Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ147

Ensuring data protection

You are collaborating with developers to secure custom training jobs that run on Vertex AI. For compliance purposes, every supported data type must be encrypted with key material located in the Europe region and controlled by your organization. Encryption must not affect the Vertex AI training operation. What should you do?

  • A Encrypt the code, training data, and metadata with Google default encryption. Use customer-managed encryption keys (CMEK) for the trained models exported to Cloud Storage buckets.
  • B Encrypt the code, training data, metadata, and exported trained models with customer-managed encryption keys (CMEK).
  • C Encrypt the code, training data, and exported trained models with customer-managed encryption keys (CMEK).
  • D Encrypt the code, training data, and metadata with Google default encryption. Implement an organization policy that enforces a constraint to restrict the Cloud KMS location to the Europe region.
Explanation

Customer-managed encryption keys (CMEK) protect the custom-job code copy, data loaded by that code, and temporary data written to the job VM disks. CMEK does not encrypt operation metadata, which is always protected with Google default encryption. Cloud Storage model exports require CMEK configuration on the applicable bucket or objects. The CMEK key must be located in the same region as the protected compute resource.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!