Google Professional Machine Learning Engineer Question 330
Single answerGoogle Cloud PlatformYou are deploying a machine learning model using Vertex AI and need to ensure that the endpoint hosting the model only allows traffic from internal services within your Virtual Private Cloud (VPC) network. Which option should you choose to achieve this requirement?
- A
Configure a Vertex AI private endpoint and route requests through a VPC network.
- B
Use a Vertex AI public endpoint and restrict access using Identity and Access Management (IAM) policies.
- C
Deploy the model to a Vertex AI endpoint and configure a Cloud Armor security policy.
- D
Set up a Vertex AI endpoint in a private Kubernetes cluster.
Show answer and explanation
Correct answer: A
Explanation
To restrict access to a Vertex AI endpoint so that only internal services within your VPC can access it, you must configure a private endpoint. This ensures that traffic is routed through the VPC network and is not exposed to the public internet. Public endpoints, even with IAM or security policies, do not provide the same level of isolation.
- A. Correct.
Correct: A Vertex AI private endpoint ensures that the endpoint is only accessible within your VPC network, meeting the requirement for internal traffic only.
- B. Incorrect.
Incorrect: A Vertex AI public endpoint exposes the endpoint to the public internet, even with IAM policies. This does not meet the requirement for internal-only traffic.
- C. Incorrect.
Incorrect: While Cloud Armor can provide additional security controls, it cannot restrict an endpoint to internal VPC traffic alone.
- D. Incorrect.
Incorrect: A private Kubernetes cluster is unrelated to Vertex AI endpoints and does not address the requirement for private traffic within a VPC.