Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A financial enterprise is designing an end-to-end machine learning pipeline on Google Cloud. The pipeline ingests sensitive customer records into Cloud Storage, processes structured feature data in BigQuery and Vertex AI Feature Store, and runs automated Vertex AI Training Pipelines to publish model artifacts to the Vertex AI Model Registry.
The security team mandates the following security and governance requirements:
Which architectural approach satisfies these security requirements?
This approach deploys machine learning models onto Google Distributed Cloud (GDC) air-gapped infrastructure, provides data scientists with administrative IAM rights (project-iam-admin), attempts to configure asymmetric Cloud KMS keys for storage encryption, and proposes using BGP routing filters for data discovery.
ENCRYPT_DECRYPT purpose in Cloud KMS), not asymmetric key pairs.project-iam-admin to data scientists gives them authority to alter all project allow policies and grant themselves direct data access, violating least privilege.The organization had a strict regulatory requirement for fully disconnected on-premises air-gapped hardware with local Kubernetes cluster management.
This approach consolidates all datasets, notebooks, and Vertex AI resources within a single project boundary, utilizes Google's standard default encryption at rest, assigns broad predefined IAM roles (roles/aiplatform.user and roles/storage.admin) to data scientists, and applies Cloud Storage Bucket Lock for retention compliance.
roles/storage.admin within a single shared project grants broad permissions, allowing them to read, modify, and delete raw sensitive training data directly.The workload was a non-sensitive rapid prototype where collaborative ease and object immutability/retention enforcement were the only operational requirements.
This architecture establishes a Shared VPC topology across service projects, opens BigQuery permissions to allUsers while expecting network perimeter controls to block access, defers data protection to inference-time transformations, and assumes CMEK can be retroactively attached to existing models.
allUsers): Granting allUsers access to BigQuery creates a severe critical vulnerability (SENSITIVE_DATA_PUBLIC_DATASET). Public access bindings must never be applied to sensitive data assets.encryptionSpec parameter supplied.Vertex AI natively supported dynamic, in-place key attachment for existing production models and BigQuery was intended as a public open-data repository.
This architecture establishes an enterprise-grade, defense-in-depth security framework for machine learning systems on Google Cloud by decoupling compute and storage into separate projects, enforcing full-lifecycle Customer-Managed Encryption Keys (CMEK), delegating execution access using dedicated custom service accounts, and enforcing continuous data discovery through Sensitive Data Protection.
roles/storage.objectViewer or roles/bigquery.dataViewer permissions on the raw data. Instead, training jobs execute under a custom service account that is granted least-privilege read access strictly to the required storage and BigQuery resources in the data project.This solution follows Google Cloud security best practices for AI/ML workloads by combining structural project isolation, cryptographic controls with Cloud KMS, programmatic identity delegation with custom service accounts, and data profiling with Sensitive Data Protection.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated