Google Professional Cloud Security Engineer Question 363
Select 3Google Cloud PlatformYou are tasked with securing an AI workload running on Google Cloud that processes sensitive user data. The workload uses a pre-trained machine learning model hosted on AI Platform Prediction. Which actions should you take to ensure the workload is secure and compliant with data protection regulations?
- A
Enable VPC Service Controls to restrict data exfiltration from AI Platform Prediction.
- B
Use CMEK (Customer-Managed Encryption Keys) to encrypt data stored in AI Platform Prediction.
- C
Ensure that the model is deployed with public access to allow external monitoring and debugging.
- D
Enable IAM policies to restrict access to AI Platform Prediction only to authorized users and service accounts.
- E
Use Shielded VM instances for running the AI Platform Prediction model.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing AI workloads in Google Cloud requires a combination of network security (e.g., VPC Service Controls), data encryption (e.g., CMEK), and identity and access management (e.g., IAM policies). These measures collectively ensure that sensitive data and the pre-trained model are protected from unauthorized access and potential data leaks. Public access should always be avoided, and Shielded VMs are not relevant to AI Platform Prediction since it is a fully managed service.
- A. Correct.
Correct: VPC Service Controls help prevent data exfiltration by creating service perimeters around Google-managed resources, which is critical for securing AI workloads.
- B. Correct.
Correct: Using CMEK ensures that data encryption keys are managed and controlled by the organization, increasing security and compliance for workloads processing sensitive data.
- C. Incorrect.
Incorrect: Allowing public access to the model introduces security risks and violates the principle of least privilege. Monitoring and debugging should be done using secure, private access methods.
- D. Correct.
Correct: IAM policies are essential to restrict access to AI Platform Prediction to authorized identities, ensuring that only approved users and service accounts can interact with the workload.
- E. Incorrect.
Incorrect: Shielded VM instances are a feature for securing Compute Engine VMs but are not applicable to AI Platform Prediction, which is a managed service. The security of the underlying infrastructure is handled by Google.