A Vertex AI deployment requires detective and preventative guardrails; how should you secure this environment?

• A. Implement Assured Workloads with a folder and relevant control package.
• B. Implement preconfigured and custom organization policies applied to the folder.
• C. Create a policy bundle using Rego and implement via Workload Manager scoped to the folder.
• D. Create a posture consisting of predefined and custom organization policies and predefined and SHA custom modules scoped to the business unit folder.

Answer: (D)

Securing Vertex AI with both preventative and detective guardrails at scale is most effective when you establish a posture that combines predefined and custom organization policies with predefined and custom policy modules, all scoped to the business unit folder. Organization policies impose preventative constraints across the resource hierarchy, stopping misconfigurations before they happen. Policy modules encode reusable, rule-based logic that can be evaluated dynamically to detect and enforce compliance across resources; having both predefined (out-of-the-box) and custom modules lets you cover common best practices while tailoring rules to your specific Vertex AI needs. By scoping this posture to the business unit folder, every project and resource under that folder inherits these guardrails, ensuring consistent enforcement as new deployments occur. This approach provides comprehensive coverage: strong preventative controls plus scalable, reusable detective checks, aligned with the organizational structure.

Options focusing only on Assured Workloads or only on organization policies without modules miss either the breadth of guardrails or the scalability and specificity of reusable policy logic. A policy bundle with Rego via a Workload Manager is less clearly integrated into the standard posture framework and may not offer the same seamless folder-scoped, multi-layer enforcement.