You are designing research AI infrastructure for a university computing facility that supports two distinct academic workloads:
A high-volume, 24/7 data extraction pipeline handling sensitive student records that are subject to strict data residency rules.
An intermittent, complex research workload requiring advanced multimodal reasoning over large context windows, with unpredictable usage spikes.
You need to minimize total operational expenditure and meet data governance requirements while satisfying the latency and capability needs of both workloads.
What should you do?

• A. Configure the managed Gemini API on Agent Platform for both workloads, enforcing VPC Service Controls and zero data retention to process all extraction and research requests.
• B. Deploy open-weight Gemma models on self-hosted Compute Engine GPU instances using Dynamic Workload Scheduler for both the 24/7 data extraction pipeline and the intermittent multimodal research workload.
• C. Use the managed Gemini API on Agent Platform for the 24/7 data extraction pipeline, and deploy an open-weight Gemma model on dedicated Google Kubernetes Engine (GKE) GPU nodes for the intermittent multimodal research workload.
• D. Deploy an open-weight Gemma model on Google Kubernetes Engine (GKE) in a private VPC for the 24
  /7 data extraction pipeline, and use the managed Gemini API on Agent Platform for the intermittent multimodal research workload.

You are evaluating a policy question-answering agent with an Agent Development Kit (ADK) eval set. Each case stores one reference answer, and the ADK eval suite scores responses using the ADK response_match_score criterion. Reviewers have been asked to evaluate the agent's responses and identify acceptable responses that cite the policy section and provide any exception applicable to the prompt.
However, reviewers cannot agree on which answer to store because several substantially different answers are acceptable.
You want ADK evaluations to assign a pass verdict to every response that meets both conditions and a fail verdict to the rest.
What should you do?

• A. Define evaluation rubrics, and score the responses using the ADK rubric_based_final_response_quality_v1 criterion.
• B. Store several reference answers in each ADK eval case.
• C. Score the cases using the ADK final_response_match_v2 criterion against the stored reference answer.
• D. Lower the response_match_score threshold that the ADK eval set requires to pass.

You are assessing a multitool customer support agent. In CI/CD, you find that changes in live API data cause unpredictable test failures, making it difficult to detect regressions in reasoning trajectories or tool selection.
You need to improve evaluation reliability in CI/CD and accurately validate the agent's behavior independently of shifts in live backend data.
What should you do?

• A. Configure exponential backoff retry policies, and increase timeout thresholds for live API calls during dataset evaluation runs in the gen AI evaluation service.
• B. Fetch real-time API responses into BigQuery before each test run, and dynamically update expected ground-truth answers in the golden dataset.
• C. Create mock tool cassettes to replay recorded API responses during test execution. Evaluate the agent's multistep tool call sequence using trajectory metrics in the gen AI evaluation service.
• D. Deploy a fine-tuned Gemini model to simulate external API responses at runtime, and evaluate agent responses against live production endpoints using exact string matching.

You are deploying a data analysis agent with a dedicated agent identity. The agent needs access to a specific Cloud Storage bucket containing financial data in the same project as the agent. You must ensure that the agent identity cannot access any other storage buckets, even if overly permissive project-wide IAM roles are accidentally granted.
What should you do?

• A. Attach a principal access boundary (PAB) IAM policy to the agent identity that provides access to only the required storage bucket.
• B. Apply IAM Conditions to the agent identity's IAM policy bindings, and restrict storage.objects.* permissions to resource names matching the designated financial bucket.
• C. Configure an IAM Deny policy on the organization node to block all service accounts from accessing the storage buckets.
• D. Configure a VPC Service Controls perimeter around the storage project, and define an ingress policy that permits Cloud Storage API operations only when invoked by the specific agent identity principal.