Business Strategies for Generative AI Solutions →mediumMultiple ChoiceObjective-mapped

Generative AI Leader Practice Question: Business Strategies for Generative AI Solutions

Exhibit

Refer to the exhibit.

```
{
  "policy": {
    "bindings": [
      {
        "role": "roles/aiplatform.user",
        "members": ["user:analyst@example.com", "user:engineer@example.com"]
      },
      {
        "role": "roles/aiplatform.admin",
        "members": ["user:admin@example.com"]
      }
    ],
    "auditConfigs": [
      {
        "service": "aiplatform.googleapis.com",
        "auditLogConfigs": [
          {"logType": "ADMIN_READ", "exemptedMembers": []},
          {"logType": "DATA_READ", "exemptedMembers": []},
          {"logType": "DATA_WRITE", "exemptedMembers": []}
        ]
      }
    ]
  }
}
```

An organization uses an IAM policy for Vertex AI as shown. A security audit reveals that engineer@example.com deployed a model that inadvertently exposed sensitive data. What is the most likely reason this happened?

⚠ Common exam trap

The trap here is that candidates may focus on operational failures like missing audit logs or lack of review, rather than recognizing that the IAM role itself grants the permission to deploy without any guardrails, which is the direct technical cause of the exposure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The engineer had the aiplatform.user role, which includes permissions to deploy models without additional review.

The `aiplatform.user` role in Vertex AI includes the `aiplatform.model.deploy` permission, which allows any user with that role to deploy models without requiring additional approvals or administrative review. This lack of a secondary authorization step means the engineer could deploy a model that exposed sensitive data, even if the model had not been properly vetted for data leakage.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Audit logging is not enabled for DATA_WRITE events.
Why it's wrong here
Audit configs show all log types enabled.
✗
The admin user did not review the deployment.
Why it's wrong here
Admin is not required to review deployments by default.
✓
The engineer had the aiplatform.user role, which includes permissions to deploy models without additional review.
Why this is correct
The user role allows deployment, and no approval gate is enforced.
✗
The policy does not include a separation of duties between development and production.
Why it's wrong here
While separation of duties is missing, the immediate cause is the permission to deploy.

Go deeper

Generative AI Leader Practice Question: Business Strategies for Generative AI Solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question