour organization is deploying a machine learning model on Google Cloud to process sensitive personal data. As a security engineer, you need to ensure the AI workload is secure while maintaining compliance with data protection regulations. Which of the following actions should you take to secure this AI workload?
- A
Use Vertex AI's built-in support for customer-managed encryption keys (CMEK) to encrypt model artifacts and training data.
- B
Enable Data Loss Prevention (DLP) to identify and redact sensitive data before training the model.
- C
Store API keys used to access the model in plaintext within the application code for faster development cycles.
- D
Restrict access to the model endpoint by configuring IAM roles and permissions.
- E
Disable logging for AI workloads to prevent sensitive data from being captured in logs.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing AI workloads involves using encryption for data and model artifacts, ensuring sensitive data is handled appropriately, and enforcing strict access controls. By leveraging CMEK, DLP, and IAM roles, you can enhance the security of the AI workload while remaining compliant with regulatory requirements. However, other insecure practices, such as storing API keys in plaintext or disabling logging, should be avoided as they introduce significant risks to the system.
- A. Correct.
Using CMEK ensures that sensitive data and model artifacts are encrypted with encryption keys that are fully controlled by your organization, enhancing security and compliance with regulations.
- B. Correct.
Enabling DLP to identify and redact sensitive data before training ensures that the training process does not inadvertently expose sensitive information, aligning with data protection best practices.
- C. Incorrect.
Storing API keys in plaintext is a major security risk as it makes them vulnerable to unauthorized access, leading to potential breaches of the AI workload.
- D. Correct.
Restricting access to the model endpoint using IAM roles and permissions ensures that only authorized users or services can interact with the model, reducing the risk of unauthorized access.
- E. Incorrect.
Disabling logging is not recommended as logs are critical for monitoring and troubleshooting. Instead, sensitive information in logs should be properly redacted or anonymized.