An enterprise is centralizing sensitive customer transaction data from multiple business units into a shared BigQuery data warehouse. The data engineering and security teams must implement a robust security architecture that satisfies the following requirements: Data Exfiltration Mitigation: Prevent unauthorized movement, copying, or API-based access to the BigQuery datasets from outside the organization or across unapproved projects. Tenant & Regional Isolation: Ensure analysts can only query table rows that match their specific geographic region without creating and managing separate physical tables or authorized views for every team. Field-Level Confidentiality: Automatically mask sensitive columns (such as credit card numbers and credit limits) for standard analysts, while allowing authorized compliance officers with explicit fine-grained permissions to view the cleartext data. Which combination of Google Cloud security mechanisms should the team implement?

Enclose the BigQuery storage and compute projects within VPC Service Controls perimeters, define BigQuery Row-Level Security policies filtered by region, and implement policy tags with dynamic data masking and the Fine-Grained Reader role.: ### What the solution is This architecture combines **VPC Service Controls**, **BigQuery Row-Level Security (RLS)**, and **BigQuery Column-Level Security** using **Policy Tags** and **Dynamic Data Masking** to establish end-to-end context-aware security and fine-grained data access. ### How it meets each requirement - **Data Exfiltration Mitigation**: **VPC Service Controls** establishes a logical security perimeter around Google-managed BigQuery service APIs, blocking data egress, unauthorized copying, and API access originating from outside the perimeter or from unapproved projects/credentials. - **Tenant & Regional Isolation**: **BigQuery Row-Level Security** applies SQL filter predicates (e.g., `WHERE region = 'APAC'`) directly to the base table based on user group membership (`GRANT TO`), avoiding the operational maintenance and scaling limits of creating separate tables or hundreds of authorized views. - **Field-Level Confidentiality**: Categorizing sensitive fields with **Data Catalog policy tags** and attaching **Dynamic Data Masking rules** automatically redacts or obfuscates column values for general analysts during query runtime, while users granted the **Fine-Grained Reader** (`roles/datacatalog.categoryFineGrainedReader`) role can view unmasked cleartext values. ### Key advantages and capabilities - **Multi-layered defense**: Secures both the network/API transport layer (via perimeter isolation) and the data presentation layer (via column and row policies). - **Centralized governance**: Eliminates data duplication and schema divergence by maintaining a single unified fact table. - **Native runtime evaluation**: Masking and row filtering execute dynamically at query time without altering the underlying raw data storage. ### Why this is optimal This approach aligns with Google Cloud security best practices by enforcing the principle of least privilege, zero-trust network boundaries, and scalable fine-grained access controls without administrative overhead.

Bigquery Fine Grained Access Vpc Service Controls | professional-cloud-data-engineer

Bigquery Fine Grained Access Vpc Service Controls

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is centralizing sensitive customer transaction data from multiple business units into a shared BigQuery data warehouse. The data engineering and security teams must implement a robust security architecture that satisfies the following requirements:

Data Exfiltration Mitigation: Prevent unauthorized movement, copying, or API-based access to the BigQuery datasets from outside the organization or across unapproved projects.
Tenant & Regional Isolation: Ensure analysts can only query table rows that match their specific geographic region without creating and managing separate physical tables or authorized views for every team.
Field-Level Confidentiality: Automatically mask sensitive columns (such as credit card numbers and credit limits) for standard analysts, while allowing authorized compliance officers with explicit fine-grained permissions to view the cleartext data.

Which combination of Google Cloud security mechanisms should the team implement?

Establish IAM Conditions restricting dataset access based on request IP attributes, export partitioned data extracts to region-specific Cloud Storage buckets, and use Sensitive Data Protection to delete sensitive columns.

Configure VPC firewall egress rules targeting BigQuery endpoints, create materialized subset tables clustered by region, and apply client-side AEAD encryption to sensitive columns.

Deploy Private Google Access with Cloud Armor security policies, generate authorized views for each geographic region, and encrypt the entire dataset with Customer-Managed Encryption Keys (CMEK).

Enclose the BigQuery storage and compute projects within VPC Service Controls perimeters, define BigQuery Row-Level Security policies filtered by region, and implement policy tags with dynamic data masking and the Fine-Grained Reader role.

Professional Cloud Data Engineer

Bigquery Fine Grained Access Vpc Service Controls

Related questions