A multinational financial services enterprise wants to share curated market analytics datasets with external corporate partners using BigQuery sharing (Analytics Hub). The enterprise has established the following technical and governance requirements: The overarching data exchange must remain private to prevent unauthorized external browsing of the entire catalog. Specific curated dataset listings within the exchange must be made publicly discoverable across the BigQuery sharing catalog for any authenticated Google Cloud user. For regulatory audit and governance purposes, the security team must capture the principal identifiers of external users executing jobs and queries against the provisioned linked datasets. Once established, the audit identity tracking configuration must be immutable to prevent accidental administrative disabling. How should the data engineer configure the Analytics Hub environment?

Create the listing in a private data exchange, enable Public Discoverability by granting the Analytics Hub Viewer role (roles/analyticshub.viewer) to allAuthenticatedUsers, and enable the Subscriber Email Logging option during listing creation.: ### What Analytics Hub Listings and Subscriber Email Logging Are **BigQuery Analytics Hub** allows organizations to publish and subscribe to shared datasets across organization and project boundaries without data replication. An **Analytics Hub listing** packages a shared dataset and exposes it via a data exchange, enabling subscribers to provision read-only **linked datasets**. ### How It Meets the Requirements - **Private Exchange with Discoverable Listings**: Analytics Hub permission inheritance dictates that while publicly discoverable exchanges cannot contain private listings, **private data exchanges can host public listings**. By configuring a private exchange and enabling **Public Discoverability** on specific listings while granting `roles/analyticshub.viewer` to `allAuthenticatedUsers`, the enterprise keeps the broader exchange secured while making individual listings discoverable to authenticated Google Cloud accounts. - **Principal Identification**: Enabling **Subscriber Email Logging** automatically tracks the **principal identifiers** (email/subject) of subscribers running queries and jobs against the linked datasets. This metadata is populated in the `job_principal_subject` field of the `INFORMATION_SCHEMA.SHARED_DATASET_USAGE` view. - **Immutability**: Once **Subscriber Email Logging** is enabled and saved on a listing, Google Cloud enforces an immutable design: this setting cannot be toggled off or edited, fulfilling the compliance and security requirement. ### Key Advantages and Capabilities - **Granular Exposure**: Permits granular public discoverability within a secure, private organizational exchange framework. - **Built-in Compliance**: Provides native audit logs of external subscriber query activity directly via standard BigQuery `INFORMATION_SCHEMA` views. - **Tamper-Resistant Configuration**: Guarantees non-repudiation and prevents accidental disabling of audit logging without deleting and recreating the listing. ### Why This Is Optimal This solution leverages native Analytics Hub discovery permissions and built-in subscriber logging without requiring custom log ingestion pipelines or compromising the privacy of the primary data exchange.

Analytics Hub Private Exchange Public Listing Subscriber Logging | professional-cloud-data-engineer

Analytics Hub Private Exchange Public Listing Subscriber Logging

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational financial services enterprise wants to share curated market analytics datasets with external corporate partners using BigQuery sharing (Analytics Hub).

The enterprise has established the following technical and governance requirements:

The overarching data exchange must remain private to prevent unauthorized external browsing of the entire catalog.
Specific curated dataset listings within the exchange must be made publicly discoverable across the BigQuery sharing catalog for any authenticated Google Cloud user.
For regulatory audit and governance purposes, the security team must capture the principal identifiers of external users executing jobs and queries against the provisioned linked datasets.
Once established, the audit identity tracking configuration must be immutable to prevent accidental administrative disabling.

How should the data engineer configure the Analytics Hub environment?

Create a publicly discoverable data exchange, configure individual listings as private, and enable Cloud Audit Logs Data Read logging on the publisher BigQuery dataset.

Create the listing in a private data exchange, enable Public Discoverability by granting the Analytics Hub Viewer role (roles/analyticshub.viewer) to allAuthenticatedUsers, and enable the Subscriber Email Logging option during listing creation.

Create a private data exchange, keep the listings private, grant the BigQuery Data Viewer role directly to allAuthenticatedUsers on the source dataset, and configure VPC Service Controls egress rules.

Create a private data exchange, enable Public Discoverability on the listing, and deploy Datastream to capture and replicate subscriber query logs into a centralized security audit table.

Professional Cloud Data Engineer

Analytics Hub Private Exchange Public Listing Subscriber Logging

Related questions