Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ92

Securing communications and establishing boundary protection

Your company has deployed an artificial-intelligence model in a central project. The model contains substantial sensitive intellectual property and must remain strictly isolated from the internet. You need to expose the model endpoint only to a specified list of projects in your organization. What should you do?

  • A Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
  • B Activate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
  • C Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
  • D Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.
Explanation

Private Service Connect can publish a service behind an internal load balancer for private consumption from other VPC networks. Its service attachment can use an explicit consumer accept list containing the authorized consumer projects, so the model endpoint remains non-internet-facing while access is limited to those projects.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!