Question 330
A customer analytics bot tries to query another business unit's restricted BigQuery dataset. Which AI choice or business response BEST addresses the primary requirement?
Explanation
Correct Answer
Apply Google Cloud IAM and service identity least privilege to models, connectors, data stores and tool actions, with separate approvals for sensitive changes. This approach directly addresses the decision boundary. IAM is a server-enforced authorization control; natural-language instructions to a model cannot replace it. Validate key assumptions using: Inspect principals, granted roles, data access, service accounts, audit logs and separation-of-duties policies. Scenario: A customer analytics bot tries to query another business unit's restricted BigQuery dataset.
Incorrect Answers
Monitor deployed generative AI with reproducible evaluations, task KPIs, version records and drift or incident tracking, not only subjective user praise. This response is aimed at Model monitoring versioning and quality KPIs, not the controlling requirement here. Foundation-model updates and data drift can change outcomes; continuous monitoring must include both technical and business indicators. The targeted response is: Apply Google Cloud IAM and service identity least privilege to models, connectors, data stores and tool actions, with separate approvals for sensitive changes. Scenario: A customer analytics bot tries to query another business unit's restricted BigQuery dataset.
Use Security Command Center and suitable operational monitoring to surface cloud security posture and findings, then assign remediation and verify fixes. This response is aimed at Security Command Center and workload monitoring, not the controlling requirement here. Security tools aid detection and prioritization; deploying a dashboard does not automatically harden an exposed AI workload. The targeted response is: Apply Google Cloud IAM and service identity least privilege to models, connectors, data stores and tool actions, with separate approvals for sensitive changes. Scenario: A customer analytics bot tries to query another business unit's restricted BigQuery dataset.
Minimize personal data supplied to AI systems, and distinguish anonymization from reversible pseudonymization when designing enterprise data flows. This response is aimed at Privacy minimization anonymization and pseudonymization, not the controlling requirement here. Pseudonymized data can still identify people when linked with other records; privacy cannot be asserted merely because names were hidden. The targeted response is: Apply Google Cloud IAM and service identity least privilege to models, connectors, data stores and tool actions, with separate approvals for sensitive changes. Scenario: A customer analytics bot tries to query another business unit's restricted BigQuery dataset.


