Google Professional Machine Learning Engineer Question 331
Single answerGoogle Cloud PlatformYou are deploying a machine learning model using Vertex AI for an organization with strict security requirements. The organization mandates that the model endpoints should only be accessible from within their private network and must not be exposed to the public internet. Which approach should you take to ensure compliance with these requirements?
- A
Configure a private endpoint for the Vertex AI model endpoint and ensure the network is connected via VPC peering.
- B
Deploy the Vertex AI model endpoint with a public endpoint and restrict access using IAM policies.
- C
Set up a private endpoint for the Vertex AI model endpoint and use a Cloud VPN or Interconnect to connect the on-premises network to Google Cloud.
- D
Use a public endpoint for the Vertex AI model endpoint but restrict access by whitelisting the organization's IP addresses.
Show answer and explanation
Correct answer: C
Explanation
To ensure compliance with strict security requirements, the Vertex AI model endpoint must not be exposed to the public internet. Configuring a private endpoint and connecting the organization's private network to Google Cloud using Cloud VPN or Interconnect ensures end-to-end security and compliance with the organization's policies. Public endpoints, even with IP whitelisting or IAM policies, do not fully restrict internet exposure, making them unsuitable for this use case.
- A. Incorrect.
This is a correct approach. Configuring a private endpoint and using VPC peering ensures that the endpoint is only accessible within the private network.
- B. Incorrect.
This is incorrect. A public endpoint, even with IAM restrictions, does not meet the requirement of avoiding exposure to the public internet.
- C. Correct.
This is the correct answer. Setting up a private endpoint and connecting the on-premises network to Google Cloud using Cloud VPN or Interconnect ensures secure communication without exposing the endpoint to the public internet.
- D. Incorrect.
This is incorrect. Using a public endpoint with whitelisting does not fully isolate access to the private network, leaving the endpoint still exposed to the public internet.