Google Professional Cloud Security Engineer Question 377
Select 3Google Cloud PlatformYour organization is using Vertex AI to deploy a machine learning model that processes sensitive customer data. As a Professional Cloud Security Engineer, you are tasked with ensuring the security of the Vertex AI environment. Which security controls should you implement to protect the data and ensure compliance with organizational policies?
- A
Enable VPC Service Controls to restrict data exfiltration risks.
- B
Use customer-managed encryption keys (CMEK) to encrypt the data used by Vertex AI.
- C
Disable the Vertex AI API to prevent external access to the service.
- D
Implement IAM roles with the principle of least privilege for users and service accounts accessing Vertex AI.
- E
Store all training and prediction data on local systems to avoid cloud data breaches.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure the security of Vertex AI, it is important to implement controls that protect data integrity, confidentiality, and access. VPC Service Controls prevent unauthorized data exfiltration, customer-managed encryption keys (CMEK) provide control over data encryption, and IAM roles ensure that only authorized entities have access to Vertex AI resources. Disabling essential APIs or avoiding cloud storage altogether is not feasible or necessary when appropriate cloud security controls are in place.
- A. Correct.
Enabling VPC Service Controls helps protect against data exfiltration by defining service perimeters for sensitive resources, making it a critical security control for Vertex AI environments.
- B. Correct.
Customer-managed encryption keys (CMEK) provide an additional layer of control over data encryption, ensuring the organization retains control over encryption keys used for sensitive data in Vertex AI.
- C. Incorrect.
Disabling the Vertex AI API would prevent the service from functioning, which is not a practical or valid security control.
- D. Correct.
Implementing IAM roles with the principle of least privilege ensures that only authorized users and service accounts have access to Vertex AI resources, minimizing the risk of unauthorized access.
- E. Incorrect.
Storing training and prediction data on local systems is unnecessary and impractical, as Vertex AI is designed to work with cloud-based data. Proper security measures in Google Cloud are sufficient to protect data.