PMLE Collaborating to manage data and models Practice Test 2 — 15 Questions

Question 1

A company uses Cloud Composer to orchestrate an ML pipeline. They notice that the pipeline occasionally fails because the Composer environment runs out of disk space on the worker nodes. The pipeline uses many large dependencies. What is the most effective long-term solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mount a Cloud Storage bucket to the Composer workers using GCSFuse to store large artifacts externally.. Mounting a Cloud Storage bucket via GCSFuse allows Composer workers to access large artifacts stored externally without consuming local disk space. This provides a scalable, durable, and cost-effective solution for handling large dependencies, as the pipeline can read/write directly to Cloud Storage, eliminating the disk space bottleneck on worker nodes.

Answer

Move the pipeline to Cloud Functions to avoid Composer's disk limitations.

Answer

Reduce the size of the Docker image used by the pipeline.

Answer

Increase the number of worker nodes in the Composer environment.

Question 2

Your team is using Vertex AI Pipelines to build an automated training pipeline. You need to share the pipeline definition with another team so they can run it in their own project. Which format should you use?

Accepted Answer

Export the pipeline as a YAML file using the Kubeflow Pipelines SDK.. Vertex AI Pipelines is built on Kubeflow Pipelines, and the standard way to share a pipeline definition is to export it as a YAML file using the Kubeflow Pipelines SDK (`kfp.compiler.Compiler().compile()`). This YAML file contains the complete pipeline specification, including all components, dependencies, and execution order, and can be uploaded and run in any Vertex AI project without requiring the original Python code or build environment.

Answer

Copy the pipeline artifacts to a Cloud Storage bucket and share the bucket.

Answer

Package the pipeline as a Docker container image.

Answer

Share the Python code that compiles the pipeline.

Question 3

Refer to the exhibit. A user receives the error shown when trying to upload a model to Vertex AI. What is the most likely cause?

Accepted Answer

The user does not have the 'roles/aiplatform.admin' or the 'aiplatform.models.upload' permission on the project.. The error message indicates a permission issue during model upload. The user lacks the 'aiplatform.models.upload' permission or the broader 'roles/aiplatform.admin' role on the project. Vertex AI requires these IAM permissions to authorize the upload action, regardless of other resource accessibility.

Answer

The container image 'gcr.io/cloud-aiplatform/prediction/tf2-cpu.2-12:latest' is not accessible.

Answer

The user specified an incorrect region (us-central1) that does not support Vertex AI.

Answer

The Cloud Storage bucket 'gs://my-model-artifacts/fraud-detection/v2/' does not exist.

Question 4

Refer to the exhibit. A user is trying to upload a Vertex AI pipeline definition. The error indicates an invalid dependency order. What should the user do to fix this?

Accepted Answer

Reorder the tasks in the YAML so that task1 is defined before task2.. Vertex AI pipeline definitions require that tasks be declared in the order they appear in the dependency graph. The YAML parser validates the `dependentTasks` field by checking that referenced tasks are already defined. Defining `task1` before `task2` ensures that when `task2` declares a dependency on `task1`, `task1` is already in scope, resolving the invalid dependency order error.

Answer

Rename task1 to a name that comes alphabetically before task2.

Answer

Change the dependency of task2 to be independent of task1.

Answer

Remove the dependentTasks field from task2 and rely on implicit ordering.

Question 5

Refer to the exhibit. An ML engineer in the team needs to deploy the model to an endpoint. The engineer is assigned the 'roles/aiplatform.user' role at the project level but still cannot deploy. What is the most likely reason?

Accepted Answer

The model's resource-level IAM policy only grants the 'roles/aiplatform.user' role, which does not include deploy permission.. The 'roles/aiplatform.user' role at the project level grants permissions to use AI Platform resources, but it does not include the 'aiplatform.models.deploy' permission required to deploy a model to an endpoint. Model deployment is controlled by resource-level IAM policies, and if the model's resource-level policy only grants 'roles/aiplatform.user', the deploy action is denied. The correct role for deployment is 'roles/aiplatform.admin' or a custom role with the deploy permission.

Answer

The service account 'sa-training' is using all the model's quota.

Answer

Alice does not have any IAM role on the project.

Answer

Alice needs to be granted the 'roles/aiplatform.admin' role at the project level.

Question 6

Which TWO tools can be used to collaborate on feature definitions across teams?

Accepted Answer

Vertex AI Feature Store. Vertex AI Feature Store (B) is correct because it provides a centralized, managed repository where teams can define, register, share, and reuse feature definitions (feature groups, features, and views) across projects, enabling consistent collaboration on ML features. Data Catalog (E) is correct because it serves as a metadata management service that lets teams discover, tag, and document datasets and features, so multiple teams can find and align on shared feature definitions. Cloud Storage (A) is not a collaboration tool for feature definitions; it only stores raw objects like blobs and files. Cloud Logging (C) is for collecting and querying logs, not for defining or sharing features. Cloud Build (D) is a CI/CD service for building and deploying artifacts, not for collaborative feature definition.

Answer

Cloud Storage

Answer

Cloud Logging

Answer

Cloud Build

Question 7

Refer to the exhibit. A team member complains they cannot deploy a model to Vertex AI Endpoints. What is the most likely reason?

Accepted Answer

The policy lacks `roles/aiplatform.deployer`. Deploying a model to Vertex AI Endpoints requires the `roles/aiplatform.deployer` role on the service account. This role grants the necessary permissions to create and manage endpoint deployments. Without it, the deployment operation will fail with an access denied error, even if other roles are present.

Answer

The policy is missing a condition

Answer

The policy lacks `roles/aiplatform.specialist`

Answer

The service account needs `roles/aiplatform.user`

Question 8

A data science team uses Vertex AI Pipelines to orchestrate ML training. They notice that some pipeline runs are failing because of inconsistent data schemas. They want to enforce schema validation as a gate before the training step executes. Which approach should they implement?

Accepted Answer

Add a pipeline component that runs schema validation using the TensorFlow Data Validation library.. The TensorFlow Data Validation (TFDV) library is specifically designed for ML pipeline schema validation. By adding a custom pipeline component that uses TFDV, the team can validate incoming data schemas against a predefined schema directly within the Vertex AI Pipelines orchestration, acting as a gate before the training step executes. This approach integrates seamlessly with the pipeline's component-based architecture and provides detailed anomaly reports.

Answer

Use Cloud Dataflow to validate schema during data ingestion before the pipeline starts.

Answer

Use BigQuery schema enforcement when importing data.

Answer

Use TFX ExampleGen with schema_gen to automatically generate and enforce schemas.

Question 9

A data scientist wants to share a trained model with colleagues for evaluation. The model is stored as a Vertex AI Model resource. What is the recommended way to share the model without exposing the underlying project?

Accepted Answer

Share the model ID and grant colleagues the 'vertex.ai.models.get' permission.. Vertex AI Model resources are managed within a single Google Cloud project, and the recommended way to share a model without exposing the underlying project is to grant the IAM role 'roles/aiplatform.user' or the specific permission 'vertex.ai.models.get' to the colleagues' Google accounts. This allows them to access the model via the model ID (a fully qualified resource name like 'projects/{project}/locations/{region}/models/{model}') without needing to copy or expose the project's infrastructure or credentials.

Answer

Create a new project and copy the model.

Answer

Upload the model to a public Cloud Storage bucket.

Answer

Export the model artifact and email it.

Question 10

A team uses Vertex AI Feature Store for online serving. They notice high latency during peak hours. They have configured the feature store with Bigtable as the online serving store. What is the most likely cause of the high latency?

Accepted Answer

The online serving node count is insufficient for the QPS.. Vertex AI Feature Store uses Bigtable as the online serving store, and during peak hours, high query-per-second (QPS) loads can overwhelm the serving nodes if they are under-provisioned. Insufficient node count leads to queuing and increased latency, as Bigtable's performance scales linearly with the number of nodes for read throughput. The most direct remedy is to increase the number of Bigtable nodes to match the QPS demand.

Answer

The Bigtable cluster has too many nodes.

Answer

Feature data is stored as Avro files.

Answer

Feature values are not pre-cached.

Question 11

A financial services company uses Vertex AI to build credit risk models. They have a team of 10 data scientists and 3 ML engineers. They use multiple notebooks in Vertex AI Workbench, storing data in Cloud Storage and BigQuery. The team reports that training jobs sometimes fail with 'Permission denied' errors when reading from certain Cloud Storage buckets. The error occurs intermittently and only for some users. The team uses custom service accounts for each user's notebook instance, but the permissions seem inconsistent. The IT security team has enforced that all service accounts must have least privilege. What is the most effective course of action to resolve the permission issues while maintaining security?

Accepted Answer

Implement resource-level IAM policies on the specific Cloud Storage buckets used, and audit the existing service account permissions.. The intermittent 'Permission denied' errors stem from inconsistent IAM bindings on the Cloud Storage buckets themselves, not from the notebook service accounts lacking project-level roles. Applying resource-level IAM policies on the specific buckets (and auditing each custom service account's existing grants) directly addresses the least-privilege requirement while ensuring every notebook SA that needs access has an explicit, correct binding. This is the only option that both fixes the root cause and preserves the security team's least-privilege mandate.

Answer

Create a single service account with broad permissions for all notebook instances and have users impersonate it.

Answer

Grant all data scientists the 'Storage Admin' role on the project to ensure they can access any bucket.

Answer

Move all training data to BigQuery to avoid Cloud Storage permission issues.

Question 12

A healthcare startup is developing a diagnostic model using sensitive patient data. They use Vertex AI to manage the training pipeline. They need to ensure that the data is encrypted both at rest and in transit. Additionally, they want to prevent the ML engineers from seeing raw data but still allow them to train models. They use Cloud Storage with CMEK and VPC-SC. They plan to use Vertex AI Training with a custom service account. The data stored in Cloud Storage is encrypted with CMEK. What additional step is needed to allow Vertex AI Training to access the encrypted data?

Accepted Answer

Grant the custom service account the Cloud KMS CryptoKey Decrypter role.. Vertex AI Training must use a custom service account that has the Cloud KMS CryptoKey Decrypter role to decrypt the CMEK-encrypted data stored in Cloud Storage. The custom service account is the identity that Vertex AI jobs run as, and it needs explicit permission to decrypt the CMEK key to read the training data. Without this role, the encrypted objects remain inaccessible even if the service account has Storage Object Viewer permissions.

Answer

Use a service account with the 'Storage Admin' role and 'Cloud KMS CryptoKey Decrypter' role.

Answer

Grant the Cloud Storage service agent the Cloud KMS CryptoKey Decrypter role.

Answer

Disable encryption for the training data to simplify access.

Question 13

A large e-commerce company deploys multiple ML models on Vertex AI Endpoints. They use Vertex AI Model Registry to manage model versions. Recently, a team accidentally deployed an unvalidated model to production, causing a service outage. They want to implement a governance process where models must pass certain validation checks before deployment. The validation includes unit tests, fairness checks, and performance benchmarks. They use CI/CD pipelines (Cloud Build). They also need to allow manual approval for critical models. Which combination of Vertex AI features and Cloud Build steps would enforce the required governance?

Accepted Answer

Implement Cloud Build triggers that run validation steps, then use Vertex AI Model Registry 'state' to mark models as 'validated' before allowing deployment to endpoints.. It combines Cloud Build triggers to run validation steps (unit tests, fairness checks, performance benchmarks) and uses Vertex AI Model Registry's 'state' field to mark models as 'validated' only after passing those checks. This state then acts as a gate in the deployment pipeline, ensuring that only validated models can be deployed to Vertex AI Endpoints. The manual approval for critical models can be integrated as a Cloud Build approval step before the state is set to 'validated'.

Answer

Use Vertex AI Experiments to log validation results and require manual checks before deployment.

Answer

Set up Cloud Armor to block deployment of unvalidated models.

Answer

Use Vertex AI Continuous Monitoring to automatically detect issues and roll back deployments.

Question 14

Your team stores training data in a Cloud Storage bucket that is shared across multiple projects. Only members of the group ml-researchers@example.com should be able to read the data, and you want to follow the principle of least privilege. Which action should you take?

Accepted Answer

Grant the roles/storage.objectViewer role on the bucket to the group ml-researchers@example.com using IAM conditions.. The group needs read-only access to the bucket, so the predefined role roles/storage.objectViewer is appropriate. Granting it to the group at the bucket level ensures only intended users get access and follows least privilege. Other roles either grant excessive permissions, no relevant permissions, or are legacy roles that do not provide object read access.

Answer

Grant the roles/storage.legacyBucketReader role on the bucket to the group ml-researchers@example.com.

Answer

Grant the roles/iam.serviceAccountUser role on the bucket to the group ml-researchers@example.com.

Answer

Grant the roles/storage.admin role on the bucket to each member of the group ml-researchers@example.com.

Question 15

Your team maintains a Vertex AI Model Registry with several model versions. A new team member needs to deploy a specific version to a Vertex AI Endpoint for testing, but must not modify the model or its artifacts. Which IAM role should you grant them on the model resource?

Accepted Answer

roles/aiplatform.modelUser. The teammate needs to deploy a model without modifying it, so a role that permits deployment but not management is required. roles/aiplatform.modelUser is specifically designed for this purpose, offering the necessary permissions to deploy and use models while restricting actions that could alter the model. This ensures secure collaboration while adhering to least privilege.

Answer

roles/aiplatform.admin

Answer

roles/aiplatform.user

Answer

roles/aiplatform.viewer