Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed Instances are automatically kept up-to-date and that users cannot accidentally alter settings in the…

Question

Options

• AEnforce the disableRootAccesa and requireAutoUpgradeSchedule organization policies for newly
• BEnable the VM Manager and ensure the corresponding Google Compute Engine instances are
• CImplement a firewall rule that prevents Secure Shell access to the corresponding Google
• DAssign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI

• A
  70% (32)
• B
  4% (2)
• C
  17% (8)
• D
  9% (4)

Explanation

Option A is correct because Vertex AI Workbench supports Organization Policy constraints specifically designed for this scenario: disableRootAccess prevents users from modifying the OS as root (protecting settings from accidental alteration), and requireAutoUpgradeSchedule enforces automatic upgrades to keep instances current - both applied at the org level so they govern all newly deployed instances automatically.

Option B is wrong because VM Manager handles patch management for general Compute Engine VMs, but Vertex AI Workbench has its own built-in upgrade mechanism; VM Manager is not the intended tool here and doesn't address the root access concern.

Option C is wrong because blocking SSH via firewall is an overly blunt security measure that would break legitimate workflows, and it doesn't prevent root-level OS changes from within the instance or enforce auto-upgrades.

Option D is wrong because IAM roles like AI Notebooks Runner/Viewer control what users can do with the notebook resource (start, stop, view), not OS-level access or automatic upgrade behavior.

Memory tip: Think "policy = platform-wide enforcement." When a question asks you to automatically apply a behavior to all newly deployed resources and prevent user tampering, reach for Organization Policies - they are declarative guardrails applied before a resource is even usable, unlike IAM roles, firewall rules, or VM tooling which operate after the fact.

No community discussion yet for this question.