Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Your DevOps engineering team is standardizing the use of Gemini in the CLI and development environments to synthesize complex gcloud automation scripts and inspect deployment configurations across your Google Cloud estate.
Your organization enforces strict data governance and enterprise security requirements:
Which combination of IAM roles and security controls should you implement?
Grant the basic roles/editor role at the organization node to developers and disable the cloudaicompanion.googleapis.com API on development projects.
Enable discoveryengine.googleapis.com, assign the roles/discoveryengine.admin role to a developer Google Group, and configure Access Context Manager to allow unrestricted public IP ingress.
Grant the roles/cloudaicompanion.settingsAdmin role directly to individual developer user accounts, and configure Private Google Access without a VPC Service Controls perimeter.
Enable cloudaicompanion.googleapis.com, add the API to a VPC Service Controls perimeter, and assign the roles/cloudaicompanion.user and roles/serviceusage.serviceUsageConsumer roles to an application developer Google Group.
This architecture establishes secure, governed access to Gemini for Google Cloud assistance tools (such as Gemini in the CLI and IDE integrations) by leveraging native VPC Service Controls (VPC-SC) perimeters alongside least-privilege Identity and Access Management (IAM) group-based bindings.
StudyCerts
StudyCertscloudaicompanion.googleapis.com) to a VPC Service Controls service perimeter prevents data exfiltration by creating a strict security perimeter around the Google-managed AI backend.roles/cloudaicompanion.user provides the minimum permissions required for developers to interact with the LLM (e.g., cloudaicompanion.companions.generateChat and cloudaicompanion.companions.generateCode) while withholding administrative privileges such as roles/cloudaicompanion.settingsAdmin.roles/cloudaicompanion.user and roles/serviceusage.serviceUsageConsumer to a centralized Google Group aligns with best practices by avoiding individual role bindings and simplifying auditability.cloudaicompanion.googleapis.com service endpoint required to process CLI conversations and script synthesis.This solution directly satisfies enterprise governance requirements by securing data in transit and at the boundary using VPC-SC while enforcing principle-of-least-privilege access using dedicated predefined IAM roles applied to identity groups.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.