Google Professional Machine Learning Engineer Question 332
Select 3Google Cloud PlatformYou are deploying a machine learning model using Vertex AI and need to ensure that the model’s endpoint is accessible only from your organization's on-premises environment. Which configuration steps should you take to achieve this?
- A
Configure the endpoint to use a private IP address and set up a VPC Network Peering connection between your Google Cloud project and your on-premises network.
- B
Use a Vertex AI public endpoint and restrict access to your organization’s IP address range using IAM policies.
- C
Enable a private endpoint and configure a Private Service Connect (PSC) connection to link your on-premises network to Google Cloud.
- D
Deploy the model with a public endpoint and configure a Google Cloud Armor policy to allow access only from your organization’s IP address range.
- E
Set up a shared VPC with your on-premises network and deploy the model on a private endpoint in a subnet accessible via your on-premises network.
Show answer and explanation
Correct answers: A, C, E
Explanation
To ensure a Vertex AI model endpoint is accessible only from your on-premises environment, you need to use private endpoints and establish private networking connections such as VPC Network Peering, Private Service Connect, or a shared VPC. Public endpoints, even with IP-based restrictions or Cloud Armor policies, do not meet the requirement as they are still exposed to the internet.
- A. Correct.
Correct: Configuring a private IP address on the endpoint and setting up VPC Network Peering ensures that the endpoint is only accessible via private networking, which is necessary for restricting access to an on-premises environment.
- B. Incorrect.
Incorrect: Public endpoints are inherently accessible over the internet, and IAM policies cannot restrict access to specific IP ranges. This does not meet the requirement of restricting access to your on-premises environment.
- C. Correct.
Correct: A private endpoint with Private Service Connect (PSC) allows you to securely connect your on-premises network to Google Cloud services over a private connection.
- D. Incorrect.
Incorrect: While Google Cloud Armor can restrict access based on IP ranges, public endpoints are still accessible over the internet, which does not fulfill the requirement of restricting access to only your on-premises network.
- E. Correct.
Correct: A shared VPC allows your on-premises network to connect to private resources in Google Cloud. Deploying the model on a private endpoint ensures that it is only accessible within the shared network.