Google Professional Cloud Security Engineer Question 375
Select 3Google Cloud PlatformYou are designing a machine learning model training solution for your organization. The model will be hosted on Google Cloud, with some tasks running on IaaS (Compute Engine) and others on PaaS (Vertex AI). As a Professional Cloud Security Engineer, which security measures should you prioritize to meet compliance and protect sensitive training data?
- A
Implement Identity and Access Management (IAM) roles to enforce least privilege for access to Compute Engine and Vertex AI resources.
- B
Encrypt sensitive training data at rest using Customer-Managed Encryption Keys (CMEK).
- C
Disable VPC Service Controls to simplify network configuration for both IaaS and PaaS workloads.
- D
Use private IPs and restrict public internet access for Compute Engine instances and Vertex AI services.
- E
Rely exclusively on Vertex AI’s default security settings without additional configurations.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure both IaaS-hosted and PaaS-hosted training models, it is critical to implement IAM for access control, encrypt sensitive data using CMEK, and restrict public internet access to reduce the attack surface. These measures address key aspects of securing machine learning workloads and ensuring compliance with organizational and regulatory requirements. Avoiding actions like disabling VPC Service Controls or relying solely on default security settings is essential for maintaining a robust security posture.
- A. Correct.
Correct: IAM enforces granular access control, ensuring that only authorized users and services can access Compute Engine and Vertex AI resources.
- B. Correct.
Correct: Encrypting data at rest with CMEK ensures that sensitive data is protected and provides greater control over encryption keys.
- C. Incorrect.
Incorrect: Disabling VPC Service Controls would expose resources to potential security risks. Instead, VPC Service Controls should be enabled to secure data communication between services.
- D. Correct.
Correct: Using private IPs and restricting public internet access minimizes exposure to external threats and enhances the security of IaaS and PaaS resources.
- E. Incorrect.
Incorrect: While Vertex AI has strong default security settings, relying exclusively on them without additional configurations may not meet specific compliance or organizational requirements.