A financial enterprise uses Google Cloud to store sensitive transactional records in a centralized BigQuery dataset. The organization plans to share specific aggregated metrics and filtered record subsets with external partner organizations through BigQuery Analytics Hub while enforcing strict governance and least-privilege access. The security architecture must satisfy the following requirements: Prevent unauthorized exfiltration of raw underlying records while allowing partner data analysts to query curated subsets. Enforce column-level data masking on Personally Identifiable Information (PII) and row-level access control based on partner tenant IDs. Ensure partner subscribers can discover listings, create linked datasets within their own perimeter, and run analytics without direct read permissions on the primary source tables. Which combination of Identity and Access Management (IAM) and BigQuery governance mechanisms should you implement?

Publish an Analytics Hub listing based on authorized views or dynamic row- and column-level security policies; assign the BigQuery Data Viewer role on the shared listing to partner subscribers while restricting source dataset access to publisher administrators.: ### What the Solution Is This architecture leverages **BigQuery Analytics Hub** combined with native BigQuery security primitives—specifically **authorized views**, **row-level security (RLS)**, and **column-level policy tags** with dynamic data masking—to distribute governed data without exposing raw underlying storage. ### How It Meets the Requirements * **Prevent Unauthorized Exfiltration**: By publishing curated listings powered by **authorized views** or applying fine-grained **row-level access control**, subscribers only access computed or filtered data. Subscribers do not require direct read permissions on the source tables, ensuring raw transactional records remain isolated. * **Column-Level and Row-Level Security**: Policy tags managed via Dataplex/Cloud Data Catalog enforce dynamic column masking on sensitive **PII fields**, while row-level filter expressions (`row_access_policies`) partition visibility by `partner_tenant_id` at query runtime. * **Subscriber Access & Analytics**: Granting partner subscriber principals the **BigQuery Data Viewer** (`roles/bigquery.dataViewer`) role and subscription permissions on the Analytics Hub listing allows them to discover the listing and provision a **linked dataset** inside their own project without granting IAM access to the provider's upstream datasets. ### Key Advantages and Capabilities * **Decoupled Compute Billing**: Queries executed by partner subscribers against linked datasets consume compute resources and query slots within the subscriber's project. * **Centralized Policy Enforcement**: Data masking and row filters apply dynamically regardless of whether access occurs internally or via Analytics Hub linked datasets. * **Least Privilege Access**: The publisher retains complete control over dataset schemas, IAM permissions, and access grants without managing external IAM identities across underlying storage tables. * **No Data Duplication**: Linked datasets provide real-time, zero-copy access to source updates without running custom scheduled replication pipelines. ### Why This Is Optimal This pattern adheres to Google Cloud security best practices by combining resource-level IAM boundaries with granular database engine security (column masking and row-level filtering). It prevents data replication drift while securing sensitive multi-tenant financial data under strict perimeter controls.

Bigquery Analytics Hub Iam Governance Security | professional-cloud-data-engineer

Bigquery Analytics Hub Iam Governance Security

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise uses Google Cloud to store sensitive transactional records in a centralized BigQuery dataset. The organization plans to share specific aggregated metrics and filtered record subsets with external partner organizations through BigQuery Analytics Hub while enforcing strict governance and least-privilege access.

The security architecture must satisfy the following requirements:

Prevent unauthorized exfiltration of raw underlying records while allowing partner data analysts to query curated subsets.
Enforce column-level data masking on Personally Identifiable Information (PII) and row-level access control based on partner tenant IDs.
Ensure partner subscribers can discover listings, create linked datasets within their own perimeter, and run analytics without direct read permissions on the primary source tables.

Which combination of Identity and Access Management (IAM) and BigQuery governance mechanisms should you implement?

Grant the partner subscribers the BigQuery Admin role on the publisher's project and create external tables linked directly to Cloud Storage buckets protected by customer-managed encryption keys (CMEK).

Publish an Analytics Hub listing based on authorized views or dynamic row- and column-level security policies; assign the BigQuery Data Viewer role on the shared listing to partner subscribers while restricting source dataset access to publisher administrators.

Grant partner subscribers the BigQuery Data Editor role directly on the raw transactional dataset and deploy VPC Service Controls perimeters with open ingress and egress rules.

Assign the BigQuery Data Owner role to external subscribers on the primary dataset and configure Dataplex auto data quality scans to redact PII at query execution time.

Professional Cloud Data Engineer

Bigquery Analytics Hub Iam Governance Security

Related questions