Your organization manages a BigQuery dataset containing a customer transactions table with sensitive Personally Identifiable Information (PII), including columns for tax_id, email_address, and credit_card_number. You are preparing this data for enterprise-wide visualization and reporting. You have the following security and access requirements: BI Analysts must be able to query the table to build dashboards and perform aggregations, but must only receive real-time obfuscated (masked) values for sensitive columns. Compliance Auditors must be able to inspect and view the unmasked, cleartext values of these sensitive columns. Unauthorized Users without explicit permissions must be blocked from querying the sensitive columns entirely. The security controls must be centrally managed and applied dynamically at query runtime without maintaining duplicate tables, views, or ETL pipelines. Which solution should you implement?

Create a taxonomy with policy tags in Dataplex and associate dynamic data masking rules with the tags. Attach the policy tags to the sensitive columns in BigQuery. Grant Compliance Auditors the Fine-Grained Reader role on the policy tags, and grant BI Analysts the Masked Reader role on the policy tags.: ### What Dataplex Policy Tags and Dynamic Data Masking Are **Dataplex policy tags** (managed via the Dataplex taxonomy and Data Catalog catalog services) provide a centralized way to enforce **column-level access control** and **dynamic data masking** across BigQuery tables. By defining hierarchical taxonomies and assigning masking rules (such as SHA-256 hashing, default masking values, email masking, or nullification) directly to policy tags, organizations can manage data protection policies independently of the underlying table schemas. ### How It Meets the Requirements - **Real-time obfuscation for BI Analysts**: Attaching a masking rule to a policy tag and granting the `roles/bigquery.maskedReader` (or `roles/datacatalog.maskedReader`) role allows BI analysts to execute queries against the dataset while BigQuery dynamically transforms sensitive column values into masked representations at query runtime. - **Cleartext access for Compliance Auditors**: Compliance auditors are assigned the `roles/datacatalog.categoryFineGrainedReader` role on the specific policy tags. This permission overrides the masking rules and allows authorized identities to view the raw, cleartext values. - **Blocked access for Unauthorized Users**: If a user has `roles/bigquery.dataViewer` on the table but lacks both the `Masked Reader` and `Fine-Grained Reader` roles for the attached policy tags, BigQuery rejects queries referencing those protected columns with an access denied error. - **Centralized and dynamic without ETL overhead**: Policy tags are applied directly to column definitions in BigQuery schema metadata, eliminating the need to materialize and maintain separate ETL pipelines, duplicate tables, or complex authorized views. ### Key Advantages and Capabilities - **Runtime evaluation**: Obfuscation occurs on-the-fly when queries execute, ensuring visualizations reflect real-time underlying data without compromising privacy. - **Granular role separation**: Decouples dataset access permissions from sensitive column-level viewing rights using IAM policies attached directly to taxonomy nodes. - **Multiple masking algorithms**: Supports preconfigured algorithms such as default masking, hash (SHA-256), email masking, and nullification to fit distinct regulatory profiles. - **Centralized governance**: A single taxonomy policy tag can be reused across thousands of tables across different datasets and projects within an organization. ### Why This Is Optimal This approach directly leverages native Google Cloud governance mechanisms in Dataplex and BigQuery. It satisfies all multi-tiered persona requirements (auditors, analysts, and unauthorized users) with zero compute overhead for ETL duplication, unified IAM management, and native integration with visualization tools like Looker Studio.

Configure Dynamic Data Masking Dataplex Policy Tags | professional-cloud-data-engineer

Configure Dynamic Data Masking Dataplex Policy Tags

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization manages a BigQuery dataset containing a customer transactions table with sensitive Personally Identifiable Information (PII), including columns for tax_id, email_address, and credit_card_number. You are preparing this data for enterprise-wide visualization and reporting.

You have the following security and access requirements:

BI Analysts must be able to query the table to build dashboards and perform aggregations, but must only receive real-time obfuscated (masked) values for sensitive columns.
Compliance Auditors must be able to inspect and view the unmasked, cleartext values of these sensitive columns.
Unauthorized Users without explicit permissions must be blocked from querying the sensitive columns entirely.
The security controls must be centrally managed and applied dynamically at query runtime without maintaining duplicate tables, views, or ETL pipelines.

Which solution should you implement?

Create a taxonomy with policy tags in Dataplex and associate dynamic data masking rules with the tags. Attach the policy tags to the sensitive columns in BigQuery. Grant Compliance Auditors the Fine-Grained Reader role on the policy tags, and grant BI Analysts the Masked Reader role on the policy tags.

Create authorized views in BigQuery that use SQL hashing functions like SHA256() on sensitive columns. Grant BI Analysts access to the authorized views and grant Compliance Auditors direct access to the underlying base tables.

Configure an ongoing Cloud Data Loss Prevention (Cloud DLP) batch job to inspect the table and overwrite sensitive columns with pseudonymized tokens stored in an external Cloud KMS lookup table. Grant Auditors IAM access to the KMS decryption key.

Create a Cloud KMS customer-managed encryption key (CMEK) for each sensitive column. Grant Compliance Auditors the Cloud KMS CryptoKey Decrypter role and grant BI Analysts only BigQuery Job User permissions.

Professional Cloud Data Engineer

Configure Dynamic Data Masking Dataplex Policy Tags

Related questions