Overview
Monitoring AI solutions has two official objectives. Task 6.1 covers identifying risks: protecting against unintended data or model exposure, such as data exfiltration, malicious prompts and sensitive data sent to LLMs, with tools like regular expressions, safety filters and Model Armor; following responsible AI practices including bias monitoring; and using explainability features on Agent Platform. Task 6.2 covers monitoring, testing and troubleshooting: configuring Model Monitoring with continuous evaluation metrics, watching for training-serving skew, data drift, concept drift and feature attribution drift, and evaluating generative AI solutions in production.
At about 13% of the exam, this section ties with Section 1 as the smallest. Its gen AI security content, especially Model Armor, is new in the June 2026 guide.
How it's tested
Domain 6 questions describe a symptom in production or a risk before launch. A model's accuracy fell, feature distributions moved, a chatbot leaked data, or a regulator wants explanations. You identify the type of problem and choose the monitoring setting, protection tool or explainability method that addresses it.
-
Name the change
Production behavior differs from training, and you decide whether it is training-serving skew, data drift, concept drift or attribution drift.
-
Block the risk
A gen AI app faces prompt injection, harmful output or sensitive data exposure, and you choose Model Armor, safety filters or data controls.
-
Explain or audit
Stakeholders need reasons for predictions or evidence of fairness, and you pick feature attributions, example-based explanations or bias metrics.
A pricing model's input distributions look unchanged since launch, yet its error has doubled because competitors changed their prices. Training-serving skew is unlikely since serving inputs match training. Data drift would show shifted inputs. The relationship between inputs and the target has changed, which is concept drift, so retraining on recent labeled data is the expected response.
Objectives 2
Official objectives from the Google Cloud outline, in outline order.
6.1 Identifying risks to AI solutionsPreventing data and model exposure, malicious prompts and sensitive data leaks, responsible AI with bias monitoring, and explainability on Agent Platform.
- What it means
- This task covers finding and reducing risk before and after deployment. You protect against unintended exposure of data or models, including data exfiltration, malicious prompts and sensitive data sent to LLMs, using regular expressions, safety filters and Model Armor. You also follow responsible AI practices such as bias monitoring and use Agent Platform explainability features.
- What to understand
- Model Armor screens prompts and responses for prompt injection, jailbreak attempts, sensitive data and harmful content, and can sit in front of any model. Gemini safety filters block categories such as hate or dangerous content at configurable thresholds. Simple regex checks catch known patterns like card numbers, while Sensitive Data Protection handles broader detection. VPC Service Controls and IAM reduce exfiltration risk. Responsible AI work includes checking performance across groups and tracking fairness metrics over time. Explainable AI on Agent Platform offers feature attributions using sampled Shapley or integrated gradients, plus example-based explanations.
- How it shows up
- A security, fairness or transparency risk is described, and you choose the protection, monitoring or explanation feature that addresses it.
- Common confusion
- Thinking safety filters stop prompt injection; they target harmful content categories, while Model Armor screens injection and jailbreak attempts.
6.2 Monitoring, testing, and troubleshooting AI solutionsModel Monitoring with continuous evaluation, skew and drift types, and monitoring and evaluating generative AI solutions.
- What it means
- This task covers keeping production models healthy. You configure Model Monitoring to set continuous evaluation metrics, watch for training-serving skew, data drift, concept drift and feature attribution drift, and monitor, test and evaluate generative AI solutions over time.
- What to understand
- Training-serving skew means serving inputs differ from training data, often from a preprocessing mismatch. Data drift means serving inputs shift over time. Concept drift means the relationship between inputs and the label changes, which only shows when ground truth arrives. Feature attribution drift means the features driving predictions change even if inputs look stable. Model Monitoring compares serving data with a training baseline or earlier windows, alerts on thresholds and can feed retraining. For gen AI, sample production prompts and responses, score them with the Gen AI evaluation service, and track groundedness, safety and user feedback.
- How it shows up
- A production symptom is given, and you identify its cause and the monitoring setting or fix that applies.
- Common confusion
- Calling every performance drop data drift, when unchanged inputs with a falling metric point to concept drift.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Model Armor
Screens prompts and responses for injection, jailbreaks, sensitive data and harmful content.
- Remember
- Works in front of any model.
- Tested as
- Gen AI security questions.
- Trap
- Relying only on model safety settings.
-
Safety filters
Configurable thresholds that block harmful content categories in Gemini.
- Remember
- Category-based content blocking.
- Tested as
- Harmful output questions.
- Trap
- Expecting them to catch prompt injection.
-
Prompt injection
Input crafted to override a model's instructions.
- Remember
- Can be direct or hidden in retrieved content.
- Tested as
- Gen AI risk questions.
- Trap
- Assuming system prompts alone prevent it.
-
Data exfiltration controls
VPC Service Controls, IAM and private endpoints.
- Remember
- Limit where data and models can move.
- Tested as
- Exposure risk questions.
- Trap
- Treating encryption alone as enough.
-
Bias monitoring
Tracking performance and outcomes across groups.
- Remember
- Fairness can change after launch.
- Tested as
- Responsible AI questions.
- Trap
- Checking fairness only once before launch.
-
Feature attributions
Explainable AI scores showing each feature's effect on a prediction.
- Remember
- Sampled Shapley and integrated gradients.
- Tested as
- Explainability questions.
- Trap
- Using the wrong method for the model type.
-
Example-based explanations
Returns similar training examples for a prediction.
- Remember
- Helps spot mislabeled or missing data.
- Tested as
- Explainability questions.
- Trap
- Confusing them with feature importance.
-
Training-serving skew
Serving inputs differ from training data.
- Remember
- Often a preprocessing mismatch.
- Tested as
- Monitoring questions.
- Trap
- Calling it drift.
-
Data drift
Serving input distributions shift over time.
- Remember
- Detected without labels.
- Tested as
- Monitoring questions.
- Trap
- Ignoring it because accuracy looks fine so far.
-
Concept drift
The input-to-label relationship changes.
- Remember
- Needs ground truth to confirm.
- Tested as
- Troubleshooting questions.
- Trap
- Expecting input monitoring to reveal it.
-
Feature attribution drift
Change in which features drive predictions.
- Remember
- Can appear before accuracy drops.
- Tested as
- Model Monitoring questions.
- Trap
- Monitoring only raw input distributions.
-
Model Monitoring
Agent Platform service comparing serving data with baselines and alerting.
- Remember
- Set thresholds, sampling and alert channels.
- Tested as
- Configuration questions.
- Trap
- Setting it up without a baseline.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Types of production change
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Training-serving skew | Serving data differs from training data. | Compares serving with the training set. | Fixing it by retraining instead of fixing preprocessing. |
| Data drift | Serving data changes over time. | Compares recent serving windows. | Treating every drift as harmful. |
| Concept drift | Same inputs now map to different outcomes. | Seen through labels, not inputs. | Looking only at input distributions. |
| Feature attribution drift | Feature importance shifts. | Watches model reasoning, not raw data. | Ignoring it while accuracy holds. |
Gen AI protections
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Model Armor | Prompt and response screening service. | Covers injection, jailbreaks and sensitive data. | Assuming it replaces access controls. |
| Safety filters | Content category thresholds. | Blocks harmful content types. | Expecting data loss prevention. |
| Regex checks | Pattern matching on text. | Cheap for known formats. | Relying on it for unknown patterns. |
Explanation methods
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Sampled Shapley | Attribution by sampling feature combinations. | Works for non-differentiable models such as trees. | Using integrated gradients on trees. |
| Integrated gradients | Gradient-based attribution. | Efficient for differentiable models like neural networks. | Applying it to non-differentiable models. |
| Example-based | Nearest training examples. | Shows similar cases, not feature weights. | Reading it as feature importance. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Retrain to fix skew
- What candidates pick
- Retrain the model on recent data
- Why it looks right
- Retraining feels like the universal fix.
- Why it's wrong
- Skew from a serving preprocessing bug persists after retraining; fix the inconsistent transformation.
Clue to watch for Serving inputs differ from training right after launch.
-
Safety filters for injection
- What candidates pick
- Raise Gemini safety filter thresholds
- Why it looks right
- Safety settings sound protective.
- Why it's wrong
- Safety filters block harmful content categories, while Model Armor detects injection and jailbreak attempts.
Clue to watch for Users try to override system instructions.
-
Input monitoring for concept drift
- What candidates pick
- Watch feature distributions to catch the decline
- Why it looks right
- Drift monitoring is the standard tool.
- Why it's wrong
- Concept drift can occur with unchanged inputs; you need ground-truth labels to measure it.
Clue to watch for Inputs stable but error rising.
-
Integrated gradients for trees
- What candidates pick
- Use integrated gradients on a boosted tree model
- Why it looks right
- It is a well-known attribution method.
- Why it's wrong
- Integrated gradients need a differentiable model; sampled Shapley suits tree ensembles.
Clue to watch for Non-differentiable model type.
-
Encryption stops leaks
- What candidates pick
- Enable customer-managed encryption keys
- Why it looks right
- Encryption protects data.
- Why it's wrong
- Encryption does not stop authorized users or services copying data out; VPC Service Controls limit exfiltration.
Clue to watch for Concern is data leaving the perimeter.
-
One-time bias check
- What candidates pick
- Run a fairness review before launch only
- Why it looks right
- It satisfies the launch checklist.
- Why it's wrong
- Population and data shift after launch, so fairness must be monitored over time.
Clue to watch for Ongoing responsible AI requirement.
Answer framework
Use these steps to diagnose a production problem or close a risk in an AI solution.
- Classify the issue first: security exposure, harmful output, unfairness, missing explanation, or declining quality, because each points to a different tool.
- For gen AI exposure, place Model Armor in front of the model, tune safety filters, and limit data movement with IAM and VPC Service Controls.
- For transparency, pick sampled Shapley for trees, integrated gradients for neural networks, or example-based explanations to inspect similar cases.
- For quality decline, compare serving data with training to find skew, with recent windows to find drift, and with labels to confirm concept drift.
- Set Model Monitoring thresholds and alerts, evaluate gen AI responses on a sample, and route confirmed issues to fixes or retraining.
Practice question
Want more like this? The GCP PMLE practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with vocabulary, because many questions turn on naming the problem correctly. Write a definition and a one-line example for training-serving skew, data drift, concept drift and feature attribution drift, along with how each is detected. Then set up Model Monitoring on a small deployed model, choose a training baseline and alert thresholds, and send skewed test requests to see an alert.
Next, cover gen AI risk. Read the Model Armor overview and the Gemini safety settings page, and list which risks each one addresses. Add notes on VPC Service Controls and IAM for exfiltration. For explainability, read the Explainable AI overview and match each attribution method to model types.
As this section is about 13% of the exam, two focused study sessions plus practice questions are usually enough. Tie it back to Section 5 by asking, for each monitoring alert, what should happen next: a code fix, retraining or rollback. That link appears often in scenario questions.
FAQ
How much of the GCP PMLE exam is Monitoring AI solutions?
Monitoring AI solutions is about 13% of the exam, tied for smallest with Section 1, so expect around seven or eight questions.
What is Model Armor?
A Google Cloud service that screens prompts and model responses for prompt injection, jailbreaks, sensitive data and harmful content before they pass through.
What is the difference between skew and drift?
Skew compares serving data with training data; drift compares serving data over time. Skew often signals a preprocessing bug, drift a changing world.
How is concept drift detected?
By comparing predictions with ground-truth labels as they arrive, since input distributions may not change at all.
Which explanation method should I use for a tree model?
Sampled Shapley, because integrated gradients needs a differentiable model such as a neural network.
How are gen AI solutions monitored?
Sample production prompts and responses, score them with the Gen AI evaluation service for quality, groundedness and safety, and track user feedback.
Other Artificial Intelligence & Machine Learning certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 6 knowledge
You have studied AI risks, explainability and production monitoring. Test whether you can diagnose skew and drift and pick the right protection in exam-style questions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the GCP PMLE AI tutor Get any concept explained your way