Google Professional Cloud Security Engineer Question 380
Select 3Google Cloud PlatformYour organization is using Vertex AI to deploy machine learning models. As a security engineer, you are tasked with ensuring the security of the data and models in Vertex AI. Which of the following actions should you take to implement security controls for Vertex AI?
- A
Enable Vertex AI Private Endpoints to limit network access to the service.
- B
Use Identity and Access Management (IAM) to restrict user access to Vertex AI resources.
- C
Store sensitive training data in a public Google Cloud Storage bucket for ease of access.
- D
Encrypt all model artifacts and training data using Customer-Managed Encryption Keys (CMEK).
- E
Disable logging to prevent sensitive data from being written to Cloud Logging.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure Vertex AI, it is important to implement network-level controls (e.g., private endpoints), manage access through IAM, and ensure encryption of sensitive data using Customer-Managed Encryption Keys (CMEK) for greater control. Public exposure of sensitive data is a serious security risk, and disabling logging can hinder auditing, making it an incorrect approach.
- A. Correct.
Enabling Vertex AI Private Endpoints ensures that access to Vertex AI APIs is restricted to your internal network, reducing the risk of unauthorized access.
- B. Correct.
Using IAM to restrict access is critical for ensuring that only authorized users and service accounts can interact with Vertex AI resources.
- C. Incorrect.
Storing sensitive training data in a public storage bucket is a bad practice and violates data security principles, as it exposes the data to unauthorized access.
- D. Correct.
Encrypting model artifacts and training data with CMEK provides an additional layer of security, giving you full control over encryption keys.
- E. Incorrect.
Disabling logging is not recommended, as logs can provide valuable insights for auditing and troubleshooting. Sensitive data should be redacted, not logging disabled.