Google Professional Machine Learning Engineer Question 157
Select 4Google Cloud PlatformYou are a machine learning engineer tasked with setting up a secure Vertex AI Workbench environment for your team. Your organization enforces strict security policies, including the use of private networking, Identity and Access Management (IAM) roles, and encryption for sensitive data. Which of the following actions should you take to comply with these security requirements?
- A
Configure Vertex AI Workbench notebooks to use private IP addresses through a private GKE cluster.
- B
Assign the Editor IAM role to all team members to ensure they can access all resources.
- C
Enable customer-managed encryption keys (CMEK) for storage of sensitive data.
- D
Restrict public IP access by disabling public endpoints for the Vertex AI Workbench instances.
- E
Use service accounts with the least privilege principle to authenticate and access Google Cloud resources.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
To comply with strict security policies, you need to adopt multiple security best practices in Vertex AI Workbench. Using private IPs ensures notebooks are not publicly accessible. Enabling CMEK gives you control over encryption. Disabling public endpoints prevents unauthorized internet access. Lastly, following the least privilege principle with service accounts minimizes security risks. However, granting broad IAM roles like Editor is not recommended as it violates security best practices.
- A. Correct.
Configuring Vertex AI Workbench notebooks to use private IP addresses ensures that notebook instances are not exposed to the public internet, aligning with the requirement to use private networking.
- B. Incorrect.
Assigning the Editor IAM role violates the principle of least privilege since it grants broad permissions that are not necessary for all team members.
- C. Correct.
Enabling customer-managed encryption keys (CMEK) allows you to have full control over encryption keys for sensitive data, which complies with the encryption requirement.
- D. Correct.
Disabling public endpoints for Vertex AI Workbench instances ensures that unauthorized users cannot directly access these resources over the public internet, improving security.
- E. Correct.
Using service accounts with the least privilege principle ensures that each component in the system only has the permissions it needs, reducing the risk of unauthorized access or privilege escalation.