hardMultiple Choice
Generative AI Leader Practice Question: A financial services firm needs to deploy a…
A financial services firm needs to deploy a generative AI model that generates reports from structured and unstructured data. The solution must ensure that outputs never contain sensitive customer information. Which combination of Google Cloud services should they use?
⚠ Common exam trap
Generative AI Leader often tests the misconception that encryption (KMS) or network controls (Cloud NAT/Armor) protect against sensitive data leakage in AI outputs — only DLP-style inspection and de-identification actually address that requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vertex AI Gemini API with DLP integration + IAM roles + VPC Service Controls
The requirement is twofold: generate reports from mixed data and guarantee that outputs never contain sensitive customer information. Vertex AI Gemini API provides the generative capability, Cloud DLP integration (via the DLP API or Vertex AI's built-in DLP integration) inspects and de-identifies sensitive data in prompts and responses, IAM roles enforce least-privilege access to the model and data, and VPC Service Controls create a security perimeter that prevents data exfiltration. Together these address generation, data protection, access control, and network isolation — the complete combination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vertex AI Gemini API with DLP integration + IAM roles + VPC Service Controls
Why this is correct
Gemini on Vertex AI generates the reports, while DLP integration inspects and redacts sensitive customer data in prompts and outputs. IAM roles and VPC Service Controls restrict access and exfiltration, collectively satisfying the requirement that outputs never contain sensitive information.
- ✗
Vertex AI Gemini API + Cloud Key Management Service (KMS) + Secret Manager
Why it's wrong here
KMS and Secret Manager manage encryption keys and secrets, but do not inspect or redact sensitive content in model outputs.
- ✗
Vertex AI Gemini API + Cloud Data Loss Prevention (DLP) standalone + Cloud NAT
Why it's wrong here
Cloud NAT provides internet access for private instances, not data protection; DLP standalone requires separate integration.
- ✗
Vertex AI Gemini API + Cloud DLP + Cloud Armor
Why it's wrong here
Cloud Armor is for network security (DDoS, WAF) and does not inspect generative AI outputs for PII.
Go deeper
Related to this question
About these practice questions
Courseiva writes every Generative AI Leader question from scratch — 1,008 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This Generative AI Leader practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Generative AI Leader exam.