GCP Professional Cloud Security Engineer Practice Question

A financial-services firm must train a fraud-detection model on Vertex AI in us-central1. The raw transaction CSVs contain PCI data, and the security team demands that every copy stored in Google Cloud be encrypted with keys the company controls and can disable at any time for crypto-shredding. Data scientists will import the CSVs into a Vertex AI Tabular Dataset and run AutoML training jobs that read the dataset. Which design satisfies the requirements while minimizing ongoing operational work?

Use the default Google-managed encryption for Vertex AI resources and configure a retention policy to delete the dataset when no longer needed.
Create a symmetric Cloud KMS key in a key ring located in us-central1, grant the Vertex AI service-agent the Cloud KMS CryptoKey Encrypter/Decrypter role, and pass the key's resource ID in the encryptionSpec when calling the Vertex AI CreateDataset API.
Generate an asymmetric RSA key in Cloud KMS, encrypt the CSV files client-side with the public key before uploading, and disable the key version when crypto-shredding is required.
Store the CSV files in a Cloud Storage bucket protected by a CMEK key and import them into Vertex AI; the dataset will automatically inherit the bucket's CMEK configuration without further action.

Report Issue

Answer Description

Vertex AI lets you protect a Dataset, Model, or Endpoint with a customer-managed key by passing an encryptionSpec.kmsKeyName field when you invoke the API that creates the resource. The key must be a symmetric Cloud KMS key in the same region as the Vertex AI resource. Vertex AI uses the service-agent ([email protected]) to access the key, so that principal needs the Cloud KMS CryptoKey Encrypter/Decrypter role. If the key is disabled or destroyed, the dataset and any training jobs that rely on it become unreadable, providing the required crypto-shredding capability.

Default Google-managed encryption does not provide customer control over keys. Vertex AI does not inherit a bucket's CMEK settings-you must explicitly supply an encryptionSpec for the dataset itself. Asymmetric keys cannot be used with CMEK-integrated services, so creating an RSA key would prevent the dataset from being created.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.