GCP Professional ML Engineer Practice Question 17: Private Service Connect Endpoint
Google Cloud Professional Machine Learning Engineer · Test 2 · question 7 of 10
A custom-trained underwriting model must be callable from application VPC networks in three different consumer projects. Security has ruled that inference traffic must never traverse a public IP address or the public internet, the team does not want to negotiate a non-overlapping peered IP range with each consumer project, and the underwriting calls are latency sensitive.
Which serving configuration satisfies these constraints?
Show answer and explanation
Answer:
Private Service Connect dedicated private endpoints are documented as the way to serve online inference from a custom-trained model "to multiple consumer projects and VPC networks without the need for public IP addresses, public internet access, or an explicitly peered internal IP address range." Each consumer VPC network gets a forwarding rule that sends traffic to the service attachment exposing the endpoint, and Google recommends the pattern for use cases that require private, secure, low-latency connections and do not need to be publicly accessible, all three constraints here (option D).
- A is wrong because a shared public endpoint still resolves to a public address. IAM and a service perimeter control who may call it and where data may move, not whether the request path is private. - B is wrong because an internal load balancer in the consumer network still has to reach the public endpoint to forward the request, so the traffic leaves the private path anyway, and it adds a hop to a latency-sensitive call. - C is wrong because peering is exactly what the team ruled out: it requires an explicitly reserved, non-overlapping IP range negotiated with each of the three consumer projects.
Reference: Use dedicated private endpoints based on Private Service Connect for online inference