Google Professional Cloud Security Engineer Question 378
Select 3Google Cloud PlatformYour organization is using Vertex AI to train and deploy machine learning models. You are tasked with ensuring that the platform and its resources are configured securely. Which of the following actions should you take to implement security controls for Vertex AI?
- A
Enable private endpoints for the Vertex AI training and prediction services.
- B
Apply Identity and Access Management (IAM) roles to grant least privilege access to Vertex AI resources.
- C
Disable logging for Vertex AI services to minimize data exposure.
- D
Use customer-managed encryption keys (CMEK) to encrypt data used by Vertex AI.
- E
Allow all incoming traffic to the Vertex AI prediction endpoint for flexibility in client access.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely configure Vertex AI, it is essential to enable private endpoints to limit network exposure, apply IAM roles to enforce the principle of least privilege, and use CMEK to control how data is encrypted. These actions ensure that your Vertex AI environment is protected from unauthorized access, complies with security policies, and minimizes vulnerabilities. Disabling logging or allowing unrestricted traffic would weaken the security posture and are not recommended.
- A. Correct.
Enabling private endpoints ensures that communication between Vertex AI and other services remains within your private network and is not exposed to the public internet, enhancing security.
- B. Correct.
Using IAM roles to apply the principle of least privilege ensures that only authorized users and services have access to Vertex AI resources, reducing the risk of unauthorized access.
- C. Incorrect.
Disabling logging is a poor security practice. Logging is essential for monitoring, auditing, and understanding potential security incidents. Properly configured logging with access control provides better security.
- D. Correct.
Using customer-managed encryption keys (CMEK) allows you to have greater control over the encryption keys used for securing Vertex AI data, ensuring compliance with organizational or regulatory requirements.
- E. Incorrect.
Allowing all incoming traffic to the prediction endpoint exposes your model to potential security risks, such as unauthorized access or denial-of-service attacks. This is a bad practice.