Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise organization is deploying Gemini Enterprise to provide employees with conversational AI assistants and custom AI agents connected to sensitive internal knowledge repositories. Your security team mandates strict security and governance controls with the following requirements:
Which architectural solution should you implement to satisfy these security and governance requirements?
Establish Private Service Connect endpoints for Vertex AI APIs, apply an Organization Policy constraint for Resource Location Restriction, and assign employees the basic Viewer (roles/viewer) IAM role at the project level.
Configure VPC egress firewall rules to restrict outbound traffic to private Google APIs, define IAM Conditions on the Cloud Assist User (roles/geminicloudassist.user) role, and restrict access using a Workforce Identity Federation pool.
Deploy Google Cloud Armor security policies with WAF rules on an External Application Load Balancer, add cloudaicompanion.googleapis.com to a VPC Service Controls perimeter, and grant users the Discovery Engine Admin (roles/discoveryengine.admin) IAM role.
Configure a VPC Service Controls perimeter enclosing the Gemini Enterprise project, add the Discovery Engine API (discoveryengine.googleapis.com) as a restricted service, apply an Access Context Manager basic access level matching corporate IP subnetworks, and grant users the Discovery Engine User (roles/discoveryengine.user) IAM role.
Establish Private Service Connect endpoints for Vertex AI APIs, apply an Organization Policy constraint for Resource Location Restriction, and assign employees the basic Viewer (roles/viewer) IAM role at the project level.
Configure VPC egress firewall rules to restrict outbound traffic to private Google APIs, define IAM Conditions on the Cloud Assist User (roles/geminicloudassist.user) role, and restrict access using a Workforce Identity Federation pool.
Deploy Google Cloud Armor security policies with WAF rules on an External Application Load Balancer, add cloudaicompanion.googleapis.com to a VPC Service Controls perimeter, and grant users the Discovery Engine Admin (roles/discoveryengine.admin) IAM role.
Configure a VPC Service Controls perimeter enclosing the Gemini Enterprise project, add the Discovery Engine API (discoveryengine.googleapis.com) as a restricted service, apply an Access Context Manager basic access level matching corporate IP subnetworks, and grant users the Discovery Engine User (roles/discoveryengine.user) IAM role.
VPC Service Controls (VPC-SC) provides perimeter-based security for Google Cloud services to prevent data exfiltration and control access from unauthorized networks. In Gemini Enterprise, the underlying service is powered by the Discovery Engine API (discoveryengine.googleapis.com). Identity and Access Management (IAM) provides fine-grained authorization, with Discovery Engine User (roles/discoveryengine.user) being the dedicated predefined role for end-user app interaction.
StudyCerts
StudyCertsdiscoveryengine.googleapis.com ensures that the API cannot be reached from the public internet and prevents data from leaving trusted boundaries.roles/discoveryengine.user) role grants the exact permissions required for employees to use search and conversational assistant applications without over-granting administrative capabilities.roles/discoveryengine.user) from catalog administrators (roles/discoveryengine.admin).This solution uses native Google Cloud security controls (VPC Service Controls, Access Context Manager, and predefined IAM roles) designed specifically for Gemini Enterprise and Discovery Engine architectures.