Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise machine learning team is implementing automated training pipelines on Google Cloud using managed Vertex AI Custom Training (TrainingPipeline). To protect intellectual property, prevent model weight exfiltration, and enforce the principle of least privilege, the security architect establishes the following requirements:
StudyCerts
StudyCertsgs://company-model-registry/output/) without having permission to read, overwrite, or delete existing model files.Which identity and access management (IAM) configuration fulfills these requirements?
Assign a dedicated user-managed service account to the training pipeline with roles/artifactregistry.writer, roles/logging.admin, and roles/storage.objectViewer on the destination bucket. Grant the ML engineers roles/storage.admin on the project.
Assign a dedicated user-managed service account to the training pipeline with roles/artifactregistry.reader on the image repository, roles/logging.logWriter on the project, and roles/storage.objectCreator on the output Cloud Storage bucket. Grant the ML engineers roles/iam.serviceAccountUser on the service account and roles/aiplatform.user in the project.
Assign the Cloud Build service account to the training pipeline with roles/artifactregistry.repoAdmin and roles/storage.legacyBucketWriter on the bucket. Grant the ML engineers roles/owner on the Vertex AI dataset and model resources.
Assign the Compute Engine default service account to the training pipeline with roles/editor on the project and roles/storage.objectAdmin on the destination bucket. Grant the ML engineers roles/aiplatform.admin on the project.
Assign a dedicated user-managed service account to the training pipeline with roles/artifactregistry.writer, roles/logging.admin, and roles/storage.objectViewer on the destination bucket. Grant the ML engineers roles/storage.admin on the project.
Assign a dedicated user-managed service account to the training pipeline with roles/artifactregistry.reader on the image repository, roles/logging.logWriter on the project, and roles/storage.objectCreator on the output Cloud Storage bucket. Grant the ML engineers roles/iam.serviceAccountUser on the service account and roles/aiplatform.user in the project.
This solution establishes a least-privilege security posture for fully managed PaaS training workloads (Vertex AI TrainingPipeline) by separating the interactive user's identity from a dedicated, fine-grained user-managed service account attached to the training job.
roles/artifactregistry.reader role at the specific repository level grants the custom training worker nodes read-only access to pull required container images without allowing modifications or pushes.roles/logging.logWriter allows the training environment to output standard runtime logs and execution events directly to Cloud Logging.roles/storage.objectCreator on the destination Cloud Storage bucket allows the training script to upload newly generated model weights (via $AIP_MODEL_DIR) while strictly denying storage.objects.get, storage.objects.delete, and list permissions. This prevents the training workload or compromised code from inspecting or exfiltrating existing intellectual property.roles/iam.serviceAccountUser (iam.serviceAccounts.actAs) on the dedicated service account alongside roles/aiplatform.user enables them to launch automated pipelines while completely abstracting direct access to backend storage and repositories.Under Google Cloud's shared responsibility model for managed PaaS training, the platform handles the underlying host VMs, OS hardening, and hypervisors. The customer remains responsible for identity configuration, container security, and data access. Using a dedicated service account with roles/storage.objectCreator and roles/artifactregistry.reader perfectly enforces zero-trust boundaries without over-granting primitive or administrative roles.
Assign the Cloud Build service account to the training pipeline with roles/artifactregistry.repoAdmin and roles/storage.legacyBucketWriter on the bucket. Grant the ML engineers roles/owner on the Vertex AI dataset and model resources.
Assign the Compute Engine default service account to the training pipeline with roles/editor on the project and roles/storage.objectAdmin on the destination bucket. Grant the ML engineers roles/aiplatform.admin on the project.