GCP Professional Cloud Architect Practice Question

Your company is creating a conversational agent using a custom Vertex AI model. Users send free-form prompts that might contain Social Security numbers or other PII. Corporate policy states that no raw PII may be persisted anywhere in Google Cloud, including prediction logs. Inference latency must remain under 300 ms and the team wants to avoid managing servers. Which architecture best satisfies these requirements?

Store prompts in Cloud Storage and run a nightly Cloud Dataflow job that uses Cloud DLP to de-identify the data before refeeding it into Vertex AI for batch prediction.
Place the Vertex AI endpoint behind Identity-Aware Proxy and within a VPC Service Controls perimeter, preventing egress to unauthorized networks without performing additional data inspection.
Call the Vertex AI predictions endpoint directly, disable request/response logging, and rely on default encryption at rest to protect any PII that is written to internal logs.
Front the Vertex AI endpoint with an HTTP Cloud Function that synchronously invokes Cloud DLP inspectContent and deidentifyContent to redact PII from both the user prompt and the model response before forwarding traffic or writing any logs, with Vertex AI logging disabled.

Report Issue

Answer Description

Invoking Cloud DLP's synchronous inspectContent/deidentifyContent methods from a lightweight Cloud Function lets you remove or mask sensitive data in-line, before any text is forwarded to Vertex AI or written to logs. The Cloud Function is fully managed, so there is no infrastructure to maintain, and the DLP content methods typically add only a few tens of milliseconds for short text, keeping overall latency well within 300 ms. Simply turning off logging or relying on encryption does not prevent raw PII from reaching back-end services. A VPC Service Controls perimeter or IAP restricts egress but still allows unredacted data to be stored internally. A nightly Dataflow pipeline would still persist raw data during the day and violates the real-time latency requirement and the "no storage" constraint.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.