Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed instances are automatically kept up-to-date and that users cannot accidentally alter settings in the operating system. What should you do?
A.
Enable the VM Manager and ensure the corresponding Google Compute Engine instances are added.
B.
Enforce the disableRootAccess and requireAutoUpgradeSchedule organization policies for newly deployed instances.
C.
Assign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI Workbench Instances.
D.
Implement a firewall rule that prevents Secure Shell access to the corresponding Google Compute Engine instances by using tags.
To ensure that Vertex AI Workbench Instances (formerly AI Platform Notebooks) are automatically updated and that users cannot modify operating system settings, it's crucial to implement organizational policies that enforce these requirements.
disableRootAccess Organization Policy:This policy prevents users from obtaining root access on virtual machines. By enforcing this policy, you ensure that users cannot make unauthorized changes to the operating system settings, maintaining the integrity and security of the instances.
requireAutoUpgradeSchedule Organization Policy:This policy mandates that virtual machines have an auto-upgrade schedule for their operating systems. By enforcing this policy, you ensure that instances are automatically kept up-to-date with the latest security patches and updates, reducing the risk of vulnerabilities.
Given the options:
Option A: Enabling VM Manager helps in managing updates and configurations but does not inherently prevent users from altering OS settings.
Option B: Enforcing the disableRootAccess and requireAutoUpgradeSchedule organization policies directly addresses both requirements: preventing unauthorized OS modifications and ensuring automatic updates.
Option C: Assigning specific roles controls user permissions but does not enforce OS-level restrictions or automatic updates.
Option D: Implementing firewall rules to prevent SSH access adds a layer of security but does not ensure automatic updates or prevent OS modifications through other means.
Therefore, Option B is the most effective approach, as it directly enforces the necessary policies to meet both requirements.
[References:, Organization Policy Service, VM Manager Overview, , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit