GCP Professional Cloud Architect Practice Question

Your healthcare analytics team is exposing a Vertex AI generative model as an internal chat-completion service for clinicians. Compliance mandates that protected health information (PHI) must never traverse the public internet, and every model response must be automatically screened for PHI before it is returned to the caller. Which design best satisfies both requirements while keeping custom code to a minimum?

Deploy the model on a private GKE cluster accessed over a VPN and use Cloud KMS envelope encryption to protect PHI in transit between clients and the cluster.
Expose the model through a private Vertex AI endpoint reachable via Private Service Connect within a VPC Service Controls perimeter, and enable Model Armor with a Sensitive Data Protection policy to automatically redact PHI in responses.
Export the model to Cloud Run behind Identity-Aware Proxy and call the Cloud DLP API from custom middleware to remove PHI before returning responses.
Serve the model on a public Vertex AI endpoint restricted to clinician accounts by IAM policies, relying on Cloud Audit Logs to monitor any PHI exposure.

Report Issue

Answer Description

Serving the model through a private Vertex AI prediction endpoint that is reachable only over Private Service Connect keeps request and response traffic on Google's private network, meeting the "no public internet" mandate. Placing the service inside a VPC Service Controls perimeter adds an additional control to block accidental or malicious data exfiltration. Enabling Model Armor with a Sensitive Data Protection (Cloud DLP) policy provides built-in inspection and redaction of PHI in prompts and responses without requiring you to write and maintain custom middleware. The other options either expose the service publicly, rely solely on IAM and logging, or require significant custom implementation and do not leverage Vertex AI's native private access and content-inspection capabilities.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.