Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your company is building a new fraud-detection model on Vertex AI. Training data in a Cloud Storage bucket is already encrypted with a customer-managed key (CMEK). Compliance policy states that: all traffic between your VPC and Vertex AI services must stay on Google's private network; only the ML engineering service account may launch training jobs; and any accidental data egress from Vertex AI to services outside the environment must be blocked. Which solution best meets these requirements?

  • Disable external IP addresses on training VMs and add egress-deny firewall rules, but continue using Google-managed encryption keys and do not configure VPC Service Controls.

  • Distribute signed URLs for the training data bucket, expose Vertex AI publicly, and connect the project to the on-premises network using VPC Network Peering instead of Private Service Connect.

  • Create Private Service Connect endpoints for Vertex AI, add the project and the CMEK-protected bucket to the same VPC Service Controls perimeter, and grant the ML engineering service account only the Vertex AI User IAM role needed to run training jobs.

  • Access Vertex AI over its public endpoint through Cloud NAT, enable Cloud Audit Logs, and give the ML engineer the Storage Object Viewer role at the organization level.

GCP Professional Cloud Security Engineer
Ensuring data protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot