How should you create a Vertex AI Workbench environment for your team and restrict access?

You are collaborating on a model prototype with your team. You need to create a Vertex AI Workbench environment for the members of your team and also limit access to other employees in your project. What should you do?

1. Create a new service account and grant it the Notebook Viewer role
1. Grant the Vertex AI User role to the default Compute Engine service account
1. Create a new service account and grant it the Vertex AI User role Source Reference Answer
1. Grant the Vertex AI User role to the primary team member

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam focuses on the principle of least privilege and using a dedicated service account so team members can impersonate it without granting broad project-wide permissions.

This PMLE exam question tests best practices for granting team access to Vertex AI Workbench while limiting other project employees. The community agrees that creating a dedicated service account with the Vertex AI User role is the correct approach.

Choosing option A (granting Notebook Viewer to a new service account) is the most common mistake because Notebook Viewer only lets users view notebooks, not actually use Vertex AI Workbench resources; the role lacks the necessary permissions to run workloads.

Community Discussion (5 comments)

fitri001 👍 1 Selected: C

1. Create a new service account and grant it the Vertex AI User role: This dedicated service account will control access to the Vertex AI Workbench environment. 2. Grant the Service Account User role to each team member on the service account: This grants your team members the ability to use the service account to access the Workbench environment. 3. Grant the Notebook Viewer role to each team member: While they can't modify notebooks, this role allows team members to view and run existing notebooks within the Workbench environment. 4. Provision a Vertex AI Workbench user-managed notebook instance that uses the new service account: By associating the instance with the service account, you ensure only authorized team members (through the service account) can access the environment.

guilhermebutzke 👍 2 Selected: C

My Answer: C This approach ensures that each team member has access to the necessary resources while limiting access to other employees not involved in the project. In A, the Notebook Viewer role is just to see, which is not sufficient for accessing Vertex AI resources. In B, This option grants permissions to the default Compute Engine service account, which may not be ideal for managing access to Vertex AI resources specifically. In D, This approach does not provide uniform access control for all team members and may lead to inconsistencies in resource management.

mindriddler 👍 1 Selected: C

Why not A? Mainly because of the fact that we're only giving the role "Notebook Viewer" to the SA, which is not sufficient.

b1a8fae 👍 1 Selected: A

A and C really sound like the same. Only going for A because I understand it gives the lowest level of permission role when creating the project (that is, all members in the Compute Engine Project); and subsequently, grants User role ONLY to the team members. https://cloud.google.com/iam/docs/overview#resource

pikachu007 👍 3 Selected: C

Dedicated Service Account: Creating a separate service account ensures isolation and control over access to Vertex AI resources. Vertex AI User Role: Granting this role to the service account provides it with necessary permissions to interact with Vertex AI services. Service Account User Role: Assigning this role to team members allows them to impersonate the service account, enabling them to use its permissions. Notebook Viewer Role: This role grants team members access to the notebook instance, but not direct Vertex AI resource management. User-Managed Notebook Instance: This type of instance uses a specific service account, ensuring access control is aligned with the designated service account's permissions.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option C is correct because it creates a new, dedicated service account and grants it the Vertex AI User role. This role provides the permissions needed to interact with Vertex AI resources, while the new service account keeps access isolated from other employees. Team members are then granted the Service Account User role on that service account, allowing them to impersonate it. Comments from users like 'Ded' emphasize that a dedicated service account ensures isolation and control over Vertex AI resources.

Why the Other Options Are Wrong

Option A grants only the Notebook Viewer role, which is insufficient for creating or using Vertex AI Workbench environments; it only allows viewing notebooks. Option B modifies the default Compute Engine service account, which is shared project-wide and lacks the isolation needed to limit access to specific team members. Option D grants Vertex AI User to the primary team member only, leaving other collaborators without access and failing to address project-level restriction.

Community Comment Notes

Commenter 'Ded' explains that a dedicated service account plus Vertex AI User role is the correct pattern, and highlights the need for the Service Account User role for team members to impersonate it. Commenter 'My Answer' points out that Option A is insufficient because Notebook Viewer is only for viewing. Commenter 'a' argues A and C sound similar, but the distinction is that C grants the required Vertex AI User role, while A only grants viewer-level access. The consensus vote clearly favors C.

Official Reference

Exam Strategy

Always check the exact IAM role name in the options. If the goal is to let users use a Workbench environment, look for the 'Vertex AI User' role and a dedicated service account, then remember to grant 'Service Account User' to team members separately.

Related Analysis

Practice All PMLE Questions

Access 65 questions with complete answers and detailed explanations.

View Full PMLE Practice Test →

← Back to PMLE Study Guide