Answer-first summary for fast verification
Answer: Encrypt the code, training data, and exported trained models with customer-managed encryption keys (CMEK).
The question requires encrypting all supported data types with keys stored in Europe and managed by the organization, without impacting training performance. According to Google's Vertex AI CMEK documentation and the community consensus (with option C receiving 55% support and multiple upvoted comments referencing the official documentation), CMEK does not encrypt metadata associated with operations like job names, regions, or dataset display names—metadata is always encrypted using Google's default encryption. Therefore, option C is correct as it applies CMEK to the code, training data, and exported trained models (the actual data requiring organizational control), while acknowledging that metadata encryption is handled by Google by default. Option B is incorrect because it includes metadata in CMEK encryption, which is not supported. Option A is incorrect as it uses Google default encryption for code and training data instead of CMEK. Option D is incorrect because it relies on Google default encryption for critical data and uses an organization policy for KMS location, which does not ensure organizational key management for all required data types.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
You need to ensure all data types used in Vertex AI custom training jobs are encrypted with keys stored in the Europe region and managed by your organization, without affecting training performance. What should you do?
A
Encrypt the code, training data, and metadata with Google default encryption. Use customer-managed encryption keys (CMEK) for the trained models exported to Cloud Storage buckets.
B
Encrypt the code, training data, metadata, and exported trained models with customer-managed encryption keys (CMEK).
C
Encrypt the code, training data, and exported trained models with customer-managed encryption keys (CMEK).
D
Encrypt the code, training data, and metadata with Google default encryption. Implement an organization policy that enforces a constraint to restrict the Cloud KMS location to the Europe region.
No comments yet.