GCP Professional Cloud Security Engineer Practice Question

A life-sciences company trains sensitive genomic models on Vertex AI. Security policy requires that every API request made by Vertex AI training jobs, batch predictions, or pipeline components must remain confined to a list of approved Google Cloud projects; any attempt to move data or models to resources outside those projects must be blocked, even if someone later grants broad IAM permissions by mistake. What is the most effective network-layer control that satisfies these requirements while letting data scientists continue to use the fully managed Vertex AI service with minimal ongoing maintenance effort?

Configure Private Service Connect endpoints for Vertex AI and require data scientists to use the private.googleapis.com domain for API access.
Create a VPC Service Controls perimeter that includes aiplatform.googleapis.com and storage.googleapis.com and limits access to only the sanctioned projects.
Remove all external IP addresses from training VMs and force any remaining egress through Cloud NAT governed by an egress-deny firewall rule.
Protect every dataset and model with CMEK and plan to destroy the keys immediately if data exfiltration is suspected.

Report Issue

Answer Description

Creating a VPC Service Controls (VPC SC) service perimeter around the approved projects and adding both aiplatform.googleapis.com (Vertex AI) and storage.googleapis.com (Cloud Storage) to the protected services list prevents data exfiltration at Google's network edge. API calls that try to read from or write to resources outside the perimeter are denied before IAM is evaluated, so even an overly permissive IAM role cannot bypass the restriction. Removing external IPs or relying only on Cloud NAT or Private Service Connect controls traffic that traverses customer VPCs but does not block Google-managed service-to-service APIs. CMEK governs encryption, not network egress, and cannot stop exfiltration.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.