🔥 40% Off Crucial Exams Memberships — Deal ends today!

1 hour, 53 minutes remaining!
Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your security team must prevent accidental or malicious data exfiltration during Vertex AI custom training jobs that read images from Cloud Storage and labels from a BigQuery dataset. CI/CD pipelines in another Google Cloud project within the same organization still need to trigger those training jobs programmatically. What should you implement to block any calls to Vertex AI, Cloud Storage, or BigQuery that come from outside approved projects while permitting the pipelines to continue working?

  • Enable Private Service Connect on the Vertex AI endpoint and block all other egress routes from the training VPC network.

  • Attach Cloud NAT to the training VMs and configure egress firewall rules that restrict traffic to Google API IP ranges only.

  • Encrypt the training data with customer-managed encryption keys (CMEK) and grant the Vertex AI runtime service account the Cloud KMS CryptoKey Decrypter role.

  • Create a VPC Service Controls service perimeter that covers the Vertex AI API, the Cloud Storage buckets, and the BigQuery dataset, and add the CI/CD pipeline's project to the same perimeter (or link it with a perimeter bridge and an ingress rule for the pipeline's service account).

GCP Professional Cloud Security Engineer
Ensuring data protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot