Objective 3.3

PCSE

Securing AI workloads

Objective 3.3 sits in Ensuring data protection, which carries 23% of the Cloud Security Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.

Objective title verbatim from the official objectives. Google Cloud exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

3-3Ensuring data protection

An engineer calls a Model Armor regional endpoint from inside a VPC network and gets certificate errors. What is missing from the network setup?

A Cloud NAT gateway on the calling subnetA gateway would give internet egress and change nothing about the certificate.
A DNS peering zone for the regional domainName resolution is not what the presented certificate depends on here.
A firewall rule allowing egress on port 443An allow rule would surface as a timeout rather than a certificate problem.
A Private Service Connect endpoint to the APIsCorrect · your answerCorrect. That endpoint is the required path.

Correct.

Concept

Private paths to a service present the certificate the private path was issued for. Reaching a regional name over a path built for the general one is what produces a mismatch rather than a refusal.

Why D

Reaching Model Armor regional endpoints from within a VPC network requires a Private Service Connect endpoint to the Model Armor APIs, which is what prevents certificate errors under Private Google Access or VPC Service Controls.

Source

To access Model Armor regional endpoints from within a VPC network, you must create a Private Service Connect endpoint to the Model Armor APIs. This is required to prevent certificate errors when regional endpoints are accessed using Private Google Access or VPC Service Controls.

Google Cloud: Model Armor overview, checked August 2026
#gcp#model-armor#private-service-connect#networking

Now you: objective 3.3 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

3-3Ensuring data protection

A team tuning a Model Armor template wants to disable every responsible AI filter for a research workload. Which one stays on regardless?

Sample question 2 of 3

3-3Ensuring data protection

A team needs Model Armor to redact detected identifiers rather than only report them, using their existing inspection templates. Which mode is required?

Sample question 3 of 3

3-3Ensuring data protection

An analyst is told to set the Low and above threshold on general content safety filters in production. What is the documented consequence?

Full Cloud Security Engineer question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Ensuring data protection