3.3 Securing AI Workloads PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When training an ML model on IaaS, which control is most directly responsible for preventing unauthorized network access to the training VMs?

   • AIAM roles
   • BVPC firewall rules
   • CCloud Audit Logs
   • DCloud KMS encryption keys
   Reveal Solution Discussion Select an answer first
2. 27application · hard

   A research lab trains a proprietary model on a cluster of Compute Engine VMs. They need to protect the trained model artifact from being stolen by an insider who has access to the VM instances. The model is stored on a persistent disk. What is the most effective control?

   • AEncrypt the persistent disk with CMEK and restrict access to the Cloud KMS key using IAM conditions that require the user to be in the lab's office network.
   • BUse Confidential VMs to protect the model in memory and enforce that the model is only loaded into memory, never written to an unencrypted disk.
   • CStore the model in a Cloud Storage bucket with a VPC Service Controls perimeter and grant the VMs access via a service account that has read-only access.
   • DApply a Cloud Armor policy to the VMs to block all inbound traffic except from the lab's IP range.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is building a new ML pipeline. The data science team wants to use a PaaS solution (Vertex AI) for speed, but the security team is concerned about the lack of control over the underlying infrastructure. The compliance team requires that all data be encrypted with keys managed by the company. What is the best way to address the security team's concern while still using Vertex AI?

   • AUse Google-managed encryption keys for Vertex AI and rely on the default VPC Service Controls perimeter.
   • BMove the training workload to Compute Engine VMs to have full control over the infrastructure, and use Cloud EKM for key management.
   • CEnable Confidential VMs within Vertex AI to protect data in use.
   • DUse CMEK for all Vertex AI resources and enable VPC Service Controls to create a security perimeter around the service.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which control is most likely the customer's responsibility when using a PaaS ML training service?

   • AManaging access to the training data
   • BPatching the virtualization hypervisor
   • CSecuring the physical data center
   • DUpgrading the ML framework version
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which Google Cloud service is primarily used to collect and analyze logs from AI workloads for security auditing?

   • ACloud Load Balancing
   • BCloud Logging
   • CCloud CDN
   • DCloud DNS
   Reveal Solution Discussion Select an answer first