An enterprise data engineering team is configuring a centralized Data Studio (Looker Studio) reporting dashboard connected to BigQuery. The dashboard will be shared with both internal business analysts who have report edit permissions and external stakeholders who have view-only access. The solution must satisfy the following governance and operational requirements: Report editors must be prevented from modifying the underlying data source connection parameters or viewing raw connection configurations. Data access must not break if the original author of the report or data source leaves the organization. External viewers must be able to view the aggregated dashboard data without requiring direct BigQuery IAM dataset permissions granted to their individual identities. Stakeholders with view access must be restricted from downloading, printing, or copying the dashboard data. Which configuration should the data engineering team implement?

Create reusable data sources using Service Account credentials to connect to BigQuery, and disable downloading, printing, and copying in the report's advanced sharing settings.: ### What Service Account Credentials and Reusable Data Sources Provide In **Data Studio (Looker Studio)**, managing enterprise reporting at scale requires separating report layout editing from underlying data connection management, ensuring credential persistence, and restricting data dissemination. Creating a **reusable data source** that authenticates using a dedicated **Google Cloud Service Account** satisfies these requirements seamlessly. ### How It Meets All Requirements - **Prevent Report Editors from Modifying Connections:** When a data source is created independently from the home page as a **reusable data source**, it exists as a separate asset with its own access control list (ACL). Report editors who are only granted access to edit the report layout cannot modify the data source connection settings or query parameters unless explicitly granted edit rights to that reusable asset. - **Prevent Disruption When Authors Leave:** Authenticating with **Service Account Credentials** binds the data connection to an organizational, non-human identity in Google Cloud rather than an individual employee's personal account (`Owner's Credentials`). If the report creator departs the organization, scheduled refreshes and report queries continue uninterrupted. - **Access Without Direct BigQuery IAM:** Service Account credentials allow authorized dashboard viewers to query the data through the service account's IAM role (`roles/bigquery.dataViewer` and `roles/bigquery.jobUser`), eliminating the need to grant individual GCP IAM access to external viewers. - **Data Exfiltration Prevention:** Disabling the download, print, and copy options within the sharing dialog's advanced settings enforces viewer restrictions, ensuring external stakeholders cannot export raw underlying tabular records or duplicate the asset. ### Key Advantages - Decouples data governance and schema management from report visual design. - Centralizes identity lifecycle management through standard Google Cloud IAM service accounts. - Prevents credential invalidation when staff roles change or personnel depart. - Provides fine-grained distribution control by preventing viewer copying, printing, or exporting. ### Why This Is Optimal This architecture establishes strict enterprise governance: reusable data sources lock down connection definitions, service accounts eliminate personal credential fragility, and advanced sharing settings prevent unauthorized data dissemination.

Data Studio Enterprise Reporting Governance Credentials | professional-cloud-data-engineer

Data Studio Enterprise Reporting Governance Credentials

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise data engineering team is configuring a centralized Data Studio (Looker Studio) reporting dashboard connected to BigQuery. The dashboard will be shared with both internal business analysts who have report edit permissions and external stakeholders who have view-only access.

The solution must satisfy the following governance and operational requirements:

Report editors must be prevented from modifying the underlying data source connection parameters or viewing raw connection configurations.
Data access must not break if the original author of the report or data source leaves the organization.
External viewers must be able to view the aggregated dashboard data without requiring direct BigQuery IAM dataset permissions granted to their individual identities.
Stakeholders with view access must be restricted from downloading, printing, or copying the dashboard data.

Which configuration should the data engineering team implement?

Create reusable data sources using Viewer's credentials to connect to BigQuery, and grant external stakeholders individual IAM BigQuery Data Viewer roles.

Create embedded data sources using Owner's credentials to connect to BigQuery, and enforce organization-wide restricted sharing via Google Workspace admin policies.

Create embedded data sources using Service Account credentials, and configure BigQuery authorized views while relying on default viewer sharing permissions.

Create reusable data sources using Service Account credentials to connect to BigQuery, and disable downloading, printing, and copying in the report's advanced sharing settings.

Professional Cloud Data Engineer

Data Studio Enterprise Reporting Governance Credentials

Related questions