3.3 Securing AI Workloads PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A marketing firm uses Vertex AI to train a model on customer behavior data. The data contains personally identifiable information (PII). The security team wants to ensure that the PII is not accessible to the data scientists who are training the model. What is the most effective approach?

   • AUse Cloud DLP to de-identify the data before it is loaded into Vertex AI, and grant the data scientists access only to the de-identified dataset.
   • BEnable Data Access audit logs for the Cloud Storage bucket and review them regularly for unauthorized access.
   • CEncrypt the data with CMEK and grant the data scientists access to the Cloud KMS key so they can decrypt it for training.
   • DUse VPC Service Controls to create a perimeter around the Vertex AI service and the Cloud Storage bucket.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security team wants to ensure that a model deployed to production has not been tampered with. Which control is most appropriate?

   • AInput validation
   • BData anonymization
   • CNetwork segmentation
   • DModel integrity checks using cryptographic hashes
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has deployed a model for real-time fraud detection. The security team has set up logging and monitoring. They notice a sudden spike in requests from a single IP address, but the requests are all returning the same prediction. They suspect a model-stealing attack. What is the most appropriate immediate response?

   • AAnalyze the requests to determine if they are part of a coordinated attack before taking any action.
   • BRetrain the model with a different architecture to make it more resistant to model stealing.
   • CBlock the IP address at the load balancer and add a rate-limiting rule for that IP.
   • DIncrease the logging verbosity for the model endpoint to capture more details about the requests.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   To comply with data protection regulations, which configuration is most important for a Gemini Enterprise Agent that processes user personal data?

   • AIncreasing the model's response length
   • BConfiguring data residency to store data in the required region
   • CEnabling data logging for all user interactions
   • DDisabling audit logging
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare startup is building a diagnostic model using patient records. A security researcher warns that an attacker could submit carefully crafted inputs to the deployed model and infer whether a specific individual's data was part of the training set. The startup wants to reduce this risk without degrading model accuracy for legitimate clinical use. What should the security team implement?

   • ARetrain the model using only aggregated statistics and remove all individual-level features from the dataset.
   • BAdd differential privacy noise during training and apply strict output filtering on inference responses.
   • CRestrict access to the model endpoint using Identity-Aware Proxy (IAP) and require multi-factor authentication for all users.
   • DEncrypt the training dataset at rest and in transit using customer-managed encryption keys (CMEK).
   Reveal Solution Discussion Select an answer first