An enterprise is migrating its sensitive analytics data warehouse to BigQuery. Under regulatory compliance standards and the cloud shared responsibility model, the organization must enforce strict data ownership and least privilege access governance: The internal Data Governance team must maintain full ownership and administrative control over BigQuery datasets (including managing dataset-level permissions, updating metadata, and deleting datasets) without possessing broad project-level infrastructure permissions. Business analysts require permissions to run analytical queries and inspect dataset contents without modifying schemas, changing dataset access permissions, or deleting tables. Automated data pipelines and ingestion services must operate securely using dedicated service identities without granting service agent roles to regular user accounts. Which Identity and Access Management (IAM) role configuration should the organization implement?

Grant the Data Governance team the BigQuery Data Owner (`roles/bigquery.dataOwner`) role, grant business analysts the BigQuery Data Viewer (`roles/bigquery.dataViewer`) and BigQuery Job User (`roles/bigquery.jobUser`) roles, and maintain service agent roles strictly for Google-managed service agents.: ### What BigQuery Predefined IAM Roles and Service Agent Controls Are **BigQuery predefined IAM roles** provide granular access control specifically tailored to data assets, separating administrative duties from analytical querying tasks. The **BigQuery Data Owner** (`roles/bigquery.dataOwner`) role gives full control over dataset configuration, data contents, and access permissions at the dataset level without granting broad Google Cloud project-level permissions like `roles/owner` or `roles/editor`. ### How It Meets the Requirements - **Data Governance Authority**: Granting `roles/bigquery.dataOwner` allows the governance team to read, update, create, and delete tables and datasets, as well as configure access control lists (ACLs) on datasets, ensuring complete data ownership and authority. - **Business Analyst Least Privilege**: Granting `roles/bigquery.dataViewer` enables analysts to view dataset contents and schemas, while `roles/bigquery.jobUser` provides the required permissions to execute query jobs and spend project query slots without giving table modification rights. - **Service Identity Security**: Reserving **service agent roles** exclusively for Google-managed service agents prevents privilege escalation and upholds organizational security boundaries. ### Key Advantages - **Granular Least Privilege**: Separates data asset ownership and administration from project infrastructure administration. - **Dataset-Level Scoping**: Allows permissions to be applied specifically at the dataset level rather than across the entire cloud project. - **Compliance Alignment**: Satisfies shared responsibility requirements by maintaining clear organizational accountability over sensitive data access. - **Separation of Duties**: Keeps query execution privileges (`roles/bigquery.jobUser`) distinct from data viewing privileges (`roles/bigquery.dataViewer`). ### Why This Is Optimal This configuration aligns perfectly with the shared responsibility model. It establishes precise data governance boundaries while preventing over-privileged access across cloud analytics resources.

StudyCerts

Bigquery Data Ownership Iam Shared Responsibility | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Bigquery Data Ownership Iam Shared Responsibility

Section: Legislation and regulation (e.g., health record privacy, children’s privacy, data privacy, ownership, and data sovereignty)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is migrating its sensitive analytics data warehouse to BigQuery. Under regulatory compliance standards and the cloud shared responsibility model, the organization must enforce strict data ownership and least privilege access governance:

The internal Data Governance team must maintain full ownership and administrative control over BigQuery datasets (including managing dataset-level permissions, updating metadata, and deleting datasets) without possessing broad project-level infrastructure permissions.
Business analysts require permissions to run analytical queries and inspect dataset contents without modifying schemas, changing dataset access permissions, or deleting tables.
Automated data pipelines and ingestion services must operate securely using dedicated service identities without granting service agent roles to regular user accounts.

Which Identity and Access Management (IAM) role configuration should the organization implement?

Grant the Data Governance team the basic Project Editor (roles/editor) role, grant business analysts the BigQuery Studio Admin (roles/bigquery.studioAdmin) role, and assign Cloud Data Fusion Service Agent roles to pipeline runners.

Grant the Data Governance team the BigQuery Data Owner (roles/bigquery.dataOwner) role, grant business analysts the BigQuery Data Viewer (roles/bigquery.dataViewer) and BigQuery Job User (roles/bigquery.jobUser) roles, and maintain service agent roles strictly for Google-managed service agents.

Grant the Data Governance team the BigQuery Admin (roles/bigquery.admin) role at the project level, grant business analysts the Dataplex Storage Data Owner (roles/dataplex.storageDataOwner) role, and grant custom users the DLP API Service Agent role.

Grant the Data Governance team the BigQuery Data Editor (roles/bigquery.dataEditor) role, grant business analysts the BigQuery User (roles/bigquery.user) role, and grant the Cloud Dataflow Service Agent role to the analytics team service account.

Professional Cloud Architect

Bigquery Data Ownership Iam Shared Responsibility

Related questions