Responsible AI, Security and Model Armor — GCP Professional ML Engineer practice questions

VPC Service Controls protect against:

1. Volumetric DDoS attacks against public endpoints
2. Data exfiltration beyond a service perimeter
3. Logic bugs in training and serving source code
4. Slow query performance on large training datasets

Answer: B — Data exfiltration beyond a service perimeter

A) Cloud Armor handles volumetric attacks. B) Correct — VPC Service Controls draw a perimeter around services so ML data and models cannot be copied to projects outside it, even with valid credentials. C) Code defects are caught by review and testing. D) Performance is a tuning problem.

A model team needs explainability on online predictions. Best approach?

1. Compute SHAP values by hand in a separate offline batch job
2. Skip explanations, since the endpoint returns only the scores
3. Wait for the nightly batch job to produce the attributions
4. Enable managed explanations on the endpoint at deployment time

Answer: D — Enable managed explanations on the endpoint at deployment time

A) Reinventing a managed capability. D) Correct — attribution methods such as sampled Shapley, integrated gradients, or XRAI are configured when the model is deployed. C) A different stage. B) A compliance risk.

A regulator requires that training data and model artifacts cannot be copied to projects outside an approved boundary, even by users with valid credentials. The MOST appropriate control is:

1. A VPC Service Controls perimeter around approved projects
2. Customer-managed encryption keys on the storage buckets
3. Uniform bucket-level access on all data buckets
4. Organization-level audit logging with alerting on large reads

Answer: A — A VPC Service Controls perimeter around approved projects

A) Correct — a service perimeter constrains data movement across project boundaries regardless of the caller's IAM credentials, which is precisely the stated requirement. B) Customer-managed keys govern key control and revocation, not where authorized data may be copied. C) Uniform bucket-level access simplifies permission management within a bucket but does not stop cross-project egress. D) Audit logging detects exfiltration after it happens rather than preventing it.

A loan applicant must be told which factors drove their individual decline decision. Which explainability approach FITS best?

1. Global feature importance computed over the training set
2. A per-prediction attribution for that applicant's input
3. A partial dependence plot for the model's top three features
4. A confusion matrix broken down by applicant segment

Answer: B — A per-prediction attribution for that applicant's input

B) Correct — an individual adverse-action explanation requires local attribution for the specific input, not aggregate model behavior. A) Global importance describes the model overall and cannot justify one person's outcome. C) Partial dependence shows average marginal effects across the population, again not case-specific. D) A confusion matrix summarizes error rates and explains no individual decision.

Which item is LEAST appropriate to include in a model card intended for downstream consumers?

1. The intended use cases and documented out-of-scope uses
2. Evaluation results broken down by relevant subgroups
3. The service account credentials used by the training pipeline
4. Known limitations and the data the model was trained on

Answer: C — The service account credentials used by the training pipeline

C) Correct as the misfit — credentials are secrets and must never appear in documentation intended for distribution. A) Stating intended and out-of-scope uses is a core purpose of a model card. B) Subgroup results let consumers judge where the model is reliable. D) Limitations and training data provenance are standard and expected content.

Off-by-one framework: which method works for image attribution on a CNN?

1. Sampled Shapley over the flattened pixel values as features
2. ROUGE overlap between the prediction and a reference label
3. BLEU computed against a reference caption for the same image
4. Integrated Gradients or XRAI, which is optimized for image input

Answer: D — Integrated Gradients or XRAI, which is optimized for image input

A) Best suited to tabular features, not pixels. D) Correct — gradient-based attribution, with XRAI tuned for images. B/C) Natural-language evaluation metrics, not attribution methods.

Right feature wrong stage: bias monitoring belongs where?

1. During training only, using fairness evaluations across slices of the training set
2. Only at deployment, as a one-off review gate before the model serves traffic
3. Both: slice-level fairness at training and slice-level monitoring after deploy
4. Nowhere, since fairness is a policy matter rather than an engineering concern

Answer: C — Both: slice-level fairness at training and slice-level monitoring after deploy

C) The controlling idea is that bias is not a one-time property: the training-time evaluation establishes a baseline, and post-deployment slice monitoring catches populations that shift after release. A tempts because training is where fairness is usually measured, but a fair model can become unfair as inputs change. B tempts because a release gate feels decisive, yet a single check expires immediately. D tempts by deferring responsibility, which leaves the failure undetected.

A customer-facing assistant lets users paste arbitrary text that is appended to a system prompt. Which threat does this MOST directly create?

1. Prompt injection that overrides the assistant's instructions
2. Model inversion recovering memorized training examples
3. Data poisoning of the next scheduled training run
4. Denial of service from oversized request payloads

Answer: A — Prompt injection that overrides the assistant's instructions

A) Correct — concatenating untrusted text with trusted instructions is the structural condition for prompt injection, because the model cannot inherently distinguish the two. B) Inversion targets a model's memorized training data and is not what pasting instructions enables. C) Poisoning requires the input to reach a training corpus, which was not stated. D) Oversized payloads are a capacity concern handled by request limits, not the primary risk of untrusted instructions.

CMEK in Vertex AI?

Customer-Managed Encryption Keys — use your KMS keys for at-rest encryption. Compliance requirement for many industries.

Name the controls that enforce least privilege, network isolation and key control for an ML workload.

IAM with predefined or custom roles granted to per-purpose service accounts, so a training job cannot read production serving data and a pipeline runner holds only the roles its steps need • VPC Service Controls to draw a perimeter that blocks data exfiltration to projects outside it • CMEK so data at rest is encrypted with keys you manage and can revoke • Private Service Connect or private endpoints to keep traffic off the public internet.

Vertex Explainable AI?

Built-in SHAP, integrated gradients, sampled Shapley. Per-feature attribution to interpret predictions.

How do you detect bias in a model, and what does a feature attribution method add?

Evaluate metrics per protected or business-relevant slice rather than only in aggregate, and compare error rates across slices to expose harm that a global metric hides; also check the training data for representation gaps. Feature attributions (for example Shapley-based methods) explain which inputs drove a prediction, which surfaces reliance on a proxy variable and supports the case-level explanations that regulated decisions require.