An enterprise is establishing a federated data governance model (data mesh) where autonomous domain teams build and deploy their own analytical data products across multiple Google Cloud projects. The central data platform team needs to implement a scalable, automated cross-system policy enforcement framework that: Automatically identifies and classifies sensitive Personally Identifiable Information (PII) across distributed data assets Standardizes business and security metadata annotations across domain teams without creating a centralized operational bottleneck Consistently restricts cleartext access to sensitive data attributes using fine-grained, policy-driven controls Which architectural solution should the central data platform and governance team implement?

Define centralized Sensitive Data Protection inspection templates to automatically scan and classify distributed data, publish standardized Data Catalog policy taxonomies, and enforce IAM fine-grained reader roles on BigQuery column-level policy tags.: ### What Centralized DLP and Policy Tag Governance Is Centralized policy enforcement in a **federated data governance model** combines automated sensitive data discovery with standardized metadata taxonomies. The central governance team defines global **Sensitive Data Protection** (Cloud DLP) inspection templates and centrally managed **Data Catalog policy taxonomies**, while allowing distributed domain teams to own and operate their data product pipelines independently. ### How it Meets All Requirements - **Automated PII identification and classification:** Centralized Sensitive Data Protection inspection templates automatically scan distributed storage locations (such as Cloud Storage and BigQuery tables) across multiple domain projects, identifying sensitive infoTypes without requiring domain-specific custom code. - **Standardized metadata annotations without bottlenecks:** Data governance tooling auto-generates metadata annotations and maps detected infoTypes directly to standardized **Data Catalog taxonomy tags**, ensuring enterprise-wide metadata consistency while eliminating manual tagging bottlenecks. - **Consistent fine-grained access restrictions:** Centralized taxonomies use **column-level access control** in BigQuery, enforcing fine-grained security policies where only users explicitly granted the `Fine-Grained Reader` role via **Cloud IAM** can view unmasked sensitive attributes. ### Key Advantages and Capabilities - **Automated Compliance Verification:** Bridges data discovery and access control by dynamically tagging assets and automatically verifying compliance. - **Decentralized Execution, Centralized Control:** Empowers autonomous domain data teams while maintaining strict, global security guardrails. - **Scalable Policy Administration:** Modifying an IAM binding or masking rule on a central policy tag instantly updates enforcement across all linked distributed columns. ### Why This Is Optimal This approach strikes the required balance in a data mesh architecture: it establishes central guardrails and automated compliance tooling without turning the central governance team into an operational bottleneck.

Cross System Policy Enforcement Federated Governance | professional-cloud-data-engineer

Cross System Policy Enforcement Federated Governance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is establishing a federated data governance model (data mesh) where autonomous domain teams build and deploy their own analytical data products across multiple Google Cloud projects. The central data platform team needs to implement a scalable, automated cross-system policy enforcement framework that:

Automatically identifies and classifies sensitive Personally Identifiable Information (PII) across distributed data assets
Standardizes business and security metadata annotations across domain teams without creating a centralized operational bottleneck
Consistently restricts cleartext access to sensitive data attributes using fine-grained, policy-driven controls

Which architectural solution should the central data platform and governance team implement?

Define centralized Sensitive Data Protection inspection templates to automatically scan and classify distributed data, publish standardized Data Catalog policy taxonomies, and enforce IAM fine-grained reader roles on BigQuery column-level policy tags.

Deploy Security Health Analytics detectors and VPC Service Controls perimeters around each domain project while restricting access using BigQuery authorized views.

Consolidate all distributed domain datasets into a single monolithic BigQuery project and use Cloud KMS customer-managed encryption keys (CMEK) to isolate table access per domain.

Require each domain team to manually maintain local schema definition files, assign dataset-level IAM reader permissions, and configure custom cryptographic hashing functions inside domain ETL pipelines.

Professional Cloud Data Engineer

Cross System Policy Enforcement Federated Governance

Related questions