hardMultiple Choice
Generative AI Leader Practice Question: Deploying a generative AI application that must…
A company is deploying a generative AI application that must meet HIPAA compliance. They need audit logging, data isolation, and a Business Associate Agreement (BAA). Which Gemini API access tier should they use?
⚠ Common exam trap
A common mistake is assuming Google AI Studio is a production-ready tier for compliance workloads, but it lacks BAA support and enterprise controls, making Vertex AI the only valid option for HIPAA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vertex AI
Vertex AI is the correct choice because it is the only Google Cloud platform that offers HIPAA-compliant services with support for audit logging, data isolation, and the ability to sign a Business Associate Agreement (BAA). Vertex AI provides enterprise-grade security controls, including VPC Service Controls, CMEK, and access transparency, which are required for protected health information (PHI) under HIPAA. The Gemini API accessed through Vertex AI inherits these compliance capabilities, making it suitable for regulated healthcare workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vertex AI
Why this is correct
Vertex AI provides the enterprise controls HIPAA workloads demand: audit logging, data isolation, and a signed Business Associate Agreement covering the Gemini API. The consumer Gemini API tier lacks a BAA, so it cannot satisfy the compliance constraint.
- ✗
Google AI Studio
Why it's wrong here
Google AI Studio is a prototyping environment without a BAA, audit logging or tenant data isolation, so it cannot host HIPAA workloads. It is tempting because it offers free, quick Gemini API experimentation, and would be correct for non-regulated prototyping before moving to Vertex AI.
- ✗
Gemini Nano on-device
Why it's wrong here
Gemini Nano runs on-device without centralised audit logging, data isolation guarantees or a BAA covering Google's processing. It is tempting because it keeps data local and offline, and would be correct for on-device features where data must never leave the handset.
- ✗
Cloud Vision API
Why it's wrong here
Cloud Vision API performs image labelling and OCR, not Gemini text generation, and provides no BAA-backed generative tier. It is tempting because it is a Google Cloud AI service with enterprise controls, and would be correct for extracting text or classifying images in a compliant pipeline.
Go deeper
Related to this question
About these practice questions
One of 1,008 original Generative AI Leader practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This Generative AI Leader practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Generative AI Leader exam.