3.3 Securing AI Workloads PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · hard

   A defense contractor trains a model on Compute Engine VMs using classified data. They require that the training data and model are never exposed to the public internet and that all data at rest is encrypted with keys managed by their own hardware security module (HSM). What should they configure?

   • AStore the training data in Cloud Storage and use a VPC Service Controls perimeter, but allow the VMs to access the data via a public Cloud Storage endpoint.
   • BCreate the VMs with a public IP address but restrict access using firewall rules that only allow traffic from the corporate VPN.
   • CCreate the VMs in a VPC with no external IP addresses, use Cloud External Key Manager (Cloud EKM) to connect to their HSM, and enable VPC Service Controls.
   • DUse Google-managed encryption keys for the persistent disks and enable Shielded VMs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational corporation is deploying a Gemini Enterprise agent for internal HR queries. The security team needs to ensure that the agent can only be accessed by employees in the HR department and that all interactions are logged for compliance. What should they configure?

   • ACreate a custom IAM role with permission to access the agent and assign it to the HR group. Enable Cloud Logging for the agent.
   • BMake the agent public but rely on the corporate firewall to restrict access to the HR department's IP range.
   • CStore the agent's logs in Cloud Storage and grant the HR department access to the logs.
   • DEnable VPC Service Controls for the Gemini API and add the HR department's VPC to the perimeter.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A media company uses Vertex AI to train a custom model on sensitive user engagement data. They must ensure that only approved data scientists can access the training data and that all access is auditable. What combination of controls should they configure?

   • ACreate a custom role with permission to use Vertex AI and assign it to the data scientists.
   • BEncrypt the training data with CMEK and store the key in Cloud KMS with a rotation period of 30 days.
   • CEnable VPC Service Controls for the Vertex AI API and grant the data scientists the Vertex AI User role.
   • DStore the training data in a Cloud Storage bucket, grant the data scientists Storage Object Viewer, and enable Data Access audit logs for the bucket.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A team is using a managed ML platform (PaaS) for training. Which security feature is typically provided by the platform, reducing the team's operational burden?

   • AAutomated patching of the underlying OS
   • BApplication-level input validation
   • CManual encryption key rotation
   • DCustom firewall rule configuration
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which control is most important for preventing unauthorized users from accessing a Gemini Enterprise Agent?

   • AData encryption at rest
   • BNetwork load balancing
   • CModel versioning
   • DIdentity and access management (IAM) policies
   Reveal Solution Discussion Select an answer first