The answer is creating a dedicated service account in the target project and granting it the roles/storage.objectViewer role on the specific Cloud Storage bucket. This approach is correct because it adheres to the principle of least privilege by limiting access strictly to reading model artifacts in the bucket, without exposing the bucket publicly or granting broader Vertex AI model resource permissions that would allow unnecessary actions like model deletion or deployment. On the Google Professional Machine Learning Engineer exam, this scenario tests your understanding of secure cross-project model artifact sharing using IAM best practices, often appearing as a trap where candidates mistakenly choose to share the bucket publicly or grant roles/storage.admin. A common memory tip is "SA in target, viewer on bucket" — always create the service account in the project that needs access, not the source project, and restrict its role to objectViewer for read-only artifact retrieval.
PMLE Collaborating to manage data and models Practice Question
This PMLE practice question tests your understanding of collaborating to manage data and models. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company trains models using Vertex AI Training and wants to share the resulting model artifacts with a different team in another Google Cloud project. What is the most secure way to grant access?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new service account in the other project, then grant it the 'roles/storage.objectViewer' role on the bucket.
Option D is correct because it follows the principle of least privilege and cross-project access best practices. By creating a dedicated service account in the target project and granting it the 'roles/storage.objectViewer' role on the specific Cloud Storage bucket, you avoid exposing the bucket publicly and avoid sharing the Vertex AI model resource directly, which would grant broader permissions than necessary. This approach ensures that only the service account can read the model artifacts, and the other team can use that service account to access the bucket securely.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use BigQuery to copy the model artifacts and share the BigQuery dataset.
Why it's wrong here
Model artifacts are not stored in BigQuery.
✗
Share the Vertex AI model resource directly by adding the other project's members to the IAM policy on the model.
Why it's wrong here
Vertex AI models cannot be directly accessed across projects; artifacts are in Cloud Storage.
✗
Set the Cloud Storage bucket containing the artifacts to 'public' access.
Why it's wrong here
Public access is a security risk.
✓
Create a new service account in the other project, then grant it the 'roles/storage.objectViewer' role on the bucket.
Why this is correct
Least privilege, secure cross-project access.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse sharing the Vertex AI model resource (which controls access to the model metadata and endpoint) with sharing the underlying artifacts in Cloud Storage, leading them to choose option B, which does not grant the necessary read access to the actual model files.
Detailed technical explanation
How to think about this question
Under the hood, Vertex AI model artifacts are stored as objects in a Cloud Storage bucket, and the Vertex AI model resource is a metadata pointer to those objects. When you grant the 'roles/storage.objectViewer' role to a service account, you are using Cloud Storage IAM to control read access at the bucket or object level. In a real-world scenario, the other team would authenticate using that service account's key or workload identity federation, ensuring that access is scoped and auditable via Cloud Audit Logs.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Collaborating to manage data and models — This question tests Collaborating to manage data and models — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a new service account in the other project, then grant it the 'roles/storage.objectViewer' role on the bucket. — Option D is correct because it follows the principle of least privilege and cross-project access best practices. By creating a dedicated service account in the target project and granting it the 'roles/storage.objectViewer' role on the specific Cloud Storage bucket, you avoid exposing the bucket publicly and avoid sharing the Vertex AI model resource directly, which would grant broader permissions than necessary. This approach ensures that only the service account can read the model artifacts, and the other team can use that service account to access the bucket securely.
What should I do if I get this PMLE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PMLE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PMLE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.