Google Professional Machine Learning Engineer Question 329
Single answerGoogle Cloud PlatformYou are deploying a machine learning model using Google Cloud Vertex AI and need to ensure that the endpoint is only accessible within your organization's private network for security purposes. How can you configure the endpoint to meet this requirement?
- A
Configure the endpoint as a private endpoint and ensure the necessary VPC Network Peering is set up.
- B
Deploy the endpoint with the public endpoint option and use a firewall rule to restrict access to your organization's IP range.
- C
Use a Vertex AI private endpoint and attach a Cloud NAT to route private traffic.
- D
Deploy the endpoint as a public endpoint and enable Identity-Aware Proxy (IAP) for security.
Show answer and explanation
Correct answer: A
Explanation
To ensure that a Vertex AI endpoint is only accessible within your organization's private network, you must configure it as a private endpoint. This setup restricts access to the endpoint within a specified VPC network. Additionally, VPC Network Peering must be used to establish secure connectivity between Vertex AI's managed services and your organization's private network. Public endpoints, even with additional security measures like firewall rules or IAP, do not fully isolate the endpoint to a private network.
- A. Correct.
This is the correct solution. Configuring the endpoint as a private endpoint ensures that it is only accessible within a private VPC network. Setting up VPC Network Peering allows the endpoint to integrate with your organization's private network securely.
- B. Incorrect.
This is incorrect. While using public endpoints with firewall rules can restrict access, the endpoint is still public, which does not meet the requirement for a private-only configuration.
- C. Incorrect.
This is incorrect. Cloud NAT is used for outbound internet access from private resources but does not secure private endpoints for inbound access.
- D. Incorrect.
This is incorrect. While Identity-Aware Proxy (IAP) provides additional access control for public endpoints, it does not make the endpoint private to your organization's network.