Professional Cloud Security Engineer · Domain 3: Ensuring data protection · 23% of the exam
Task 3.3: Securing AI workloads.
Security and privacy controls that keep AI and ML systems from exposing data or models, requirements for IaaS- and PaaS-hosted training, and controls for Gemini Enterprise Agent Platform.
Study it
Securing AI workloads: Agent Platform controls, Model Armor and training environments
Try each one before opening the answer. Every option is explained, with the Google Cloud documentation page that proves it.
Question 1 · choose 1
A customer support chatbot calls a Gemini model on Gemini Enterprise Agent Platform. Users have tried to make it ignore its instructions, and some answers have included account numbers drawn from support tickets. The security team wants inputs screened for these manipulation attempts and outputs screened for sensitive data before either reaches its destination. What should the security engineer add?
AModel Armor templates applied to the prompts sent to the model and to the responses it returns
BStricter Gemini safety filter thresholds for the harassment, hate and dangerous content categories
CA Cloud Armor policy on the chatbot's load balancer with the preconfigured cross-site scripting rules
DA VPC Service Controls perimeter around the project that hosts the chatbot and the model endpoint
Show the answer and why
AModel Armor templates applied to the prompts sent to the model and to the responses it returns
Correct
Model Armor screens prompts and responses; its templates can detect prompt injection and jailbreaks and use Sensitive Data Protection to find and redact sensitive data.
BStricter Gemini safety filter thresholds for the harassment, hate and dangerous content categories
Incorrect
Safety filters block harmful content categories; they are not built to catch instruction overrides or to redact account numbers.
CA Cloud Armor policy on the chatbot's load balancer with the preconfigured cross-site scripting rules
Incorrect
Cloud Armor inspects HTTP requests for web attacks such as XSS; it does not understand prompts or model responses.
DA VPC Service Controls perimeter around the project that hosts the chatbot and the model endpoint
Incorrect
A perimeter stops API calls from crossing the boundary; it does not inspect what users type or what the model answers.
Model Armor is Google Cloud's service for screening LLM prompts and responses. Templates choose the filters: responsible AI categories, prompt injection and jailbreak detection, malicious URL detection and Sensitive Data Protection. Google suggests separate templates for user prompts and model responses, since inputs and outputs carry different risks.
Data scientists run serverless custom training jobs on Gemini Enterprise Agent Platform with regulated data from buckets. The security team requires that each job run with only the permissions it needs and that the training data and resulting models cannot be exfiltrated to projects outside the company's boundary. Which TWO measures should the security engineer apply? (Choose TWO.)
ALet jobs run as the Agent Platform service agent, which already has access to the project's buckets
BA user-managed service account for the jobs, granted only the roles they need
CA public Agent Platform endpoint for the trained model, protected with an API key
DA service perimeter restricting the Agent Platform and Cloud Storage APIs
EAgent Platform Workbench instances with public IP addresses for the data scientists, so that they can reach external packages
Show the answer and why
ALet jobs run as the Agent Platform service agent, which already has access to the project's buckets
Incorrect
The default service agent's access is broad and shared by every job; Google recommends a custom service account per workload.
BA user-managed service account for the jobs, granted only the roles they need
Correct
Training jobs can run as a user-managed service account, so each job gets only the bucket and model permissions it needs.
CA public Agent Platform endpoint for the trained model, protected with an API key
Incorrect
Exposing the model publicly with an API key adds an exfiltration path and does not identify callers.
DA service perimeter restricting the Agent Platform and Cloud Storage APIs
Correct
With both APIs restricted in the perimeter, data and models cannot be moved through those APIs to projects outside it.
EAgent Platform Workbench instances with public IP addresses for the data scientists, so that they can reach external packages
Incorrect
Public IP addresses on notebooks widen access to the data instead of limiting it.
Agent Platform jobs can run as a custom service account instead of the default service agent, which keeps each workload to least privilege. VPC Service Controls supports the Agent Platform API, so placing it in a perimeter with Cloud Storage keeps datasets, training outputs and models from being exfiltrated through those APIs.
A research team plans to move model training from Agent Platform serverless training jobs to its own Compute Engine GPU VMs built from Deep Learning VM images, to get more control over the environment. Which security responsibility does the team take on with this move?
AEncryption at rest, because Compute Engine does not encrypt the disks of VMs created from Deep Learning VM images
BPatching the VMs' operating system, GPU drivers and ML frameworks for as long as they run
CPhysical security of the GPU hosts, because the team now chooses the machine type and zone
DNothing new, because Google patches every VM created from a Deep Learning VM image
Show the answer and why
AEncryption at rest, because Compute Engine does not encrypt the disks of VMs created from Deep Learning VM images
Incorrect
Compute Engine encrypts disks at rest by default, whatever image the VM uses.
BPatching the VMs' operating system, GPU drivers and ML frameworks for as long as they run
Correct
On IaaS the customer owns the guest OS and software stack, so updates to running VMs are the team's job; new images do not patch existing VMs.
CPhysical security of the GPU hosts, because the team now chooses the machine type and zone
Incorrect
Google keeps responsibility for its data centers and hardware whichever compute model the customer picks.
DNothing new, because Google patches every VM created from a Deep Learning VM image
Incorrect
Deep Learning VM images are maintained by Google, but a VM built from one is patched by its owner.
In the shared responsibility model, the customer's share grows as the service moves from PaaS to IaaS. With Agent Platform serverless training, Google runs the training infrastructure. With Compute Engine VMs, even from Google's Deep Learning VM images, the team owns the guest operating system, drivers and libraries and must keep them patched and hardened.
Many product teams build generative AI features and create their own Model Armor templates. The security team wants teams to keep that freedom, but no team may ever save a template with weaker filter settings than the company baseline. What should the security engineer configure?
AOne central template that every team must reference, with all other template creation blocked by IAM
BModel Armor floor settings at the organization level, with the baseline filters as minimums
CA Security Health Analytics custom module that reports weak templates each day
DA VPC Service Controls perimeter around every project that calls a Gemini model
Show the answer and why
AOne central template that every team must reference, with all other template creation blocked by IAM
Incorrect
Blocking template creation removes the teams' freedom, which the requirement keeps.
BModel Armor floor settings at the organization level, with the baseline filters as minimums
Correct
Floor settings define minimum filters that new and updated templates must meet at the organization, folder or project level, so teams cannot go below the baseline.
CA Security Health Analytics custom module that reports weak templates each day
Incorrect
A detector reports weak templates after they exist; it does not stop them being saved.
DA VPC Service Controls perimeter around every project that calls a Gemini model
Incorrect
A perimeter limits API access across a boundary; it does not judge the filter thresholds in templates.
Model Armor floor settings set minimum requirements for templates, for example the confidence levels of their filters, at the organization, folder or project level. Newly created and updated templates must conform, and floor settings can also turn on inline enforcement for supported Gemini models in a project.
Data scientists work with patient data in Agent Platform Workbench instances. Auditors require that each instance be used by exactly one person and that its calls to Google Cloud APIs run with that person's own credentials. How should the security engineer have the instances created?
AWith the Service account access mode and one shared service account for the whole team
BWith any access mode, then switched to single user after the data has been loaded
CWith the Single user only access mode for that data scientist and managed end user credentials enabled
DWith the Single user only access mode for that data scientist, and the instance's service account granted the data roles
Show the answer and why
AWith the Service account access mode and one shared service account for the whole team
Incorrect
In service account mode, calls run as the service account, and sharing it lets anyone with access act as it.
BWith any access mode, then switched to single user after the data has been loaded
Incorrect
The access mode is chosen at creation and cannot be changed afterwards.
CWith the Single user only access mode for that data scientist and managed end user credentials enabled
Correct
Single user only limits JupyterLab to the named user, and managed end user credentials make the instance call Google Cloud with that user's own credentials instead of a service account's.
DWith the Single user only access mode for that data scientist, and the instance's service account granted the data roles
Incorrect
Single user only by itself limits who opens JupyterLab, but the instance's calls still use its service account's credentials, not the user's.
A Workbench instance's JupyterLab access mode decides who can use it, and it is set at creation and cannot be changed. By default, code in an instance calls Google Cloud with the instance's service account, even in Single user only mode. To have calls run with the user's own credentials, the instance is created with Single user access and with managed end user credentials enabled.
A European bank's assistant sends customer questions to a Gemini model on Gemini Enterprise Agent Platform. Its regulator requires that the model's processing of prompts and responses happen only in EU locations. The developers currently call the global endpoint because it has the best availability. What should the security engineer require?
AKeep the global endpoint and set the project's resource locations policy to in:eu-locations
BKeep the global endpoint and turn on CMEK for the project's Agent Platform resources
CKeep the global endpoint and wrap every call in a VPC Service Controls perimeter
DSwitch from the global endpoint to an EU regional endpoint or the EU multi-region endpoint
Show the answer and why
AKeep the global endpoint and set the project's resource locations policy to in:eu-locations
Incorrect
Requests to the global endpoint may be processed in any location, and a location policy on resources does not change that.
BKeep the global endpoint and turn on CMEK for the project's Agent Platform resources
Incorrect
CMEK controls the encryption of stored resources; it does not decide where the model runs.
CKeep the global endpoint and wrap every call in a VPC Service Controls perimeter
Incorrect
A perimeter controls API access across its boundary, not the location where requests are processed.
DSwitch from the global endpoint to an EU regional endpoint or the EU multi-region endpoint
Correct
Regional and jurisdictional multi-region endpoints keep ML processing in the jurisdiction they belong to, while the global endpoint gives no data residency guarantee.
Agent Platform documents where data is stored at rest and where ML processing happens. Requests sent to a global endpoint may be processed in any Google Cloud location and carry no data residency guarantee, so a residency rule for processing means calling regional endpoints in the required locations or a jurisdictional multi-region endpoint such as eu.
A company wants to tune a model on two years of support chat transcripts. The transcripts contain customers' names, phone numbers and addresses, and the privacy team is concerned that the tuned model could reproduce such details in its answers. What should the security engineer do before tuning?
ADe-identify the transcripts with Sensitive Data Protection before they are used for tuning
BEncrypt the transcripts with a CMEK key while they are stored in Cloud Storage
CRestrict the tuning job's service account to read-only access on the bucket
DTurn on Data Access audit logs for the bucket that holds the transcripts
Show the answer and why
ADe-identify the transcripts with Sensitive Data Protection before they are used for tuning
Correct
Removing or replacing personal data in the training set means the model cannot learn and later repeat it.
BEncrypt the transcripts with a CMEK key while they are stored in Cloud Storage
Incorrect
Encryption at rest protects the stored files, but the model still trains on the personal data in them.
CRestrict the tuning job's service account to read-only access on the bucket
Incorrect
Read-only access is good practice, yet the job still reads and learns the personal data.
DTurn on Data Access audit logs for the bucket that holds the transcripts
Incorrect
Audit logs record who read the files; they do not keep personal data out of the model.
A model can memorize parts of its training data. Using Sensitive Data Protection to inspect and de-identify training data, for example by replacing detected infoTypes or pseudonymizing them, keeps personal data out of tuning, which is a core privacy control for AI workloads.