GCP Generative AI Leader Practice Question 13: Open Model Deployment Control
Google Cloud Generative AI Leader · Test 2 · question 3 of 10
A defense contractor's security committee will not approve any gen AI summarization tool whose model is reached as a shared, serverless third-party service. Its condition is that the model itself must run inside the contractor's own Google Cloud project and VPC network, where its security team controls the environment. The committee is otherwise happy with the quality of a mid-sized model and has cleared the licensing terms.
Which approach satisfies the committee's condition?
Show answer and explanation
Answer:
Google Cloud's documentation draws the line clearly: unlike model-as-a-service (MaaS) offerings, which are serverless and don't require manual deployment, self-deployed models run securely within your Google Cloud project and VPC network, giving you full control over the deployment environment. Open models, Gemma among them, are available for self-deployment on exactly those terms, provided you follow their licensing, which the committee has already cleared. Option D is the only one that moves the model itself inside the contractor's boundary.
- A is wrong because encryption keys protect data at rest and in transit; they don't change the fact that inference still happens on a shared, serverless managed endpoint. - B is wrong because a contractual retention promise is a legal control, not the technical isolation the committee demanded. The model is still outside the contractor's VPC. - C is wrong because tuning a proprietary model produces a private tuned version that is still served by the provider's managed infrastructure; you cannot export a proprietary model's weights and run it yourself.
Reference: Overview of self-deployed models