An enterprise is deploying a secure machine learning environment on Google Cloud using Vertex AI Workbench notebooks, Vertex AI Pipelines, and custom training jobs. The workloads process confidential corporate data and proprietary algorithms. Security and compliance requirements dictate: All training data buckets, pipeline metadata, managed datasets, and registered model artifacts must be encrypted using Customer-Managed Encryption Keys (CMEK). All communication from the VPC to Vertex AI APIs and Cloud Storage must use private routing without traversing the public internet. Accidental data leakage and exfiltration through stolen credentials or modified IAM policies must be prevented by establishing strict network-layer perimeter boundaries around the ML resources. Which architectural approach satisfies all of these security requirements?

Configure a VPC Service Controls perimeter enclosing the projects, restrict the Vertex AI, Cloud Storage, and Cloud KMS APIs, deploy Private Service Connect endpoints for Google APIs, and specify CMEK keys across storage buckets, pipeline jobs, datasets, and model registries.: ### What this architectural solution is This architecture establishes a comprehensive defense-in-depth model for PaaS machine learning on Google Cloud. It combines **VPC Service Controls (VPC SC)** perimeters to enforce strict data boundary controls, **Private Service Connect (PSC)** endpoints for private API transport, and **Customer-Managed Encryption Keys (CMEK)** for centralized cryptographic ownership over all machine learning data assets. ### How it meets the requirements - **Mitigating exfiltration risks**: Placing the projects within an enforced **VPC Service Controls** perimeter and restricting `aiplatform.googleapis.com`, `storage.googleapis.com`, and `cloudkms.googleapis.com` prevents unauthorized access or data exfiltration from unauthorized networks, even if credentials are compromised or IAM permissions are misconfigured. - **Private API routing**: Deploying **Private Service Connect** endpoints inside the VPC assigns internal IP addresses to Google APIs, ensuring all Vertex AI and Cloud Storage API calls from Workbench notebooks and training workloads route over private Google network paths without touching the public internet. - **Centralized data protection**: Enforcing **CMEK** across Cloud Storage training buckets, Vertex AI managed datasets, Vertex AI Pipelines metadata stores, and Model Registry ensures that organizations retain exclusive lifecycle and revocation control over the encryption keys managed in Cloud KMS. ### Key advantages and capabilities - **Zero-trust boundary**: Perimeter boundaries block unauthorized API ingress and unauthorized cross-project egress attempts at the network layer. - **Granular access control**: Access Context Manager and VPC SC ingress/egress rules allow controlled inter-perimeter collaboration when using Shared VPC topologies. - **Cryptographic kill switch**: Revoking or disabling the CMEK key in Cloud KMS immediately prevents Vertex AI services from accessing models, training pipelines, and underlying datasets. - **No public IP dependency**: Eliminates the requirement for public IP addresses or NAT gateways when interacting with Google APIs. ### Why this is optimal This approach directly aligns with Google Cloud enterprise security best practices for generative AI and machine learning platforms. It provides automated boundary enforcement, complete data-at-rest encryption control, and fully private network connectivity.

Secure Vertex Ai Pipelines Vpcsc Psc Cmek | Professional Cloud Security Engineer

Secure Vertex Ai Pipelines Vpcsc Psc Cmek

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying a secure machine learning environment on Google Cloud using Vertex AI Workbench notebooks, Vertex AI Pipelines, and custom training jobs. The workloads process confidential corporate data and proprietary algorithms.

Security and compliance requirements dictate:

All training data buckets, pipeline metadata, managed datasets, and registered model artifacts must be encrypted using Customer-Managed Encryption Keys (CMEK).
All communication from the VPC to Vertex AI APIs and Cloud Storage must use private routing without traversing the public internet.
Accidental data leakage and exfiltration through stolen credentials or modified IAM policies must be prevented by establishing strict network-layer perimeter boundaries around the ML resources.

Which architectural approach satisfies all of these security requirements?

Configure a VPC Service Controls perimeter enclosing the projects, restrict the Vertex AI, Cloud Storage, and Cloud KMS APIs, deploy Private Service Connect endpoints for Google APIs, and specify CMEK keys across storage buckets, pipeline jobs, datasets, and model registries.

Configure standard VPC Network Peering to the Vertex AI producer network, create a NAT VM reverse proxy for API egress, and enforce the compute.vmCanIpForward organization policy constraint on all training instances.

Deploy Serverless VPC Access connectors across all subnets, apply IAM conditions on Cloud Storage buckets requiring MFA, configure VPC Network Peering with default Google APIs, and enable Google-managed default encryption.

Enable Access Transparency at the organization level, deploy Cloud NAT gateways for outbound internet access from Workbench instances, and attach client-side encryption certificates to Vertex AI custom training containers.

Professional Cloud Security Engineer

Secure Vertex Ai Pipelines Vpcsc Psc Cmek

Related questions