Your organization stores customer transaction data in a centralized BigQuery table named sales.transactions. You need to securely share this table with three distinct user groups while enforcing the principle of least privilege: Finance Auditors: Must be able to query all rows and view sensitive payment identifiers (such as credit card numbers) in cleartext. Business Analysts: Must be able to query all rows, but sensitive payment identifiers must be dynamically masked (e.g., using a masking rule or hash) so that existing queries continue to run without exposing cleartext data. Regional Sales Managers: Must be restricted to querying only rows where region = 'EMEA', and payment identifiers must be masked. How should you configure access controls and data policies in Google Cloud to achieve these requirements?

Create a Data Catalog taxonomy with policy tags attached to the sensitive column. Grant Finance Auditors the Data Catalog Fine-Grained Reader role on the tag, attach a dynamic data policy with a masking rule to the tag and grant the BigQuery Masked Reader role to Business Analysts and Regional Sales Managers, and create a Row Access Policy on the table filtering on region for Regional Sales Managers.: ### What the solution is This solution combines **BigQuery Column-Level Access Control**, **Dynamic Data Masking (DDM)** via **Data Catalog policy tags**, and **Row-Level Security (RLS)** to enforce multi-layered, fine-grained access controls. ### How it meets the requirements - **Finance Auditors (Cleartext access on all rows)**: Granting the **Data Catalog Fine-Grained Reader** (`roles/datacatalog.categoryFineGrainedReader`) role on the taxonomy policy tag allows auditors to read the unmasked cleartext data in the tagged column across all rows. - **Business Analysts (Masked access on all rows)**: Creating a data policy with a masking rule on the policy tag and assigning analysts the **BigQuery Masked Reader** (`roles/bigquery.maskedReader`) role allows their queries to execute normally while dynamically returning obscured/masked values. - **Regional Sales Managers (Row filtering + Masked column)**: Defining a **Row Access Policy** (`CREATE ROW ACCESS POLICY ... FILTER USING (region = 'EMEA')`) restricts the returned rows to `EMEA`, while the assigned **BigQuery Masked Reader** role ensures that the payment identifier column in those permitted rows remains masked. ### Key advantages and capabilities - **Seamless query execution**: Queries written by analysts and sales managers do not require manual redaction logic or separate view definitions; BigQuery evaluates masking and row filtering dynamically at runtime. - **Centralized governance**: Data Catalog taxonomies allow policy tags and masking definitions to scale across multiple tables and datasets consistently. - **Composable security layers**: Column-level security, dynamic data masking, and row-level access policies natively coexist on the same base table without conflict. ### Why this is optimal This approach avoids data duplication, eliminates maintenance overhead associated with managing separate localized views or export tables, and natively enforces fine-grained authorization using standard Google Cloud IAM and BigQuery DDL policies.

Configure Bigquery Fine Grained Access Masking Rls | professional-cloud-data-engineer

Configure Bigquery Fine Grained Access Masking Rls

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization stores customer transaction data in a centralized BigQuery table named sales.transactions. You need to securely share this table with three distinct user groups while enforcing the principle of least privilege:

Finance Auditors: Must be able to query all rows and view sensitive payment identifiers (such as credit card numbers) in cleartext.
Business Analysts: Must be able to query all rows, but sensitive payment identifiers must be dynamically masked (e.g., using a masking rule or hash) so that existing queries continue to run without exposing cleartext data.
Regional Sales Managers: Must be restricted to querying only rows where region = 'EMEA', and payment identifiers must be masked.

How should you configure access controls and data policies in Google Cloud to achieve these requirements?

Create a Data Catalog taxonomy with policy tags attached to the sensitive column. Grant Finance Auditors the Data Catalog Fine-Grained Reader role on the tag, attach a dynamic data policy with a masking rule to the tag and grant the BigQuery Masked Reader role to Business Analysts and Regional Sales Managers, and create a Row Access Policy on the table filtering on region for Regional Sales Managers.

Use Sensitive Data Protection (Cloud DLP) to tokenize the entire table before loading it into BigQuery, store the cryptographic keys in Cloud KMS, and grant Cloud KMS CryptoKey Decrypter permissions only to the Finance Auditors.

Create separate authorized logical views for each user group in dedicated datasets, embedding custom SHA-256 SQL masking expressions and WHERE clauses, and grant table-level BigQuery Data Viewer permissions on each view.

Assign the BigQuery Admin role to Finance Auditors, create an authorized materialized view for Business Analysts with masked columns, and configure IAM Conditions on table-level access for Regional Sales Managers.

Professional Cloud Data Engineer

Configure Bigquery Fine Grained Access Masking Rls

Related questions