Fundamentals of Generative AI →hardMultiple ChoiceObjective-mapped

Generative AI Leader Fundamentals of Generative AI Practice Question

Exhibit

{
  "bindings": [
    {
      "role": "roles/aiplatform.user",
      "members": ["user:alice@example.com"]
    },
    {
      "role": "roles/aiplatform.customCodeModelAdmin",
      "members": ["user:bob@example.com"]
    }
  ]
}

Refer to the exhibit. An administrator creates this IAM policy for a Vertex AI project. What is the effect of this policy?

⚠ Common exam trap

Google Cloud often tests the distinction between specific IAM permissions (e.g., `get` vs. `create` vs. `delete`) and the common misconception that viewing a model implies full access or that creating a model implies the ability to deploy it.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Alice can deploy pre-trained models; Bob can create and manage custom model code

The IAM policy grants Alice the `aiplatform.models.get` permission (allowing her to view and deploy pre-trained models) and grants Bob the `aiplatform.models.create` and `aiplatform.models.update` permissions (allowing him to create and manage custom model code). The policy uses separate bindings for each user, with specific roles that align with these actions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Alice can view models; Bob can delete models
Why it's wrong here
aiplatform.user includes more than view; delete is not granted by customCodeModelAdmin.
✓
Alice can deploy pre-trained models; Bob can create and manage custom model code
Why this is correct
aiplatform.user includes deployment permissions; customCodeModelAdmin covers custom code management.
✗
Both have full access to all Vertex AI resources
Why it's wrong here
Neither role grants full access; aiplatform.user is limited, customCodeModelAdmin is specific.
✗
Alice can train models; Bob can deploy models
Why it's wrong here
Training is not typically part of aiplatform.user; customCodeModelAdmin includes deployment of custom models, but not necessarily all models.

Go deeper

Generative AI Leader Fundamentals of Generative AI Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question