Sharing Vertex AI Model via IAM
A data scientist wants to share a trained model with colleagues for evaluation. The model is stored as a Vertex AI Model resource. What is the recommended way to share the model without exposing the underlying project?
Quick Answer
The answer is to share the model ID and grant colleagues the 'vertex.ai.models.get' permission. This is correct because Vertex AI Model resources are scoped to a single Google Cloud project, and IAM permissions allow you to share a vertex ai model without exposing project infrastructure or credentials—colleagues access the model via its fully qualified resource name like 'projects/{project}/locations/{region}/models/{model}'. On the Google Professional Machine Learning Engineer exam, this tests your understanding of IAM-based resource sharing versus copying or exporting models, a common trap being to assume you must move the model to another project. The key insight is that Vertex AI uses IAM for fine-grained access control, so granting the 'roles/aiplatform.user' role or the specific 'vertex.ai.models.get' permission is the recommended way to share a model without exposing the underlying project. Memory tip: think "ID + IAM, not copy and scram"—share the identifier, not the infrastructure.
⚠ Common exam trap
Google Cloud often tests the misconception that sharing a model requires copying or exporting the artifact, when in fact IAM-based access control on the managed resource is the secure and recommended approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Share the model ID and grant colleagues the 'vertex.ai.models.get' permission.
Vertex AI Model resources are managed within a single Google Cloud project, and the recommended way to share a model without exposing the underlying project is to grant the IAM role 'roles/aiplatform.user' or the specific permission 'vertex.ai.models.get' to the colleagues' Google accounts. This allows them to access the model via the model ID (a fully qualified resource name like 'projects/{project}/locations/{region}/models/{model}') without needing to copy or expose the project's infrastructure or credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Share the model ID and grant colleagues the 'vertex.ai.models.get' permission.
Why this is correct
This provides secure, traceable access without exposing the project.
- ✗
Create a new project and copy the model.
Why it's wrong here
Duplicate projects increase management overhead and cost.
- ✗
Upload the model to a public Cloud Storage bucket.
Why it's wrong here
Public buckets expose the model to anyone, violating security.
- ✗
Export the model artifact and email it.
Why it's wrong here
Emailing artifacts is insecure and does not support versioning.
Go deeper
Related to this question
About these practice questions
This PMLE question is part of Courseiva's 990-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PMLE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data scientist wants to share a trained model with the team for review before deployment. The model is stored in Vertex AI Model Registry. What is the recommended way to grant the team read access to the model?
easy- A.Grant the IAM role 'roles/aiplatform.admin' to the team members.
- B.Export the model as a local file and share it via a shared drive.
- ✓ C.Grant the IAM role 'roles/aiplatform.viewer' to the team members on the project.
- D.Add the team members to the Cloud Storage bucket ACL with 'READER' access.
Why C: The 'roles/aiplatform.viewer' IAM role grants read-only access to Vertex AI resources, including models in the Model Registry. Option A is incorrect because 'roles/aiplatform.admin' grants full administrative access, which is too broad for read-only needs. Option B is wrong because exporting the model and sharing via a shared drive bypasses version control and security best practices. Option D is incorrect because Cloud Storage bucket ACLs control access to the underlying bucket, not to the Vertex AI Model Registry; the model is managed through Vertex AI IAM.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PMLE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PMLE exam.