Google Professional Cloud Security Engineer Question 379
Select 3Google Cloud PlatformYour organization is using Vertex AI for training machine learning models. You need to ensure that sensitive data used during training is protected and that access to the Vertex AI pipelines is restricted following the principle of least privilege. What steps should you take to implement these security controls?
- A
Use Customer-Managed Encryption Keys (CMEK) to encrypt data stored in Vertex AI.
- B
Grant the Vertex AI Service Agent role to all users in your organization to simplify access management.
- C
Enable private endpoints for Vertex AI to restrict access to authorized networks only.
- D
Leverage IAM roles to grant granular permissions to Vertex AI resources.
- E
Use public buckets for training data to ensure easy access for developers and training pipelines.
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement security controls for Vertex AI, it's critical to ensure that sensitive data is encrypted, access is restricted to authorized networks, and permissions are granted on a need-to-know basis. Using CMEK allows you to manage encryption keys securely, private endpoints restrict network access, and IAM roles enforce proper access control. Avoid practices like granting broad access or using public buckets, as they pose significant security risks.
- A. Correct.
Using Customer-Managed Encryption Keys (CMEK) ensures that sensitive data stored in Vertex AI is encrypted with a key that you control, providing an additional layer of security.
- B. Incorrect.
Granting the Vertex AI Service Agent role to all users violates the principle of least privilege, as it provides unnecessary access to all users in your organization.
- C. Correct.
Enabling private endpoints for Vertex AI restricts access to the service to authorized networks, ensuring that only trusted systems can connect.
- D. Correct.
Leveraging IAM roles allows you to enforce the principle of least privilege by granting users or services only the permissions they need for specific Vertex AI resources.
- E. Incorrect.
Using public buckets for training data is not secure, as it exposes sensitive data to unauthorized access.